Extracting prog: 5m44.54177472s Minimizing prog: 30m31.40627333s Simplifying prog options: 0s Extracting C: 42.471719163s Simplifying C: 11m0.767965308s extracting reproducer from 43 programs testing a last program of every proc single: executing 9 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socketpair$unix-sendmmsg$unix-pipe-splice-syz_mount_image$ext4 detailed listing: executing program 0: syz_emit_ethernet(0x11, &(0x7f0000000040)=ANY=[@ANYBLOB="908000000000000000e85a54e18cce88c12a5aef86fbe407ec59dce01930b084234c54d8829f1855c561b7d45d66ee7d690beaed3dc5619684"], 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000003580)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000380)="a1", 0x1}], 0x1, &(0x7f0000000800)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r0, @ANYBLOB="0000000014"], 0x30, 0x40400d1}}], 0x1, 0x810) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0xa85, 0xf) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000180)='./file0\x00', 0x4002, &(0x7f0000000000), 0x1, 0x75d, &(0x7f0000001240)="$eJzs3M1rHGUYAPBnptmmH7EbQfDjIEILLZRukubSnhov3gqFgtcakkkImWRDdlO7sWDrWajNRUEQ9ezRq1DqH+BNCgreBdEaD+JlZTab1KbZuO2m3ZL+fjDZ533nnXnehx3eZCAzAbyw3ip+JBFDEXEpIsrt/jQiDraiQxE3Nsat378+VWxJNJuXf0+Kw2K9Wd46V9L+PBqtQ+K1iLhbijj90aN5a43V+ck8z5bb7ZH6wtJIrbF6Zm5hcjabzRbHxs+PnhsfPzc6/r81vNplrSfePX/49g/vrK39+G391psDZ5KYaNUd7dq6PM2Okl37SzGxrX+xl2TPoU71AwDwfCn+zh9ob6Uox4FWBAAAAOwnzcEmAAAAsO8l0e8ZAAAAAE/X5v8BbD7b2+tzsI/rt7cjYnin/AOtZ4gjDkUpIo6sJw89mZBsHAY9uXEzIu5MbL/+vi6usBs9nnt0W/vhZ6QP9nh29sKdYv2Z2Gn9SbfWn9hh/RnYfHdCjzqvfw/yH+iw/l3qMsd3X7xe6pj/ZsQbAzvlT7byJx3yv9dl/ltrH99uBcce3df8KuLkjr9/kody7fJ+iImZuXzX1w/c/efUvd3qP9Ipf7J7/Utd1v/B+p/zndaSIv+p47t//zvlL66JT9rzSCPidvuzaK+1RjwYfXzhp+93q386ovkk3/+XXdb/yzeD17ocCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1pRAxFkla24jStVCKORsQrcSTNq7X66ZnqyuJ0sS9iOErpzFyejUZEeaOdFO2xVvygfXZbezwiXv758EbSuTyrTFXz6X4XDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJajETEUSVqJiDQi/iqnaaUSMdDFsYPPYH4AAADAHhnu9wQAAACAp879PwAAAOx/T3r/n+zxPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB97dLFi8XWXL9/fapoT19trMxXr56ZzmrzlYWVqcpUdXmpMlutzuZZZaq68OgZmgf+28qr1aWx87FybaSe1eojtcbqlYXqymL9ytzC5Gx2JSs9u9IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4DEOtLUkrEZG24jStVCJeiojhKCUzc3k2GhHHIuJeuTRYtMf6PWkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2XK2xOj+Z59myQPDCBjHwrJN+GBHPR+2dgn6vTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9EOtsTo/mefZcq3fMwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKC/0l+TiCi2k+UTQ9v3Hkz+Lrc+I+L9zy9/em2yXl8eK/r/2Oqvf9buP9uP+QMAAMAL4cLjDN68T9+8jwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOhWrbE6P5nn2XJvwYVorDaTDmP6XSMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBk/g0AAP//twHHZg==") program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-prlimit64-sched_setscheduler-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-syz_clone-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-sendmsg$nl_route_sched-bpf$PROG_LOAD detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10008, &(0x7f0000000080)={[{@debug}, {@resuid={'resuid', 0x3d, 0xee01}}]}, 0xff, 0x49e, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvbH/Qyo9WRBQEraCR+KOlBZWDBzSaeNDERA94rG1BZKGG1gRIo8UYPBoS78ajiX+BNy9GPRgTr5p4NCREe6F4qpmdGbpsd0u3tF3pfj7Jdt/bmd33vjPv7b6Z15kA2tZA+ieJ2BYRv0dEX5a9fYWB7Gl+bmbs5tzMWBILC2//nVTWuzE3M1asWrxva545VIoofZbE8WRpuVMXL50ZLZcnzuf5oemzHw5NXbz03Omzo6cmTk2cGzl27OiR4RdfGHl+TeJM47qx9+PJfXtef/fqm2Mnrr7307dptXbvz5ZXx3FHN+sEVMdAutX+WaioXfZkE3W/F2yvSiedLawITemIiHR3dVX6f190xOLO64vXPm1p5YB1lf42bWm8eHYB2MSSaHUNgNYofujT49/isUFDj/+F6y9HdOfp+bmZsflb8XdGKX+9ax3LH4iIE7P/fpU+otnzEAAAq1AZ2zxbb/xXit2V52yuY0c+h9IfEfdHxM6IeCAidkXEgxGVdR+KiIezNy/0rbD8gZr80vFP6VrdOq+RdPz3UtXYb74q/vypvyPPba/E35WcPF2eOJxvk0PRtSXNDy9Txvev/vZFo2XV47/0kZZfjAXzClzrrDlBNz46PbpWG+H65Yi9nfXiT27NBKQtYE9E7G3uo3cUidNPf7Ov0Up3jn8ZazDPtPB1xFPZ/p+NmvgLyfLzk0M9UZ44PFS0iqV+/vXKW43Kv6v418D1A49kicX9X7NGVUMrlyfOTzVfxpU/Pm94TLPa9t+dvFOZs/7l/ey1C6PT0+eHI7qTNyr54piu8vrI4nsvjE73pvli/bT9HzpYv//vzN+T7v90K6WNeH9EPBoRj+V1fzwiDkTEwWXi//GVJz5YJv4kkmjd/r8cMV73++9W++9PqufrV5HoOPPDd41mzFe2/4/GbOW7NlP5/ruDlVbwLjcfAAAA3BNKEbEtktJglh7YFqXS4GD2P/y74r5SeXJq+pmTkx+dG8+uEeiPrlJxpquv6nzocDKbf2KWH8nPFRfLj+Tnjb/s6K3kB8cmy+Mtjh3a3dbb+38U/T/1V0erawesO9drQfuq7f+lFtUD2Hgr+f13LACb0+39vyf909uqugAby/E/tK96/f+TmrzxP2xOS/v/n3VuWQdsRsb/0L70f2hf+j+0pWYu54/jjRb1REQztwUoLhZY/V0FelZ8hX+7JIo7XqxnWb1x6Ux3/kqUWhRpR5ONbVMk0h6zsYUu3kMFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgXvZfAAAA//8hId5P") prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000380)={'syztnl2\x00', &(0x7f0000000300)={'syztnl0\x00', 0x0, 0x29, 0x4, 0xfb, 0x7, 0x2, @mcast1, @dev={0xfe, 0x80, '\x00', 0x14}, 0x7, 0x780, 0x80000000, 0x2}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000003fc0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000003f80)={&(0x7f0000002380)=@newtfilter={0x1bcc, 0x2c, 0x100, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x9, 0x10}, {0xa, 0xc}, {0x8, 0xfff2}}, [@TCA_CHAIN={0x8, 0xb, 0x1}, @TCA_RATE={0x6, 0x5, {0x6, 0x42}}, @TCA_RATE={0x6, 0x5, {0x6, 0x6}}, @TCA_RATE={0x6, 0x5, {0x7f, 0x11}}, @filter_kind_options=@f_matchall={{0xd}, {0x12b0, 0x2, [@TCA_MATCHALL_ACT={0x12ac, 0x2, [@m_ife={0x1044, 0xf, 0x0, 0x0, {{0x8}, {0x1c, 0x2, 0x0, 0x1, [@TCA_IFE_SMAC={0xa}, @TCA_IFE_DMAC={0xa, 0x3, @broadcast}]}, {0x1004, 0x6, "fcc2688cb23b38ce503697e10c4eb82f74af8ca75f4abc0b1ace0886c67e6951d46a48801b887154b7f7628c2034e9beb58568eb7cce1f29f2c74b38910e5c3b112583523ec21d6ca7d0d966ab0cdea64881928228185aaedf6748628dcd56e9648f571731fd2b25e71552e4f5b7aa4e7bb9c2d4a8e9600b59bff11751739517028355585dcb0cb62bceb46cf283f8615e3b4a6c705243727463432b34e8329997150c752670ec19a46b122d67b168a35adc6139a07df256c6e12a4e95badf6b053ee9ff37f241b6338dddcff43b9bb0a41f772b3889542be71dcec698931a87fc76b9c11269929021fdc57b81d0d85305e0cdf4c3502eb4cb29511d7f59ac9a0a5c1ba45dd42cb71755fa785f0893fb3ebea42725fdd2125effe894611eaa18adb6ec8c7da926a6be0e7a5b53e8267d7a07f61000e225d055a5f5fe81727ea8ff3c7f5e644c8c60b0d927a1c6b15840dc42865f6f4470cd998e656e85f1a3edbf0d9fe2f70d9509498b00790d9715250f6c89b9a45bcf56dfdd1a883a8c01cb5fbc557cfa7148f6ec016f4b07ad7692538009f0ae019acab5d45f3f763c28f6404d76927780306cdd730dcae711906c61b9c7003fec7a88e88dc0490aa3106a5d1be131bb17fa7edf20902fa0ad97b4e146d2aa34c65366cbc2e11ca69e64d6c8bb177283df6cfee861f3d47542e6bdc9b9a700f4b60473a393756e40065438b5349048b162c76cdefb19a00aa00f30b620e87488f6c407ac886cc7f5ff815d4027cc6d2738500a3e517ee0c70f99e048594776aafa21e0459446a728fdfb8c07f1a53dbed9cf6b432bfe805e0991f61acc26a4d2e9fd89a7610ba2aef4bd550345ce389aa812c004307071bd3e20179d4cb5ff2db319afd85111c6f776e8ea8f58eca54115af874d41693bbd244bb751c8a7d14b199b3abe383a005964e888b8d7d247b3cb6d429a8f3b0a4c55e37077d2cf9faad22e0fd425d69b973efbf5fbb9d0f9fe6b12629d3a72b500b5f28b231ff0891b1b22533ed038e2a235c59938369e3076407d7f35802ed4a09effc311132887c4c651e1612c8d27bda7db7ed2d62ecd71e0d0a9dfb6c0dd20a8aaae14166e30c6a4b88e4d0849af5be90b156f9f1f1f66caadf7948a58610391af257cb75204f67b6438270d171674e1969657021a59e03d8b43dd0a0fc7770051006dd5e5698dec8e9b9595497eda0aa49b5236718478fea014dea2d96bab42f0fb13a76cf3356dba70bfecc5d18f6756cecd89d832a85359d7be52ac65ae1ef463f18669ed8766e6042c423febad3bcd4bf3d0270c1ed7794b14e6d900b2b2a5c5ca3e37418b239906d0fffdc1fcef43a37e17b5c7ac3fdb789bd49ee333ad630b6284727455cdc2f140b8c2ad4202805248789cebfb64120f55ad1b408f18c8191a42274d31110b325394c0a511c894401088a69f08f4332f546ff675394d143d379ad76ebaec69b8379f00cb81301307caf5482948c02398afdd37ea5cf29eec5b414953e5ba3078b976a7fe00686778e19329d6e463794d991be28d585b9f6050fe020e10e4b02ed653794fcecc380734fd1d97cc55596c96ae35531ee93a5abb3baaf97a3c064d9d4a6ace6a2c9f3023e015932c8677f9c13ecd8ce129489f281500822dc9349e6b05fad463a9aafb5497c327c757d229302bc39df53e31e7171a74f9f51b6121ac1f8888f56f07a80a9877d2e99ee49d374171bbff1c07e0ef3416e27ac5efb4c9ad9a96591c97f3634e2ab38a05550f32aaf480d18db9d11af04ae804969fd1478fae74a478a180f0ec8ada199e53a5c18f9f0cfbf4390c12e0285171370407542a0b8eb3344310f60893d5dacc4e06f3a955008073bc3627bb7f64456b146168e8c0da1f228cd723fa71c094623965f8e84b479dff2b798c091bee9c3544db7926439f3434d971377fcc74efe18e90e4963199f8787b4d1da22ee33c85e4a775df5e903d2affaaf9db5a11c327349ad7f6ab6e5f1a521be875e50b0f91bf9e06d954416e78c09fa1436fe0c0b80c12a97bcd71d5b5a917d03a01501455f267be79a99da899da841e889fedf896303fc4868b33cae56b1b50778cad3fa30fa489fd12012355ebd56ac766be36d49dae06761249b44e7f8979cc3cb11a700a82517295a1bb9fd9ada141fc68bf7ee2b3b7219060264a3e6bbe272d16feb2a524a5bf509bfb3f97b723c7a7d4904dafa0dbf30e3e3c163fa595687de9a39cbe8fbfb656970301c505afc3a67ac8587a690e84284ff3e83ba6194b47a2d19f958dfab88e5c0f32403c0133a823e3d064994b709b7ced4972110c0eee86605899c530e462b2ca0b80464266cc77a45f1d9385adc9bb83db175aeb432f40cbf4a0ee117ef4abd6c79333ae124bc96f88de58b9e966ad9c0ed8119da45280c571e6e26622cb9b3e0dbcde15eed1cda66ec18815f3cdc887e3f396bfc882192afee3cd892e55f66069158efc650bb934b69dd0e2568af32b6bf513ea6b4a94876b7308b3004b75f25e49d4213cf40309ed993aae15108ae0ed87f0c8163bf28421a08ed33fa985d02ef2490336fa17b4e350dd65167b4fb8031f87eb3aaa229a8002794d768a675ad309a3f4bf1c07eef8abf139b3362825bdd2e0f5faabab116729c1f9bdf8cdc894682c92a42660412445571c9ac58a51483f521c2a841a5ae8d8b9c356fe4fb131596819a0e3c853af5f8c6e85e5e3258642a702c1ca11e2b8c0857b4587e9dd10b33a545d03c3a3055a99d75cc692ab0240203cc900e8ffb464577ffc899be2757f10906a1842615401cb7997bbc314ba5ada8144d20e528a15376873840af2868dec7119da46415e99bac3359cb410b285fe03e1711a4af354a3aa3697f96beb0a96575a4c0a4c947d1c848072202b9c761a0e238d0958fb5457b457b2b923ba71a57967043489b46064155e73736a3b4943c090e339bbc387dadb77179ea5a4d88a4f52f8e1f6372e08ef5fbf3eb6da5d836f30713777f87bfd63ce55f2c7fe6a7422f2626b29f31be1e2891d1f1706ff2754c0ba2413e748ea176d35c1cae900621ac3ff15680a88b4add1953a65f1d6eed197898665113e1f43c51de8e4eb8bf16ba83c936a5c22cf09a4947bd118b6cd859c00d4633992555266b8d6c5eb3e4253e5ede4b9644dafc81b7977e454868c1e7ef1799bfb1931b0db4985ce94009d404dbb766d6f1d9ae4322f08e509e1792fa15aa53ae14daa39b8e0727ca4e633104fabe1a3284c0e8d11e4340744fca83ba9da117b3377e33f4f1cb12ee77b8c09e0f033771a846a4b8120399c1651306efb812f326c81ea926a54d3dd80c945a9cc4918ef58946930656b42099ab8c3f59ae6804c6a40e2093ad5b29d00ae7fbf64347a2411332912745835df4eef338b5de5e68cca82ee218c0fed4e0a4f035d4ed76e0863c5ad0192bdeec4ea70ec9dc5e599956a83d52a3739ef0e6f94caaeee9e777f110377d279ed42a6b7cb81eb17544dfa941e1b8c02725c0f39444971abfc41f9a890afef17f00a1e043e5a6cd70048cc911e1006c76a2ba83ebda02c02474528fa8888b696be6e0c113b025f0a5f9d2f2ef599df6b1b0c18994436d63264fdab957b2407004b8c75bcc423fd1138ab950780cc0b16acc7a987548d1254eb3c667dfff07bfb13306b88c2fcd0dbee43be8c51ecded08b13c02903c34a4841c28ecc27451f2f1f6586627ecd271ae7940b44fc3ea0c85fd62e14310f1d41a53314ca87c4627c5a014e141bbda24d6d8c767969e781c52e7bf050f3689a90916e9aed2e974c94007929974e1093418792318f3da025193063929c74bf3e95a6dcd1c4737235e976f0ca6cf204fb1f251670fa0f6746276bb541102bed734e837e41167501a5aa228a630f60990a2bd010294192a71d25d8baf31f67581e6bec69525445cbe29b02d01c7e2d8e38b588ad566719cb4ed37fa35a9802a6ab9b9dcafa52feff3e74e6ed25cf66cad2d707c7363eeacd8ac0d61078b3fe1708ebf5f110e2b748e7848d911b3013730b04cd863780aeb0ccc481e2c46c26024a8b525cb2dc27351e0dd9711da1a33364a5ed7ca4db7661fe00a19b096c968f1dd3fc8bbc5753894f85fc661b2bbd6db9f85321668caec6147e2d88e8c9a0249d9281e4a6fae3b468a1feca91418161641bbfc4da1cd7c101a068def9f2ddf7dcdd5977ebc6f86e06905c3afe4a5f6a5a2516f34612a67dad0b9c13f078ebb2692f9a4a28a32322db9e5d4a033043b74b58341048c304968eb4987094b213bee7e19ad873eeef9439da139da5630b041d030582d4d62a70021c8b1040b149dc7cd72d07be59dfec443b16255a251aeebd00e9985e186d8b01b0d1f6276a19d776cf190070c7edd9e57bcaf414b60e6bee0933c2832ef3bd0f52af35d0d8d140755349f681bf0865468b338ef3ff6f850daa28828ba87607a13a19f10a61d77a65c9a299121fff7e61498c1757cd8f94a0557f91923d235e9ffc4ca6ed70b8d0c1a534b99e667c29c127af9911aac670008cd63f71f8e7c185f4b4bff49505cca9a6de4d900261f6f02006ee4178bf0512c47164bce705993765678a4e2f5a7dabff582abecdd609fa080cea270b358dffd6bc10c3918aa4e7091a4e9bf799de47ddc6cffd765a502b8e2ec108e3c2a7ff6f74cb68b18e15ad693ea53919234999c4e0d74648495f5a780c557d32b645fba2ed9d01cec02513b0f1583686138d3c417e2aaed31a1335243a34068803230247df4242036e0bffbe36bd147b0e2cd7db728616c9f9d6591123ccb4fd6709f5fe00a05e9b8b5639c62e8d26f6a61b21ab7422d489a7b47b87273ec1702ca9516d91d9d7fced8a3e375904ca56e4987f96478f734a860be32d8d67d601e4c3d48f2c6b394d1649ee4209730537ad10fb52e9891b982d06ce5e66d16097c8697197228229076360f792bb0f5bd707dcd90e4f2ebc0f70541e34cb83b50c9d1375ff20bfb66c93ea882890f5b4c82fd32081bb630ba645f346e6d4ab8f1d59fefa07a1a1ecd4385cf1936c27b4e6da9f8459e65f92612095a609a43cf099837d6fb0b726e9edc6f66af68cfcce69e51f7495ec154025f09cc471fbf5887a3d5fe57151c6edb369a8c7ce95cfe71946ea059c1f53313297a8e6125bdb211f802c30dd5d475c413afcf2e422637efddae3e02305bffa3e87d09250ec88b340e4641b0a44d23b4214a9644d7e4ea8da48a2796a6e01a0c4d6d306082c6ebbd8c2d3a2b258cbbd6707955e93635e40a84159171d86ad2b42b25dd421d0fc7374bdbaba24d57531919fce40e850703337112e32143034a22885c5a984a913dceb6ba83258a0e26be06e10516adbb9f46ddc5eb8aab8bf253396551237c1a2a07a382f60f6c02c5bf368cbe7faa5c84194e903a4d85531a34ecb287cf782ada074ebec63f6bda34797fa57fa0d93f36c4a172f7dc7da76f4c0f7c0fe77e1b40804f6e4f630a6b0a6cbc9d8a6debf97ec2258853cac414e3d48049536f5909db2a9c0465979688705bf48441224b895f544691af010b4a48fa5a09475ff3aa0963443d585cec1078dbb649b8084a8220ec7ce21a59935f3a555554acd9f8284d6acfd4ae959adb0040fd0d5923cc641eac90499af15386f94b73d60a7825f175ca7b1375717bde449b699ec2302aff7f21a90de662f46a9fed8461b56682611e15fe1639bc3ee083190b3c3fd0388736ac184eb3f7ae7142cf1eb523ddfd2b2bbd831b0ede416f20c3b7c84981babc7da4d8b34"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_connmark={0xf8, 0xa, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5, 0x8, 0x4, 0x6, 0x81}, 0x9}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xd, 0x2, 0x5, 0x6, 0x2}, 0x4}}]}, {0x8f, 0x6, "02fc08097b54b76b72e4022c7e57280c7c79319c4c26b493f65f23a60ffd1d19626e6a9e1d9603e709acdee39bb7b6e8ed18e7606af635760c5c95b0cfb33045cae6dd15368a915b5dd6b722d1862c3c0f8b6338d77eabe9aa0181ec1381ab69d5b7cfec29015bce09c58fcc0863b9cc2a72444c2c95269d9845a47b33874ae5a13d125afc3149ce739241"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x4}}}}, @m_nat={0x16c, 0x12, 0x0, 0x0, {{0x8}, {0xa4, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x7704, 0x10, 0x6, 0x4931c61a, 0x9}, @multicast1, @multicast2, 0xffffff00}}, @TCA_NAT_PARMS={0x28, 0x1, {{0xa47, 0x8, 0xffffffffffffffff, 0xffff, 0x1}, @broadcast, @loopback, 0xff, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x9, 0x80, 0x5, 0x7, 0x5}, @rand_addr=0x64010102, @private=0xa010102}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x5, 0x4, 0x20000000, 0x7, 0xa4}, @multicast2, @remote, 0xff000000}}]}, {0xa1, 0x6, "def5f6926b5c0d51c6443bd607da5bb8942fcc44b899b90b3489608c58dcf8ceabbc5355600b38cc766e759f02be89b480aea3468ca05e20d4d3f45ed42d8d5a82ca5bcfd8b6a54edc90fd04afc0824674061c55193b5de98c55fb4dda69e742fd75d862700c599be9ea828e03a3789ff6e1f3d66ba3d5e2f9e48c866048f92ab05859f58ad6660934745f60d797d87dfc09158c2ba8d551d3d6de2536"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}]}]}}, @TCA_CHAIN={0x8}, @TCA_CHAIN={0x8, 0xb, 0x6e}, @filter_kind_options=@f_basic={{0xa}, {0x8ac, 0x2, [@TCA_BASIC_POLICE={0x5c, 0x4, [@TCA_POLICE_RATE64={0xc}, @TCA_POLICE_TBF={0x3c, 0x1, {0x40, 0x7, 0x3, 0xb799, 0x6, {0x40, 0x1, 0x10, 0x30, 0xbfb, 0x636}, {0x4, 0x1, 0x77ce, 0x7, 0x80, 0x4dd}, 0xfffff5be, 0x8, 0x7}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x40}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x3}]}, @TCA_BASIC_CLASSID={0x8, 0x1, {0x8, 0x9}}, @TCA_BASIC_CLASSID={0x8, 0x1, {0xc, 0x5}}, @TCA_BASIC_POLICE={0x830, 0x4, [@TCA_POLICE_AVRATE={0x8, 0x4, 0x1}, @TCA_POLICE_RATE64={0xc, 0x8, 0x8}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1220, 0xffff9cb8, 0x3, 0xa, 0x8, 0x4, 0xb, 0x1ff, 0x6bd, 0x7fff, 0xae, 0xffffffff, 0x3, 0x8000, 0x50000000, 0x8, 0x0, 0xd, 0x4, 0x7fff, 0x5cc, 0x5, 0x6, 0x8, 0x798, 0x7a7d, 0x101, 0x2, 0x42, 0xfff, 0x1, 0x6, 0x2, 0x100, 0x9f6, 0x80000000, 0x68, 0x1, 0x0, 0x2, 0x1000, 0x7954, 0xed86, 0x1, 0x2, 0x80000000, 0x3, 0x2, 0x743, 0x6, 0xfffffe00, 0x8001, 0x7, 0x5, 0x5, 0x2, 0x81, 0x4, 0x1, 0xfffffffb, 0x5, 0x6, 0x2, 0x9, 0x869, 0x7, 0x7, 0x5, 0x80000000, 0x9, 0x4, 0x0, 0x9, 0x0, 0x5, 0x1, 0x5, 0x80, 0x80000001, 0x8, 0x4, 0x200, 0xec70, 0x10000, 0xa, 0x8, 0x2, 0xfffffffb, 0x7, 0x3, 0xfffffff8, 0xa, 0x100, 0x7, 0x6, 0x6, 0x8000, 0xfffff927, 0x8, 0x6, 0x7, 0x6, 0xc, 0x9, 0x44ec, 0x1, 0x8, 0x7, 0x0, 0x5, 0x0, 0x5, 0x34f, 0x3, 0x6, 0x7, 0x2, 0xb, 0x40, 0x6, 0x13, 0x6, 0x100, 0x0, 0x6, 0x2, 0x6, 0x86, 0x8, 0x200, 0xfffffffb, 0x1d5, 0xf3f, 0x9, 0x1, 0x2, 0x2, 0x3, 0x1, 0x9, 0x2, 0x4846, 0xffffffff, 0x401, 0x5, 0x7, 0x1, 0xc9477a4, 0x40, 0xfffffffc, 0x6, 0x2, 0x1, 0x8, 0x1, 0x10001, 0x3, 0x1ff, 0x9, 0xb, 0xfffffff8, 0x7, 0x23d, 0xfffffffc, 0x0, 0x9, 0x4fb58713, 0xf, 0x78b, 0xff, 0xc0f, 0xd3, 0xffffffc0, 0x0, 0xff, 0x8, 0x2, 0x5003, 0x7ff, 0x9, 0x9, 0xb, 0x81, 0x8f4a, 0x9, 0x4, 0x530, 0x8f, 0x9, 0x1, 0x9, 0x2, 0x6, 0x8, 0x2, 0x0, 0x200, 0x6, 0x65, 0x5, 0x100, 0xe, 0x6, 0x80000000, 0x6f, 0x9, 0x3ff, 0x2, 0x6, 0x5, 0x7fffffff, 0x1ff, 0x10000, 0x3, 0x0, 0x6, 0x200, 0x3, 0x8, 0x3, 0x0, 0x9, 0x7fffffff, 0xd73, 0x4, 0x7, 0x7fff, 0x3, 0x2, 0x6, 0xf92, 0x5518cf22, 0xfff, 0xbf9, 0x9, 0xb3c1, 0x7, 0x4, 0x180, 0x3, 0x2, 0xa0, 0x7, 0x9, 0x5, 0x75e, 0x7, 0xd, 0x1, 0x6, 0x0, 0xffff, 0x9, 0x10, 0xfff, 0xdd]}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xfffffe00}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xea39}, @TCA_POLICE_RATE={0x404, 0x2, [0x100, 0x8, 0x0, 0xdd, 0x5, 0x2, 0x1, 0x8, 0x8, 0x7, 0x5, 0x101, 0x4, 0x200, 0x10, 0xfffffff8, 0x5, 0x4, 0x0, 0xfffffff3, 0x5, 0x9, 0x0, 0x6, 0x8, 0x6, 0x7, 0xd, 0x81, 0x7, 0x8, 0x5, 0x6e, 0x6, 0x8, 0x9, 0x271, 0x5, 0x3, 0x7ff, 0x6, 0x6, 0x90, 0x0, 0x6, 0xffff, 0x7, 0x1, 0x20ba8bb3, 0x7f, 0x8, 0x401, 0x12d, 0xe, 0x4, 0xfff, 0x5, 0x0, 0x8, 0x2, 0x4, 0x3, 0x8, 0x10001, 0x9, 0xa0000000, 0x2, 0x1, 0x1ff, 0x8, 0x1000, 0x7ff, 0x0, 0x4, 0x0, 0x6, 0x7, 0x1, 0x9, 0x3, 0x5, 0x80000001, 0x2, 0x8, 0x4, 0x6, 0x8, 0x1, 0x8, 0x1, 0xbe, 0x48000, 0x5ca0, 0x6, 0x5a87, 0x8001, 0x6, 0xf, 0x9, 0x8001, 0xffffffff, 0x1, 0x6, 0x40004, 0x1, 0x4, 0x0, 0xc, 0x0, 0x4, 0x2, 0xb1, 0x8, 0x200, 0x8, 0x5, 0x80, 0x5, 0x0, 0x5, 0xb, 0x9, 0xffffff89, 0x200, 0xfffffffb, 0xa, 0x9ec, 0x1ff, 0x800, 0x5, 0x10000, 0x4, 0x0, 0x99d, 0x6, 0xa, 0x9, 0x1, 0x5, 0xfd, 0x10, 0x4, 0x5, 0x8, 0x5, 0x21155f13, 0x1ff, 0xc1, 0x8, 0xfffff3df, 0x3, 0xff, 0x488, 0x0, 0x0, 0x3ff, 0x2, 0x2, 0x5, 0x4, 0x9, 0x400, 0x81, 0x3, 0x7fff, 0x7, 0x8, 0xffffff26, 0x5, 0xd, 0x8, 0x8, 0x5, 0x100, 0x10000, 0x3, 0x7, 0x3e, 0x5ebe, 0xe, 0xffffffff, 0xfffffff9, 0xa, 0x7, 0x401, 0x4, 0x5, 0x80000001, 0x1, 0x8, 0x54, 0x8, 0x0, 0xfffffff7, 0x2, 0x3, 0xffffffff, 0x80000000, 0x9, 0xc, 0x10, 0x6, 0x10, 0xffffffff, 0x7, 0x7, 0x800, 0x200, 0x1, 0x8, 0xb39, 0x1, 0x61, 0xffffffff, 0x9, 0xff, 0x9745, 0x10000, 0x82e, 0x3ff, 0xfffffff7, 0x0, 0x1, 0x7, 0xff, 0x6, 0x1, 0x67ab97b5, 0xa, 0xff, 0xfffeffff, 0x8378, 0x9, 0x2, 0x6, 0x3, 0x8, 0x7, 0xba0, 0x7, 0x4, 0xfffff26e, 0x9, 0x1000, 0x2, 0x9, 0x401, 0xe3a2, 0x8, 0x4, 0x2c6, 0x0, 0x4, 0x10001, 0x2e21045e, 0x46]}]}, @TCA_BASIC_EMATCHES={0xc, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}]}]}}]}, 0x1bcc}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000010) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0xe, 0x2000000000000230, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa300000000000007030000f1feffff720af0fff8ffffff71a4f0ff0000000071103d00000000007d400500000000002604000001ed00000f030000000000007c440000000000006b0a00fe000000007203000000000006b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f18564a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c26fc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccc99069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad24b89b6a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c87852730a3bd7ac923fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca4856ff03b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec860cde7c79f7b4d4e24c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b450100000001000000393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00400000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd599c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb80610eb37bd2d40ebdfed687f0b093e68f10b72146a0b749ee2105e2da94a288146abbbaf7c0b24fe0000000000000000f1a4f4de6a8d12dc9e71a20cbd412898586843b534d36e21379a8a06133c1babde9e5bd5b6afc5f684aada43ee560e800f58cb33b8483f6518abde7c86bd5d389c1b3c40fdd4bebe4adf87b1025ff57eb50984cc5bad9ea1c15484ea627c3c1501d612ed65939266e7332966f03e0376076e7c5dfe25f367dda7f69db89829b360dd2f59cbaad10f13e269eca792725bbacb96aa0a5c426ca76f84322661"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x5}, 0x8, 0x10, &(0x7f0000000000)={0x0, 0x100}, 0x10}, 0x94) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-mmap$IORING_OFF_SQ_RING-bpf$BPF_BTF_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$BPF_LINK_CREATE-add_key$keyring-openat-pwrite64-write$P9_RSTAT-add_key$keyring-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-capset-socket$inet6-openat$cgroup_root-bpf$BPF_PROG_QUERY-ioctl$sock_inet6_SIOCSIFDSTADDR-keyctl$KEYCTL_MOVE-open-getdents-keyctl$setperm-getdents-ioctl$VHOST_SET_VRING_BASE-bpf$MAP_CREATE-close-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-syz_mount_image$f2fs detailed listing: executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x46403, 0x0) r1 = mmap$IORING_OFF_SQ_RING(0x0, 0x2000, 0x6, 0x11, r0, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={&(0x7f0000005dc0)=ANY=[@ANYBLOB="dce301000000b193061771973099ef2c4d09113f9af50683e005f51e99ef4126787dfc0f490727b099527fcc964d93d5180eb7c7496d8c4610d294da7f00a2919876f7da856a0e3016ac247916ecb49c4cf2f64e396eaf475ff0bdb052d9c29d79705198b30b9d05d08e269b28445b31dd0b6d23ad7ee6fc30dcf155276770054e4a3d7b4e019a03ecf65b0ec3bf73df2f5663c3b63695328857a0bb2015da026c8a67d95703f3b94d7c869972e8b971108bbfc9c404c409f7c92d271f614e1043f24eaf1ee1054ccb8bd1f5b90d9f52e3e5de068ea087f1b09fef9f4580c8fa4137874dddd3a6aea24565ff01", @ANYRESOCT, @ANYRESDEC, @ANYRES32=r0, @ANYRES32=r0, @ANYRESHEX, @ANYRES16=r1, @ANYRES32=r1, @ANYRES32=r0], 0x0, 0x34}, 0x28) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_tracing={0x1a, 0x2, &(0x7f0000005d80)=ANY=[@ANYRES64=0x0], &(0x7f0000000180)='GPL\x00', 0x10000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x19, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r3, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000600)={r4, 0xffffffffffffffff, 0x33, 0x0, @void}, 0x10) r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) r6 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x64000, 0xc6) pwrite64(r6, &(0x7f0000000140)="f6", 0xffffff07, 0x8000c61) write$P9_RSTAT(r6, &(0x7f0000000380)=ANY=[@ANYRESHEX=r6], 0x4f) r7 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x2}, 0x0, 0x0, r5) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x0, 0x3, &(0x7f0000000440)=ANY=[], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x0, 0x5, 0xfffffffd}) r9 = socket$inet6(0xa, 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000004c0)={@map, 0x9, 0x1, 0x8, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x0, &(0x7f0000000100)=[0x0, 0x0], &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) ioctl$sock_inet6_SIOCSIFDSTADDR(r9, 0x8918, &(0x7f0000000080)={@empty, 0x18}) keyctl$KEYCTL_MOVE(0x1e, r5, r5, r7, 0x0) r10 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) keyctl$setperm(0x5, r7, 0x4002400) getdents(r10, &(0x7f0000001fc0)=""/184, 0xb8) ioctl$VHOST_SET_VRING_BASE(r10, 0x4008af12, &(0x7f0000000540)={0x2, 0x1ac}) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="02000000040000000400000001"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000010001000900000001"], 0x48) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000300)=ANY=[@ANYRES16=r8, @ANYRES32=r11, @ANYBLOB="0000000000000000b700010000007b8af8ff00000000bfa200000a00000007020000f8ffffffb703000020000056b7040000000000008500000001000000850000000500000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000001c0)={r12, 0xffffffffffffffff, 0x60000000}, 0xc) syz_mount_image$f2fs(&(0x7f0000000140), &(0x7f0000000080)='./file0\x00', 0x10020, &(0x7f0000005c80)=ANY=[@ANYBLOB="42dd0e171cb653e225a1c4f68df7b4cb969a1e3e2b921391fba02d84ed80bfbf1efa320a366131d5001cd3a8fc52c52c75f9db67f3423dec96f29f444e1ea7f83a68eac8b272daccdee2efb8d6535e54af095f38285e240a84000000000000000059d067e44a94623af96d842167f8a977ace4e9d94a39a4968ee5f6395f77d44edcf118bf3d7c44e3da764329b0e2b80aac8cac261f1d63"], 0x0, 0x556a, &(0x7f0000005f00)="$eJzs3M9vVNUXAPDzWgoF+uXbGBfueAkxaROmYcqP6A4VRI0QgrpwpdPOMBmY6WvaYaisWLg0LvxPjCauXPo3uHCrO+NC485EM+++FgqiYKdMKZ9P8ua8e9+dc+99IaTnzWQCeG7N5r//msWxOBwRkxExE7F1nm0OOp/CSxFxPCIm7juyqn+r42BEHImIY8Pk9/IML31xcnDi7C/v/Pbt94cOHP3ymx/Gt2tg3F6OiN5qOr/dS7Fop3ij6m8MOmXsnRlUMV3oTqfrvSL1324tlRluNzbHNcp4up3GF6u31ofxerexPIztzvWyf3UlTbg+aG/mKd9wo7FWtputpTJ21osytu+keTfupP/b7qz3U55mle+TMn30+5sx9bc2Wmk/qzfLuLzSjzj649a9KJqtjWEcVLGaLpaLbrNcx9J/vs173rudlVsb+aC1tt4pVvKzC/VXFurnavW1otnqt87UGr3muTP5XLs7HFbrtxq98+2iaHdbC8tFbz6fay8v1+r1fO5Ca6nTWMnr9YXTC6dqZ+ers5P5pSsf5N1mPjeMr3dWbvU73fX8erGWp3fM54sLp1+dz0/U8/cuX82vXrt48fLV9z+68OGV1y6//UY16KFl5XOLpxYXa/VTtcX6/D7a/3Rs7X/4d8BD+/+0WvQI9w87ko17AQDPnkfV/5n6H9hF/1b/Z/9Q//duVu1iEG/OPFj/r12L2P36P3Za/5f9Ka/6f4/Uv6n+n4gnrv8vzeyj/T/V5x+wI+p/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDn1k9TX71Vnsym9tGq/39V1wtVO4uIiYj4829MxsFtOSerPFOPGD/1wBq+y6LMMJzjUHUciYjz1fHH/3f7LgAAAMD+9fXd45+naj29zI57QexYdvexh6aHNhMzH49q6oiYmv15s/ngU54nNDF8eXHnq0qG/74PxMaIspVbmx5RsvTI7cAIEj3+HZ/cFqbvC1kKEyNYDgAAsMdsrwRGUYUAAACwN3027gUwHlnc+8yw+gL/oRSqDwQPb2sBAAAAz4x73w/PxroOAAAA4Gko63+//wcAAAD7W/r9PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOAvdu7mNnEgCgDws8EL+6dFq71vK3uDMraEHHOMKCBNUEAO1JAGqIHcUkIEER6HAOGQhMFWou+TzDDGvHnDz2Fm5AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHO6q+ZVXP29PjXOan2aPL0BAAAAjllW80n9ZJTq35vzP5tTv5t6ERFlRBwbu/fiy17MXhOner7+Zvf66iCH24g6wqaNQXN8i4h/zfHw69yfAgAAAHxei+lsnEbr6WHUdUK0KU3alD/+Z4pXREQ1uj9s4J3KTbw/GdKqbX7f/bjMFK2ewBpmCpam3Pq5or1K/Xfffj/DnaJIRXn0bdsks/UdAABoUW+vaHcUAgAAQJsuuk6AbhTxtJS5XQocpKJZ3vu6VwMAAAA+oKLrBAAAAIDsDu/prcf/Le3/t7b/HwAAAHQj7f8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAOS2r+WQxnY1fvNB/W5zV+jT5egQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI/szzsKhEAYhMHe9Z3J3P+w0qChsUkVCB9/YzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw5nd/+T8xNc4kc6+NpeeRZO3U2Do19s6Noz+Mr18DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcLE/BykMAkEQRSvJJNGdzP0PKwW68QIivAfCp5sWBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeKLX8eV9xqexJRmdNr4dzyS/rhr/rhpLDxprD+b17+OGFwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACws3P/vnFTcQDAn+3z9QcgQkAZghBIDLDQ9FpauiEGUMTAn4AUpdcSeuVHm4FWFSILG8rcBcGIEBIobP0fOrdSl7J1uKFIiPHQ89k5t43ggoRtks9Hen7fsxy/77OVKF8/JwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABANH5nFmdxszCN03LfnYc31mN/97E+urV9bzm2GCdNJv3/8FL9Q7LUXiIAAAAcHllV34cQ7uc7q7FPF4r6P6+OiTX/d89M46qef7zur/qq9o/t118evLA70MJ0nHjSCxuj4cknU+n9d7Pstmf/8YheceWLZy9ZcUPS97eeH+fF9Uy+uX373X4RHmkiWwDg3zhR9WVQ/T4U+0GbiQFwaPRqhXdV/2cL7eYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0ITxVniqipMQwnJvFkd3H95Y36u/tX1vuWpnb97cDl/NzhlPkYcQLmyMhicbnU23Xb12/dLaaDS80nzwcgihrdHfLqd/6cM5Dg6hleuz/+DPbqTRtSAtb/b8X3W0ze+LjgQt/lACAOBAyssW6/r7+c5q3JcshjD5/tH6/7VaHOas/x98dPZOfax6/T9obIbdt7J5+bOVq9euv7Fxee3i8OLwkzdPDd4anD535sy5leJZyYonJgAAAOzbZDKZ7H7ol61e/6eLT67/H6/FYc76//NvB1/WB87U/3uaLfq1nQkAAMDh9twrf/ye7LE/6fd7YW1z88rgi2Kb9PuhiE5Nty2kum9Hylav/7PFtrMCAAAAmjDeSh5Z/z9fi8Oc6/9P//DiT/VzZiGEY+X6/4n1T0fnm5tOpzXx58RtzxEAAIB2HStbff0/L97/T3dfeUhDCK+/Oo3LfwP4t/V/Xtb/2Xtf/1gfq/7+/+nmpthJ6dL0ehT9Ugi9pbYzAgAA4CA7WrZY7P+W76x+/PPxD/re/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABo2l8BAAD//w6dPoE=") program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_connect$midi-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-socket$inet_tcp-setsockopt$IP_VS_SO_SET_DELDEST-mmap-getsockopt$inet_tcp_int-mkdirat-socket$inet6-setsockopt$inet6_int-sendmmsg$inet6-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212000100001e000904"], 0x0) syz_usb_connect$midi(0x4, 0xa5, &(0x7f0000000140)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x93, 0x1, 0x1, 0x1, 0xf0, 0x5, "", {{{0x9, 0x4, 0x0, 0x0, 0x4, 0x1, 0x3, 0x10, 0x5, [@midi_in_jack={0x6, 0x24, 0x2, 0x3, 0x5, 0x27}, @midi_in_jack={0x6, 0x24, 0x2, 0x2, 0x7f, 0x42}, @midi_out_jack={0x17, 0x24, 0x3, 0x0, 0x3, 0x8, [{0x78, 0x9}, {0xcd, 0x4}, {0x1, 0x5}, {0xfa, 0x80}, {0x1, 0x44}, {0x8, 0x6}, {0x8, 0x97}, {0x81, 0xa}], 0xdd}, @ms_header={0x7, 0x24, 0x1, 0x6, 0x7}], [{{0x9, 0x5, 0x0, 0x3, 0x4ed5b632363e1136, 0x3, 0x10, 0xb0, {0x14, 0x25, 0x1, 0x10, "acd30897ee1cd411c6ca2128eb6f78ba"}}}, {{0x9, 0x5, 0x80, 0x1, 0x3ff, 0x81, 0x10, 0x8, {0xe, 0x25, 0x1, 0xa, "307268b5d68b51b3ccd9"}}}, {{0x9, 0x5, 0x0, 0x1, 0x3ff, 0x0, 0x9, 0x0, {0xc, 0x25, 0x1, 0x8, "ba72c82f5599e17d"}}}, {{0x9, 0x5, 0xd, 0x1, 0x400, 0x5, 0x4, 0xff, {0x5, 0x25, 0x1, 0x1, "cd"}}}]}}}}}]}}, &(0x7f00000005c0)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x291, 0x2, 0x1, 0x8, 0x10, 0x8}, 0x38, &(0x7f0000000240)={0x5, 0xf, 0x38, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x0, 0x2, 0x9, 0x2}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x7, 0x5, 0x6}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7, 0x5, 0x81, 0x8000}, @ss_container_id={0x14, 0x10, 0x4, 0x4, "44000c68730826d0d4037f5dfad1aa05"}, @ext_cap={0x7, 0x10, 0x2, 0x1c, 0x8, 0x5}]}, 0x7, [{0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x455}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x437}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x404}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x448}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0xc66}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x409}}, {0xd5, &(0x7f00000004c0)=@string={0xd5, 0x3, "83a9cd2a76cfac00d141905db222d8b168f634f5ab557b7f121746b3b9bd91b00bab665258592be4e3b7343f79ec16a05e51ee64d187f0d4000320038c6663a94dcaf30de2213872e90f7f960658638047be88a56ef2b65247308b506e20dda5b5904e2ebd114f7557dad97b89f713aee614acaf9bbb22f2ddc5ef693c0945491fd769f0b2db7955ddccbef53939ee464f43061e3550f670182501c8082cd6284dbf6a4b3f7cd9f776423a4d24ec1eaa4c3a70a088f018bbe48fa529351fad5d1c992ce12106d4ee0493167e989099e34f8cb6"}}]}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000080)={0x44, &(0x7f0000000480)=ANY=[@ANYBLOB="000a06"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x6, 0x9, &(0x7f0000000080)={{0x3c, @multicast2, 0x4e26, 0x880002, 'rr\x00', 0x8, 0x3, 0x7d}, {@dev={0xac, 0x14, 0x14, 0x2f}, 0x4e20, 0x12007, 0x8, 0x8, 0x2000050}}, 0x44) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x300000c, 0x204031, 0xffffffffffffffff, 0xffffd000) getsockopt$inet_tcp_int(r1, 0x6, 0x9, 0x0, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g1\x00', 0x1ed) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4e, &(0x7f00000000c0)=0xfffffff7, 0x4) sendmmsg$inet6(r2, &(0x7f0000001700)=[{{&(0x7f0000000100)={0xa, 0x4e21, 0x2, @local, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="24000000000000002900000032000000ff"], 0x28, 0x7ffffff7}}], 0x1, 0x4040) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-creat-open-socket$unix-socket$inet6_udp-ioctl$SECCOMP_IOCTL_NOTIF_RECV-socketpair$unix-recvmmsg-socket$inet6_udp-socket$netlink-sendmsg$nl_route detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f00000000c0)={[{@grpid}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x7}}, {@nodioread_nolock}, {@test_dummy_encryption}, {@lazytime}, {@stripe}, {@i_version}, {@orlov}]}, 0x4, 0xbaf, &(0x7f00000017c0)="$eJzs3M1rXFUbAPDn3ny2zftO+vIi1k0jIi2o07SSYotgKxU3LgTdCg3ppIRMP0giNWkWE/0HRF0LbgS1KF3YdTcKbt1o3VpcCEVioyCikTsfSWxmkrSd5Ibk94Mz95w5d+Z5nrlM7j0wNwHsWgPZQxpxICLOJhGF+vNpRHRXe70Rldp+C/OzI7/Pz44ksbj42i9JJBFxd352pPFeSX27rz7ojYhvX0zif++sjjs5PTM+XC6XJurjI1MXLh+ZnJ55ZuzC8PnS+dLFo8efGzo2dHzwxFDbav3jx1M3fnv85Z8qf37617Vf3/84iVPRV59bWUe7DMTA0meyUmdEDLc7WE466vWsrDPpXOdF6SYnBQBAS+mKa7hHohAdsXzxVoivvss1OQAAAKAtFjsiFgEAAIAdLrH+BwAAgB2u8TuAu/OzI42W7y8Sttad0xHRX6t/od5qM51RqW57oysi9t5NYuVtrUntZQ9tICJu/3Dii6zFJt2HvJbKXEQ82uz4J9X6+6t3ca+uP42IwTbEH7hnvN3qf7q7df2n2hA/7/oB2J1unq6dyFaf/9Kl659ocv7rbHLuehB5n/8a138Lq67/luvvaHH99+oGY1z95MMrreay+p+/8dLnjZbFz7YPVdR9uDMX8Vhns/qTpfqTFvWf3WCMwt9XSq3m8q5/8aOIQ9G8/oZk7f9PdGR0rFwarD02jTH3zdBnreLnXX92/Pe2qH+94395gzHeOHPmequ59etPf+5OXq/2uuvPvDU8NTVxNKI7eWX188fqN7S30Nin8R5Z/YefWPv736z+LESl/jlka4G5+jYbv31PzBeuXf1yrfqztV+ex//cAx7/dzcY48mv3zvcam7l+jdrWfzbSW0tDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANaUT0RZIWl/ppWixG7IuI/8fetHxpcuqp0UtvXjyXzUX0R1c6OlYuDUZEoTZOsvHRan95fOye8bMRsT8iPijsqY6LI5fK5/IuHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCX7IqIvkrQYEWlELBTStFjMOysAAACg7frzTgAAAADYdNb/AAAAsPNZ/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDJ9h+8eSuJiMrJPdWW6a7PdeWaGbDZ0rwTAHLTkXcCQG46804AyM19rvFdLsAOlKwz39typqftuQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwfR06cPNWEhGVk3uqLdNdn+tq+oqDW5gdsJnSvBMActOx1mTn1uUBbD1fcdi9mq/xgd0kWWe+d3mfyr9nejYtJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC2n75qS9JiRKTVfpoWixH/iYj+6EpGx8qlwYj4b0R8X+jqycY9eScNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA201Oz4wPl8ulCR0dnXw7yfZIo9bJ+y8TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5mJyeGR8ul0sTk3lnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAORtcnpmfLhcLk1soHP9fnZe0cm7RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8vNPAAAA///5ZQ4Q") creat(&(0x7f0000000040)='./bus\x00', 0x0) r0 = open(&(0x7f0000000340)='./file1\x00', 0x86442, 0x10) socket$unix(0x1, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000180)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="ec00000010000108000000008100000000000000", @ANYRES32=r2, @ANYBLOB="0b00000000000000cc001a8018000a8014000700fe", @ANYRES16=r2], 0xec}}, 0xc804) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-creat-open-socket$unix-socket$inet6_udp-ioctl$SECCOMP_IOCTL_NOTIF_RECV-socketpair$unix-recvmmsg-socket$inet6_udp-socket$netlink-sendmsg$nl_route detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f00000000c0)={[{@grpid}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x7}}, {@nodioread_nolock}, {@test_dummy_encryption}, {@lazytime}, {@stripe}, {@i_version}, {@orlov}]}, 0x4, 0xbaf, &(0x7f00000017c0)="$eJzs3M1rXFUbAPDn3ny2zftO+vIi1k0jIi2o07SSYotgKxU3LgTdCg3ppIRMP0giNWkWE/0HRF0LbgS1KF3YdTcKbt1o3VpcCEVioyCikTsfSWxmkrSd5Ibk94Mz95w5d+Z5nrlM7j0wNwHsWgPZQxpxICLOJhGF+vNpRHRXe70Rldp+C/OzI7/Pz44ksbj42i9JJBFxd352pPFeSX27rz7ojYhvX0zif++sjjs5PTM+XC6XJurjI1MXLh+ZnJ55ZuzC8PnS+dLFo8efGzo2dHzwxFDbav3jx1M3fnv85Z8qf37617Vf3/84iVPRV59bWUe7DMTA0meyUmdEDLc7WE466vWsrDPpXOdF6SYnBQBAS+mKa7hHohAdsXzxVoivvss1OQAAAKAtFjsiFgEAAIAdLrH+BwAAgB2u8TuAu/OzI42W7y8Sttad0xHRX6t/od5qM51RqW57oysi9t5NYuVtrUntZQ9tICJu/3Dii6zFJt2HvJbKXEQ82uz4J9X6+6t3ca+uP42IwTbEH7hnvN3qf7q7df2n2hA/7/oB2J1unq6dyFaf/9Kl659ocv7rbHLuehB5n/8a138Lq67/luvvaHH99+oGY1z95MMrreay+p+/8dLnjZbFz7YPVdR9uDMX8Vhns/qTpfqTFvWf3WCMwt9XSq3m8q5/8aOIQ9G8/oZk7f9PdGR0rFwarD02jTH3zdBnreLnXX92/Pe2qH+94395gzHeOHPmequ59etPf+5OXq/2uuvPvDU8NTVxNKI7eWX188fqN7S30Nin8R5Z/YefWPv736z+LESl/jlka4G5+jYbv31PzBeuXf1yrfqztV+ex//cAx7/dzcY48mv3zvcam7l+jdrWfzbSW0tDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANaUT0RZIWl/ppWixG7IuI/8fetHxpcuqp0UtvXjyXzUX0R1c6OlYuDUZEoTZOsvHRan95fOye8bMRsT8iPijsqY6LI5fK5/IuHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCX7IqIvkrQYEWlELBTStFjMOysAAACg7frzTgAAAADYdNb/AAAAsPNZ/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDJ9h+8eSuJiMrJPdWW6a7PdeWaGbDZ0rwTAHLTkXcCQG46804AyM19rvFdLsAOlKwz39typqftuQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwfR06cPNWEhGVk3uqLdNdn+tq+oqDW5gdsJnSvBMActOx1mTn1uUBbD1fcdi9mq/xgd0kWWe+d3mfyr9nejYtJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC2n75qS9JiRKTVfpoWixH/iYj+6EpGx8qlwYj4b0R8X+jqycY9eScNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA201Oz4wPl8ulCR0dnXw7yfZIo9bJ+y8TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5mJyeGR8ul0sTk3lnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAORtcnpmfLhcLk1soHP9fnZe0cm7RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8vNPAAAA///5ZQ4Q") creat(&(0x7f0000000040)='./bus\x00', 0x0) r0 = open(&(0x7f0000000340)='./file1\x00', 0x86442, 0x10) socket$unix(0x1, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000180)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="ec00000010000108000000008100000000000000", @ANYRES32=r2, @ANYBLOB="0b00000000000000cc001a8018000a8014000700fe", @ANYRES16=r2], 0xec}}, 0xc804) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE2-syz_usb_connect$midi-bpf$MAP_CREATE-ioctl$FIDEDUPERANGE-openat$vhost_vsock-unshare-mprotect-ioctl$VHOST_SET_VRING_CALL detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b00000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d0005007e0500000603000003000000fcffffff05010905a10105091901290a150025017501950a8102950175068103c0"], 0x135) syz_usb_connect$midi(0x5, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000088c0d0c004000010203010902"], 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) unshare(0x20000400) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f0000000180)={0x1}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_BALANCE_V2-socket$nl_generic-syz_genetlink_get_family_id$wireguard-sendmsg$WG_CMD_SET_DEVICE-mount$incfs-mount$9p_tcp-chdir-lremovexattr-mprotect-openat$procfs-openat$tun-ioctl$TUNSETIFF-dup detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000000440)={r6, 0x6, 0x6}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001080)={0x8, 0x5, {0xffffffff, @usage=0x55c6, r3, 0x6935, 0x8, 0x5, 0x9, 0x7, 0x44b, @struct={0x2, 0x80000001}, 0x8, 0xfffffffe, [0x8000000000000001, 0x800, 0x3, 0x2, 0x1, 0x3]}, {0x3, @struct={0x6, 0x5}, r4, 0x1, 0x9000, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x4, @usage=0x2, 0x883a, 0x401, [0x80000000, 0x5, 0x4, 0x5, 0x4]}, {0x2, @usage=0x2, r6, 0xfffffffffffffff8, 0x15d, 0x80b6, 0x4, 0x7, 0x20, @struct={0x8, 0x8}, 0x0, 0xff4, [0xa, 0x1c0, 0xae6, 0xfa, 0x7, 0xfffffffffffffff8]}, {0x6ee3, 0x5a8, 0x1}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)={0xa4, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x7c, 0x8, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x9, @mcast2, 0x5d}}, @WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}]}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x404c844}, 0x40000) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) mount$9p_tcp(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x200008, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') lremovexattr(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000100)=@known='user.incfs.metadata\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/tty/ldiscs\x00', 0x0, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) dup(r9) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir single: successfully extracted reproducer found reproducer with 27 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_BALANCE_V2-socket$nl_generic-syz_genetlink_get_family_id$wireguard-sendmsg$WG_CMD_SET_DEVICE-mount$incfs-mount$9p_tcp-chdir-lremovexattr-mprotect-openat$procfs-openat$tun-ioctl$TUNSETIFF detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000000440)={r6, 0x6, 0x6}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001080)={0x8, 0x5, {0xffffffff, @usage=0x55c6, r3, 0x6935, 0x8, 0x5, 0x9, 0x7, 0x44b, @struct={0x2, 0x80000001}, 0x8, 0xfffffffe, [0x8000000000000001, 0x800, 0x3, 0x2, 0x1, 0x3]}, {0x3, @struct={0x6, 0x5}, r4, 0x1, 0x9000, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x4, @usage=0x2, 0x883a, 0x401, [0x80000000, 0x5, 0x4, 0x5, 0x4]}, {0x2, @usage=0x2, r6, 0xfffffffffffffff8, 0x15d, 0x80b6, 0x4, 0x7, 0x20, @struct={0x8, 0x8}, 0x0, 0xff4, [0xa, 0x1c0, 0xae6, 0xfa, 0x7, 0xfffffffffffffff8]}, {0x6ee3, 0x5a8, 0x1}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)={0xa4, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x7c, 0x8, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x9, @mcast2, 0x5d}}, @WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}]}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x404c844}, 0x40000) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) mount$9p_tcp(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x200008, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') lremovexattr(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000100)=@known='user.incfs.metadata\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/tty/ldiscs\x00', 0x0, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_BALANCE_V2-socket$nl_generic-syz_genetlink_get_family_id$wireguard-sendmsg$WG_CMD_SET_DEVICE-mount$incfs-mount$9p_tcp-chdir-lremovexattr-mprotect-openat$procfs-openat$tun detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000000440)={r6, 0x6, 0x6}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001080)={0x8, 0x5, {0xffffffff, @usage=0x55c6, r3, 0x6935, 0x8, 0x5, 0x9, 0x7, 0x44b, @struct={0x2, 0x80000001}, 0x8, 0xfffffffe, [0x8000000000000001, 0x800, 0x3, 0x2, 0x1, 0x3]}, {0x3, @struct={0x6, 0x5}, r4, 0x1, 0x9000, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x4, @usage=0x2, 0x883a, 0x401, [0x80000000, 0x5, 0x4, 0x5, 0x4]}, {0x2, @usage=0x2, r6, 0xfffffffffffffff8, 0x15d, 0x80b6, 0x4, 0x7, 0x20, @struct={0x8, 0x8}, 0x0, 0xff4, [0xa, 0x1c0, 0xae6, 0xfa, 0x7, 0xfffffffffffffff8]}, {0x6ee3, 0x5a8, 0x1}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)={0xa4, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x7c, 0x8, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x9, @mcast2, 0x5d}}, @WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}]}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x404c844}, 0x40000) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) mount$9p_tcp(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x200008, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') lremovexattr(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000100)=@known='user.incfs.metadata\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/tty/ldiscs\x00', 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_BALANCE_V2-socket$nl_generic-syz_genetlink_get_family_id$wireguard-sendmsg$WG_CMD_SET_DEVICE-mount$incfs-mount$9p_tcp-chdir-lremovexattr-mprotect-openat$procfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000000440)={r6, 0x6, 0x6}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001080)={0x8, 0x5, {0xffffffff, @usage=0x55c6, r3, 0x6935, 0x8, 0x5, 0x9, 0x7, 0x44b, @struct={0x2, 0x80000001}, 0x8, 0xfffffffe, [0x8000000000000001, 0x800, 0x3, 0x2, 0x1, 0x3]}, {0x3, @struct={0x6, 0x5}, r4, 0x1, 0x9000, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x4, @usage=0x2, 0x883a, 0x401, [0x80000000, 0x5, 0x4, 0x5, 0x4]}, {0x2, @usage=0x2, r6, 0xfffffffffffffff8, 0x15d, 0x80b6, 0x4, 0x7, 0x20, @struct={0x8, 0x8}, 0x0, 0xff4, [0xa, 0x1c0, 0xae6, 0xfa, 0x7, 0xfffffffffffffff8]}, {0x6ee3, 0x5a8, 0x1}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)={0xa4, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x7c, 0x8, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x9, @mcast2, 0x5d}}, @WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}]}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x404c844}, 0x40000) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) mount$9p_tcp(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x200008, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') lremovexattr(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000100)=@known='user.incfs.metadata\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/tty/ldiscs\x00', 0x0, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_BALANCE_V2-socket$nl_generic-syz_genetlink_get_family_id$wireguard-sendmsg$WG_CMD_SET_DEVICE-mount$incfs-mount$9p_tcp-chdir-lremovexattr-mprotect detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000000440)={r6, 0x6, 0x6}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001080)={0x8, 0x5, {0xffffffff, @usage=0x55c6, r3, 0x6935, 0x8, 0x5, 0x9, 0x7, 0x44b, @struct={0x2, 0x80000001}, 0x8, 0xfffffffe, [0x8000000000000001, 0x800, 0x3, 0x2, 0x1, 0x3]}, {0x3, @struct={0x6, 0x5}, r4, 0x1, 0x9000, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x4, @usage=0x2, 0x883a, 0x401, [0x80000000, 0x5, 0x4, 0x5, 0x4]}, {0x2, @usage=0x2, r6, 0xfffffffffffffff8, 0x15d, 0x80b6, 0x4, 0x7, 0x20, @struct={0x8, 0x8}, 0x0, 0xff4, [0xa, 0x1c0, 0xae6, 0xfa, 0x7, 0xfffffffffffffff8]}, {0x6ee3, 0x5a8, 0x1}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)={0xa4, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x7c, 0x8, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x9, @mcast2, 0x5d}}, @WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}]}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x404c844}, 0x40000) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) mount$9p_tcp(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x200008, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') lremovexattr(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000100)=@known='user.incfs.metadata\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_BALANCE_V2-socket$nl_generic-syz_genetlink_get_family_id$wireguard-sendmsg$WG_CMD_SET_DEVICE-mount$incfs-mount$9p_tcp-chdir-lremovexattr detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000000440)={r6, 0x6, 0x6}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001080)={0x8, 0x5, {0xffffffff, @usage=0x55c6, r3, 0x6935, 0x8, 0x5, 0x9, 0x7, 0x44b, @struct={0x2, 0x80000001}, 0x8, 0xfffffffe, [0x8000000000000001, 0x800, 0x3, 0x2, 0x1, 0x3]}, {0x3, @struct={0x6, 0x5}, r4, 0x1, 0x9000, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x4, @usage=0x2, 0x883a, 0x401, [0x80000000, 0x5, 0x4, 0x5, 0x4]}, {0x2, @usage=0x2, r6, 0xfffffffffffffff8, 0x15d, 0x80b6, 0x4, 0x7, 0x20, @struct={0x8, 0x8}, 0x0, 0xff4, [0xa, 0x1c0, 0xae6, 0xfa, 0x7, 0xfffffffffffffff8]}, {0x6ee3, 0x5a8, 0x1}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)={0xa4, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x7c, 0x8, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x9, @mcast2, 0x5d}}, @WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}]}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x404c844}, 0x40000) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) mount$9p_tcp(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x200008, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') lremovexattr(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000100)=@known='user.incfs.metadata\x00') program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_BALANCE_V2-socket$nl_generic-syz_genetlink_get_family_id$wireguard-sendmsg$WG_CMD_SET_DEVICE-mount$incfs-mount$9p_tcp-chdir detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000000440)={r6, 0x6, 0x6}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001080)={0x8, 0x5, {0xffffffff, @usage=0x55c6, r3, 0x6935, 0x8, 0x5, 0x9, 0x7, 0x44b, @struct={0x2, 0x80000001}, 0x8, 0xfffffffe, [0x8000000000000001, 0x800, 0x3, 0x2, 0x1, 0x3]}, {0x3, @struct={0x6, 0x5}, r4, 0x1, 0x9000, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x4, @usage=0x2, 0x883a, 0x401, [0x80000000, 0x5, 0x4, 0x5, 0x4]}, {0x2, @usage=0x2, r6, 0xfffffffffffffff8, 0x15d, 0x80b6, 0x4, 0x7, 0x20, @struct={0x8, 0x8}, 0x0, 0xff4, [0xa, 0x1c0, 0xae6, 0xfa, 0x7, 0xfffffffffffffff8]}, {0x6ee3, 0x5a8, 0x1}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)={0xa4, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x7c, 0x8, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x9, @mcast2, 0x5d}}, @WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}]}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x404c844}, 0x40000) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) mount$9p_tcp(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x200008, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_BALANCE_V2-socket$nl_generic-syz_genetlink_get_family_id$wireguard-sendmsg$WG_CMD_SET_DEVICE-mount$incfs-mount$9p_tcp detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000000440)={r6, 0x6, 0x6}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001080)={0x8, 0x5, {0xffffffff, @usage=0x55c6, r3, 0x6935, 0x8, 0x5, 0x9, 0x7, 0x44b, @struct={0x2, 0x80000001}, 0x8, 0xfffffffe, [0x8000000000000001, 0x800, 0x3, 0x2, 0x1, 0x3]}, {0x3, @struct={0x6, 0x5}, r4, 0x1, 0x9000, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x4, @usage=0x2, 0x883a, 0x401, [0x80000000, 0x5, 0x4, 0x5, 0x4]}, {0x2, @usage=0x2, r6, 0xfffffffffffffff8, 0x15d, 0x80b6, 0x4, 0x7, 0x20, @struct={0x8, 0x8}, 0x0, 0xff4, [0xa, 0x1c0, 0xae6, 0xfa, 0x7, 0xfffffffffffffff8]}, {0x6ee3, 0x5a8, 0x1}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)={0xa4, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x7c, 0x8, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x9, @mcast2, 0x5d}}, @WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}]}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x404c844}, 0x40000) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) mount$9p_tcp(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x200008, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_BALANCE_V2-socket$nl_generic-syz_genetlink_get_family_id$wireguard-sendmsg$WG_CMD_SET_DEVICE-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000000440)={r6, 0x6, 0x6}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001080)={0x8, 0x5, {0xffffffff, @usage=0x55c6, r3, 0x6935, 0x8, 0x5, 0x9, 0x7, 0x44b, @struct={0x2, 0x80000001}, 0x8, 0xfffffffe, [0x8000000000000001, 0x800, 0x3, 0x2, 0x1, 0x3]}, {0x3, @struct={0x6, 0x5}, r4, 0x1, 0x9000, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x4, @usage=0x2, 0x883a, 0x401, [0x80000000, 0x5, 0x4, 0x5, 0x4]}, {0x2, @usage=0x2, r6, 0xfffffffffffffff8, 0x15d, 0x80b6, 0x4, 0x7, 0x20, @struct={0x8, 0x8}, 0x0, 0xff4, [0xa, 0x1c0, 0xae6, 0xfa, 0x7, 0xfffffffffffffff8]}, {0x6ee3, 0x5a8, 0x1}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)={0xa4, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x7c, 0x8, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x9, @mcast2, 0x5d}}, @WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}]}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x404c844}, 0x40000) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_BALANCE_V2-socket$nl_generic-syz_genetlink_get_family_id$wireguard-sendmsg$WG_CMD_SET_DEVICE detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000000440)={r6, 0x6, 0x6}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001080)={0x8, 0x5, {0xffffffff, @usage=0x55c6, r3, 0x6935, 0x8, 0x5, 0x9, 0x7, 0x44b, @struct={0x2, 0x80000001}, 0x8, 0xfffffffe, [0x8000000000000001, 0x800, 0x3, 0x2, 0x1, 0x3]}, {0x3, @struct={0x6, 0x5}, r4, 0x1, 0x9000, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x4, @usage=0x2, 0x883a, 0x401, [0x80000000, 0x5, 0x4, 0x5, 0x4]}, {0x2, @usage=0x2, r6, 0xfffffffffffffff8, 0x15d, 0x80b6, 0x4, 0x7, 0x20, @struct={0x8, 0x8}, 0x0, 0xff4, [0xa, 0x1c0, 0xae6, 0xfa, 0x7, 0xfffffffffffffff8]}, {0x6ee3, 0x5a8, 0x1}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)={0xa4, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x7c, 0x8, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x9, @mcast2, 0x5d}}, @WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}]}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x404c844}, 0x40000) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_BALANCE_V2-socket$nl_generic-syz_genetlink_get_family_id$wireguard-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000000440)={r6, 0x6, 0x6}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001080)={0x8, 0x5, {0xffffffff, @usage=0x55c6, r3, 0x6935, 0x8, 0x5, 0x9, 0x7, 0x44b, @struct={0x2, 0x80000001}, 0x8, 0xfffffffe, [0x8000000000000001, 0x800, 0x3, 0x2, 0x1, 0x3]}, {0x3, @struct={0x6, 0x5}, r4, 0x1, 0x9000, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x4, @usage=0x2, 0x883a, 0x401, [0x80000000, 0x5, 0x4, 0x5, 0x4]}, {0x2, @usage=0x2, r6, 0xfffffffffffffff8, 0x15d, 0x80b6, 0x4, 0x7, 0x20, @struct={0x8, 0x8}, 0x0, 0xff4, [0xa, 0x1c0, 0xae6, 0xfa, 0x7, 0xfffffffffffffff8]}, {0x6ee3, 0x5a8, 0x1}}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_BALANCE_V2-socket$nl_generic-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000000440)={r6, 0x6, 0x6}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001080)={0x8, 0x5, {0xffffffff, @usage=0x55c6, r3, 0x6935, 0x8, 0x5, 0x9, 0x7, 0x44b, @struct={0x2, 0x80000001}, 0x8, 0xfffffffe, [0x8000000000000001, 0x800, 0x3, 0x2, 0x1, 0x3]}, {0x3, @struct={0x6, 0x5}, r4, 0x1, 0x9000, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x4, @usage=0x2, 0x883a, 0x401, [0x80000000, 0x5, 0x4, 0x5, 0x4]}, {0x2, @usage=0x2, r6, 0xfffffffffffffff8, 0x15d, 0x80b6, 0x4, 0x7, 0x20, @struct={0x8, 0x8}, 0x0, 0xff4, [0xa, 0x1c0, 0xae6, 0xfa, 0x7, 0xfffffffffffffff8]}, {0x6ee3, 0x5a8, 0x1}}) socket$nl_generic(0x10, 0x3, 0x10) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_BALANCE_V2-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f0000000440)={r6, 0x6, 0x6}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000001080)={0x8, 0x5, {0xffffffff, @usage=0x55c6, r3, 0x6935, 0x8, 0x5, 0x9, 0x7, 0x44b, @struct={0x2, 0x80000001}, 0x8, 0xfffffffe, [0x8000000000000001, 0x800, 0x3, 0x2, 0x1, 0x3]}, {0x3, @struct={0x6, 0x5}, r4, 0x1, 0x9000, 0x6, 0xfffffffffffffffd, 0xfffffffffffffff7, 0x4, @usage=0x2, 0x883a, 0x401, [0x80000000, 0x5, 0x4, 0x5, 0x4]}, {0x2, @usage=0x2, r6, 0xfffffffffffffff8, 0x15d, 0x80b6, 0x4, 0x7, 0x20, @struct={0x8, 0x8}, 0x0, 0xff4, [0xa, 0x1c0, 0xae6, 0xfa, 0x7, 0xfffffffffffffff8]}, {0x6ee3, 0x5a8, 0x1}}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-ioctl$BTRFS_IOC_SCRUB-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB(r3, 0xc400941b, &(0x7f0000000440)={r4, 0x6, 0x6}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-ioctl$BTRFS_IOC_BALANCE_PROGRESS-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000040)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-openat$sysfs-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x80000, 0x44) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_SCRUB_PROGRESS-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c80)={0x0, 0x9, 0x6}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-mkdir-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-bpf$MAP_GET_NEXT_KEY-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001bc0)={r2, &(0x7f0000000000), 0x0}, 0x20) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-sendmsg$nl_route_sched-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-bpf$MAP_UPDATE_CONST_STR-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{r2}, &(0x7f0000000000)=0x7d8, &(0x7f0000000180)='%ps \x00'}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_CREATE-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001000000", @ANYRES32=r1, @ANYBLOB="000000006ab745d3c9059e000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{}, &(0x7f00000001c0), &(0x7f0000000200)}, 0x20) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-syz_mount_image$vfat-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000040)='./file1\x00', 0x100048a, &(0x7f0000000880)=ANY=[], 0x1, 0x25e, &(0x7f00000004c0)="$eJzs2j1vHEUcB+D/msQ2jpwz70okxAgKoFnlXFPEQomEsASCGCkgUDZ4DScvd5b3ZOkQIqaBlo9AjSjpkFBKGjd8Ago6N65QCsQi50zInQ6kADmH5HmaG+3MTztzOzOaYvZf+vKjzY063yj6MZNlMXM+duNGFksxE3/YjRefv/zD029efvvVldXVC2+kdHHlUns5pXT6me/f+eSbZ6/3T7317env5mJv6b39g+Wf957cO7P/26UPO3Xq1Knb66ciXe31+sXVqkzrnXozT+n1qizqMnW6dbk9Ur9R9ba2Bqnori8ubG2XdZ2K7iBtloPU76X+9iAVHxSdbsrzPC0uBP/G2tc3miYOmpNXommah7+KU9dj8adoRfZIyh47nz1xJXtqNztz0DSt4+4qd4Xv/2C7bVOfj6i+2FnbWRv+DutXNqITVZRxLlrxaxxOkyPD8sVXVi+cSzctxefVtaP8tZ21h0bz7WjF0uR8e5hPo/m5WIg4GXGUX45WPD45vzwxPx8vPHfb+/NoxY/vRy+qWI/D7J/5T9spvfza6lj+7M12AAD3mzzdMvH8lud/VT/M38H5cOx8dSLOnjjesRNRDz7eLKqq3L5PCvMx/uRwlPdAx6ZQyG49mT36utPtxmfTe9dc3FEqi9g9/D8mtZn5z1dBxN+2mf0nS2926jPq2LYkpmh0nwQAAAAAAAAAAOD/4m5cHswiYvwG7gSP/tJ+d8qjBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7kW/BwAA///9A8R/") mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: mkdir(0x0, 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000840)={0x0, 0x3, 0x1, [0x1, 0x1, 0x7, 0x845, 0xfbc], [0x2, 0x0, 0x0, 0x7f, 0x7, 0x3, 0x7, 0x9, 0x8, 0x15600, 0x1, 0x1, 0x100, 0x1, 0x80000001, 0x4, 0x3, 0x5, 0xfe00000000000000, 0xad73, 0x6, 0x5, 0x7, 0x100000001, 0x3, 0x80, 0x35, 0x5, 0x8, 0x100000000, 0x10000, 0xd, 0x76, 0x2, 0x5, 0x80, 0x73, 0x7fffffffffffffff, 0xa379, 0xfffffffffffffff9, 0xbe80, 0x6eb, 0x3, 0x9, 0x6, 0xfff, 0xfffffffffffffffe, 0x88, 0x3f, 0x2, 0x8, 0x0, 0x1, 0x3, 0x7fffffffffffffff, 0x0, 0x7, 0x6, 0x1, 0x7, 0x1, 0x3, 0x6, 0x9, 0x7, 0x4, 0x74, 0x0, 0x1, 0x2, 0xfffffffffffffff9, 0x80, 0x0, 0xfffffffffffffffc, 0x5, 0x3, 0x7fff, 0xc4, 0x1, 0x5f, 0x0, 0x6d, 0x0, 0xff, 0x2, 0x3, 0x2, 0x8, 0x5, 0x5, 0x3, 0x7, 0x7, 0xa66, 0x8000, 0xfffffffffffffffe, 0x4, 0x8, 0x80, 0xffffffffffffffff, 0x8, 0x2, 0x9, 0x8, 0x1fff, 0xffff, 0x5, 0x7fff, 0x0, 0x2, 0x7db6911e, 0x7f, 0x85d7d29, 0x7, 0x0, 0x3, 0x5, 0x7, 0x6, 0x3940, 0x6]}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0) mount$incfs(0x0, &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', 0x0, &(0x7f0000000000), 0xc002, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', 0x0, 0xc002, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program did not crash testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program did not crash testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program did not crash testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-ioctl$BTRFS_IOC_GET_DEV_STATS-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x1a6) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true reproducing took 50m34.48930935s repro crashed as (corrupted=false): RSP: 002b:00007fff6e56f978 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f237a82f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff6e56fa30 RBP: 00007fff6e56fa30 R08: 00007fff6e570a30 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff6e570ac0 R13: 00007f237a8c44bb R14: 0000000000006ec8 R15: 00007fff6e570b00 ---[ end trace 159f3228e66f261c ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:423 Write of size 4 at addr 0000000000000170 by task syz-executor/363 CPU: 1 PID: 363 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:439 [inline] kasan_report+0xbd/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] ihold+0x20/0x60 fs/inode.c:423 d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x2d5/0x3c0 fs/namei.c:3915 incfs_kill_sb+0xf7/0x200 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x44f/0x500 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f237a82f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff6e56f978 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f237a82f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff6e56fa30 RBP: 00007fff6e56fa30 R08: 00007fff6e570a30 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff6e570ac0 R13: 00007f237a8c44bb R14: 0000000000006ec8 R15: 00007fff6e570b00 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000170 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 110cd9067 P4D 110cd9067 PUD 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 1 PID: 363 Comm: syz-executor Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 81 6c b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 ef f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 01 RSP: 0018:ffffc90000c37d38 EFLAGS: 00010246 RAX: ffff88810ce99400 RBX: 0000000000000000 RCX: ffff88810ce99400 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90000c37d48 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf848 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000555586adc500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000012a286000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x2d5/0x3c0 fs/namei.c:3915 incfs_kill_sb+0xf7/0x200 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x44f/0x500 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f237a82f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff6e56f978 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f237a82f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff6e56fa30 RBP: 00007fff6e56fa30 R08: 00007fff6e570a30 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff6e570ac0 R13: 00007f237a8c44bb R14: 0000000000006ec8 R15: 00007fff6e570b00 Modules linked in: CR2: 0000000000000170 ---[ end trace 159f3228e66f261d ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 81 6c b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 ef f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 01 RSP: 0018:ffffc90000c37d38 EFLAGS: 00010246 RAX: ffff88810ce99400 RBX: 0000000000000000 RCX: ffff88810ce99400 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90000c37d48 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf848 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000555586adc500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000012a286000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 81 6c b7 ff call 0xffb76c94 13: 48 8d bb 70 01 00 00 lea 0x170(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 40 ef f1 ff call 0xfff1ef64 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 70 01 lock xadd %r14d,0x170(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 01 .byte 0x1 final repro crashed as (corrupted=false): RSP: 002b:00007fff6e56f978 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f237a82f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff6e56fa30 RBP: 00007fff6e56fa30 R08: 00007fff6e570a30 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff6e570ac0 R13: 00007f237a8c44bb R14: 0000000000006ec8 R15: 00007fff6e570b00 ---[ end trace 159f3228e66f261c ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:423 Write of size 4 at addr 0000000000000170 by task syz-executor/363 CPU: 1 PID: 363 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:439 [inline] kasan_report+0xbd/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] ihold+0x20/0x60 fs/inode.c:423 d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x2d5/0x3c0 fs/namei.c:3915 incfs_kill_sb+0xf7/0x200 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x44f/0x500 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f237a82f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff6e56f978 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f237a82f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff6e56fa30 RBP: 00007fff6e56fa30 R08: 00007fff6e570a30 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff6e570ac0 R13: 00007f237a8c44bb R14: 0000000000006ec8 R15: 00007fff6e570b00 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000170 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 110cd9067 P4D 110cd9067 PUD 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 1 PID: 363 Comm: syz-executor Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 81 6c b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 ef f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 01 RSP: 0018:ffffc90000c37d38 EFLAGS: 00010246 RAX: ffff88810ce99400 RBX: 0000000000000000 RCX: ffff88810ce99400 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90000c37d48 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf848 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000555586adc500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000012a286000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x2d5/0x3c0 fs/namei.c:3915 incfs_kill_sb+0xf7/0x200 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x44f/0x500 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f237a82f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff6e56f978 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f237a82f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff6e56fa30 RBP: 00007fff6e56fa30 R08: 00007fff6e570a30 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff6e570ac0 R13: 00007f237a8c44bb R14: 0000000000006ec8 R15: 00007fff6e570b00 Modules linked in: CR2: 0000000000000170 ---[ end trace 159f3228e66f261d ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 81 6c b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 40 ef f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 01 RSP: 0018:ffffc90000c37d38 EFLAGS: 00010246 RAX: ffff88810ce99400 RBX: 0000000000000000 RCX: ffff88810ce99400 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90000c37d48 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf848 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000555586adc500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000012a286000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 81 6c b7 ff call 0xffb76c94 13: 48 8d bb 70 01 00 00 lea 0x170(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 40 ef f1 ff call 0xfff1ef64 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 70 01 lock xadd %r14d,0x170(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 01 .byte 0x1