Extracting prog: 25m30.41209336s Minimizing prog: 6m5.116351944s Simplifying prog options: 0s Extracting C: 22.055766521s Simplifying C: 12m34.003370106s extracting reproducer from 31 programs testing a last program of every proc single: executing 6 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write$cgroup_int-write$FUSE_POLL detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0xe7) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/sys/net/ipv6/conf/syz_tun/forwarding\x00', 0x2, 0xe0) write$cgroup_int(r0, &(0x7f0000000380)=0x9, 0x12) write$FUSE_POLL(r0, &(0x7f00000024c0)={0x18, 0x0, 0x0, {0x13}}, 0x18) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$uhid-write$UHID_CREATE2-mmap-syz_open_dev$hidraw-writev detailed listing: executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000380), 0x0, 0x81) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000400)="cf", 0x1}], 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$cdc_ecm-shutdown detailed listing: executing program 0: r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a100df00008032080b00020903000009040000000e0100000d240100092700006cdc020101112402010102000000000000000002000009240302010100010009040100000e0200000e240101470081000200000001001b240401015955593200001000800000aa00389b711001000000001e240501008002e0010000000000000000006009001516050001"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, &(0x7f0000000240)={0x40, 0x18, 0x30, "ca47772c886563859a47111214be7d0905cb70bbe37b0bec244b6ed344567af0c523673c41d2dfc40957674ddb958687"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x3, 0x7a, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000000)={0x44, 0x0, 0x0, 0x0, &(0x7f00000005c0)={0x20, 0x80, 0x1c, {0x8001, 0x4, 0x7fff, 0x6, 0x6, 0x6, 0x3e, 0xff, 0x9, 0xeba9, 0x204, 0x80}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-openat$cgroup_ro-write$cgroup_subtree-mmap-fsopen detailed listing: executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) fsopen(&(0x7f0000000000)='proc\x00', 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-openat$cgroup_ro-write$cgroup_subtree-mmap-fsopen detailed listing: executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) fsopen(&(0x7f0000000000)='proc\x00', 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 31 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5] detailed listing: executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x4, 0x1}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r2, 0x1, 0x70bd2a, 0x0, {{}, {}, {0x14, 0x19, {0x0, 0x1}}}}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x4080) executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000740), 0x3, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000780), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x4004743d, 0x110e22fff6) close(0x4) executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000938000/0x8000)=nil, 0x8000, 0x2, 0x22052, r0, 0xdfe7000) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0x8, &(0x7f0000000000)="511bd0", 0x3) getsockopt$inet_opts(r1, 0x0, 0x400000000000009, &(0x7f0000937fed)=""/16, &(0x7f0000000080)=0x2b) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./tracing\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) read$FUSE(r0, 0x0, 0x2d) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) executing program 2: r0 = socket$vsock_stream(0x28, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./file2\x00', 0x42, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000dc0)=0xffff, 0x8) executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) fsopen(&(0x7f0000000000)='proc\x00', 0x0) executing program 32: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) fsopen(&(0x7f0000000000)='proc\x00', 0x0) executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) close(r0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r0, 0x29, 0x7, 0x0, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/thread-self/fail-nth\x00', 0x402, 0x1c0) write(r0, &(0x7f0000000340)='7', 0x1) add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0x2, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x4, 0x0}, 0x4}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71012000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) executing program 4: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) r0 = socket(0x11, 0x3, 0x8000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@uid={'uid', 0x3d, r1}}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, &(0x7f0000000100)) executing program 4: recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000240)='cpuset.sched_relax_domain_level\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000080), 0x12) executing program 4: sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20004004}, 0x20000000) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_clone(0x1002200, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$getregset(0x4204, r0, 0x202, &(0x7f0000000000)={0x0}) executing program 0: r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4000000, 0xa031, 0xffffffffffffffff, 0x9154e000) read(r0, 0x0, 0x0) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='3', 0x4e) setreuid(0x0, 0x0) executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000000c0)={0x84, &(0x7f0000003200)=ANY=[@ANYBLOB="400a04000000000063a8f0d5a0ab5ed4212504b3b1f8767d00623d926e5312f9f593831024ede926a92365cda94da181c56baf94abb366ff7484ebc96a249d9510ee5bd3fddf64627a2b6ff4b553b3cdd7a2233639971dfbe8b54c85"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) add_key(0x0, &(0x7f0000000540)={'syz', 0x0}, 0x0, 0x0, r1) executing program 4: r0 = syz_usb_connect$cdc_ncm(0x3, 0x7a, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000000)={0x44, 0x0, 0x0, 0x0, &(0x7f00000005c0)={0x20, 0x80, 0x1c, {0x8001, 0x4, 0x7fff, 0x6, 0x6, 0x6, 0x3e, 0xff, 0x9, 0xeba9, 0x204, 0x80}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) executing program 3: syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) pipe2(0x0, 0x90000) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x8c, 0x200) ioctl(r0, 0xffff454b, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./mydev\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./mydev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./mydev/ttyS0\x00', 0x2, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f00000003c0)={0x3, 0x8, 0x1000, 0x8, 0x38, "050052029851b42cd3010000000100"}) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000200)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=[r0, r1, r0, r0], 0x10}, @fda={0x66646185, 0x4}, @child_ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x8}}, &(0x7f0000000040)={0x0, 0x28, 0x48}}, 0x1000}]}) executing program 3: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc_dir\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc_dir/acpi/wakeup\x00', 0x2, 0x0) write$FUSE_DIRENTPLUS(r0, 0x0, 0xb0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000500)=[@text64={0x40, &(0x7f0000000540)="66b8b0008ee866b8ba000f00d036664b0f38f58900000000b8010000000f01d9f043191f430f08260f96ac0b3241000066b8eb000f00d848b80000000000820000000023d00f21f8352000000e0f23f8c74424007a000000c74424024d000000ff2c24", 0x63}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 3: r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a100df00008032080b00020903000009040000000e0100000d240100092700006cdc020101112402010102000000000000000002000009240302010100010009040100000e0200000e240101470081000200000001001b240401015955593200001000800000aa00389b711001000000001e240501008002e0010000000000000000006009001516050001"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, &(0x7f0000000240)={0x40, 0x18, 0x30, "ca47772c886563859a47111214be7d0905cb70bbe37b0bec244b6ed344567af0c523673c41d2dfc40957674ddb958687"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x571, 0x4) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000080)=0x6, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x20000080, &(0x7f00000000c0)={0xa, 0x4e1f, 0x80000004, @loopback, 0x55}, 0x1c) recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffd40}, 0x2141) executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe(0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, 0x0) setsockopt$inet_buf(r0, 0x0, 0x40, &(0x7f0000000080)="8c5d7b87b32ecae06ac8cfe890364ab911d8c33439477a7591f6914e91c6821ee7163f8ae1896184d48797997716158aad89f66dd67480ce8ff178ef748cfcdcf54127d5ff95cbcaebf10a3b7cddafa2c0fa6aa2eaef0d457680203c02d0c623", 0x7590) executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000240), 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) executing program 1: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000580)='./proc\x00', &(0x7f00000005c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./proc/sys/net/netfilter/nf_conntrack_buckets\x00', 0x2, 0x0) write$FUSE_STATX(r0, 0x0, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x0, 0x7, 0x8, 0x0, 0x5, 0xa, 0x98, 0x9, 0xb, 0x0, 0x9, 0x40, 0x0, 0x7, 0x0, 0x7, 0x2, 0xad, 0xda, '\x00', 0x4, 0x100000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 1: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000380), 0x0, 0x81) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000400)="cf", 0x1}], 0x1) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0xe7) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/sys/net/ipv6/conf/syz_tun/forwarding\x00', 0x2, 0xe0) write$cgroup_int(r0, &(0x7f0000000380)=0x9, 0x12) write$FUSE_POLL(r0, &(0x7f00000024c0)={0x18, 0x0, 0x0, {0x13}}, 0x18) program crashed: BUG: unable to handle kernel NULL pointer dereference in vfs_rmdir bisect: bisecting 31 programs bisect: split chunks (needed=false): <31> bisect: split chunk #0 of len 31 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5] detailed listing: executing program 4: recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000240)='cpuset.sched_relax_domain_level\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000080), 0x12) executing program 4: sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20004004}, 0x20000000) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_clone(0x1002200, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$getregset(0x4204, r0, 0x202, &(0x7f0000000000)={0x0}) executing program 0: r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4000000, 0xa031, 0xffffffffffffffff, 0x9154e000) read(r0, 0x0, 0x0) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, 0x0) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='3', 0x4e) setreuid(0x0, 0x0) executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000000c0)={0x84, &(0x7f0000003200)=ANY=[@ANYBLOB="400a04000000000063a8f0d5a0ab5ed4212504b3b1f8767d00623d926e5312f9f593831024ede926a92365cda94da181c56baf94abb366ff7484ebc96a249d9510ee5bd3fddf64627a2b6ff4b553b3cdd7a2233639971dfbe8b54c85"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) add_key(0x0, &(0x7f0000000540)={'syz', 0x0}, 0x0, 0x0, r1) executing program 4: r0 = syz_usb_connect$cdc_ncm(0x3, 0x7a, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000000)={0x44, 0x0, 0x0, 0x0, &(0x7f00000005c0)={0x20, 0x80, 0x1c, {0x8001, 0x4, 0x7fff, 0x6, 0x6, 0x6, 0x3e, 0xff, 0x9, 0xeba9, 0x204, 0x80}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) executing program 3: syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x0) pipe2(0x0, 0x90000) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x8c, 0x200) ioctl(r0, 0xffff454b, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./mydev\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./mydev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./mydev/ttyS0\x00', 0x2, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f00000003c0)={0x3, 0x8, 0x1000, 0x8, 0x38, "050052029851b42cd3010000000100"}) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000200)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, &(0x7f0000000300)=[r0, r1, r0, r0], 0x10}, @fda={0x66646185, 0x4}, @child_ptr={0x70742a85, 0x1, 0x0, 0x0, 0x0, 0x8}}, &(0x7f0000000040)={0x0, 0x28, 0x48}}, 0x1000}]}) executing program 3: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc_dir\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc_dir/acpi/wakeup\x00', 0x2, 0x0) write$FUSE_DIRENTPLUS(r0, 0x0, 0xb0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000500)=[@text64={0x40, &(0x7f0000000540)="66b8b0008ee866b8ba000f00d036664b0f38f58900000000b8010000000f01d9f043191f430f08260f96ac0b3241000066b8eb000f00d848b80000000000820000000023d00f21f8352000000e0f23f8c74424007a000000c74424024d000000ff2c24", 0x63}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 3: r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a100df00008032080b00020903000009040000000e0100000d240100092700006cdc020101112402010102000000000000000002000009240302010100010009040100000e0200000e240101470081000200000001001b240401015955593200001000800000aa00389b711001000000001e240501008002e0010000000000000000006009001516050001"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, &(0x7f0000000240)={0x40, 0x18, 0x30, "ca47772c886563859a47111214be7d0905cb70bbe37b0bec244b6ed344567af0c523673c41d2dfc40957674ddb958687"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x571, 0x4) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000080)=0x6, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x20000080, &(0x7f00000000c0)={0xa, 0x4e1f, 0x80000004, @loopback, 0x55}, 0x1c) recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffd40}, 0x2141) executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe(0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, 0x0) setsockopt$inet_buf(r0, 0x0, 0x40, &(0x7f0000000080)="8c5d7b87b32ecae06ac8cfe890364ab911d8c33439477a7591f6914e91c6821ee7163f8ae1896184d48797997716158aad89f66dd67480ce8ff178ef748cfcdcf54127d5ff95cbcaebf10a3b7cddafa2c0fa6aa2eaef0d457680203c02d0c623", 0x7590) executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000240), 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) executing program 1: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000580)='./proc\x00', &(0x7f00000005c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./proc/sys/net/netfilter/nf_conntrack_buckets\x00', 0x2, 0x0) write$FUSE_STATX(r0, 0x0, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x0, 0x7, 0x8, 0x0, 0x5, 0xa, 0x98, 0x9, 0xb, 0x0, 0x9, 0x40, 0x0, 0x7, 0x0, 0x7, 0x2, 0xad, 0xda, '\x00', 0x4, 0x100000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 1: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000380), 0x0, 0x81) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000400)="cf", 0x1}], 0x1) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0xe7) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/sys/net/ipv6/conf/syz_tun/forwarding\x00', 0x2, 0xe0) write$cgroup_int(r0, &(0x7f0000000380)=0x9, 0x12) write$FUSE_POLL(r0, &(0x7f00000024c0)={0x18, 0x0, 0x0, {0x13}}, 0x18) program did not crash bisect: testing without sub-chunk 2/3 testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5] detailed listing: executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x4, 0x1}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r2, 0x1, 0x70bd2a, 0x0, {{}, {}, {0x14, 0x19, {0x0, 0x1}}}}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x4080) executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000740), 0x3, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000780), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x4004743d, 0x110e22fff6) close(0x4) executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000938000/0x8000)=nil, 0x8000, 0x2, 0x22052, r0, 0xdfe7000) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0x8, &(0x7f0000000000)="511bd0", 0x3) getsockopt$inet_opts(r1, 0x0, 0x400000000000009, &(0x7f0000937fed)=""/16, &(0x7f0000000080)=0x2b) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./tracing\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) read$FUSE(r0, 0x0, 0x2d) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) executing program 2: r0 = socket$vsock_stream(0x28, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./file2\x00', 0x42, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000dc0)=0xffff, 0x8) executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) fsopen(&(0x7f0000000000)='proc\x00', 0x0) executing program 32: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) fsopen(&(0x7f0000000000)='proc\x00', 0x0) executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) close(r0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r0, 0x29, 0x7, 0x0, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/thread-self/fail-nth\x00', 0x402, 0x1c0) write(r0, &(0x7f0000000340)='7', 0x1) add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0x2, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x4, 0x0}, 0x4}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71012000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) executing program 4: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) r0 = socket(0x11, 0x3, 0x8000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@uid={'uid', 0x3d, r1}}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, &(0x7f0000000100)) executing program 3: r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a100df00008032080b00020903000009040000000e0100000d240100092700006cdc020101112402010102000000000000000002000009240302010100010009040100000e0200000e240101470081000200000001001b240401015955593200001000800000aa00389b711001000000001e240501008002e0010000000000000000006009001516050001"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, &(0x7f0000000240)={0x40, 0x18, 0x30, "ca47772c886563859a47111214be7d0905cb70bbe37b0bec244b6ed344567af0c523673c41d2dfc40957674ddb958687"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x571, 0x4) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000080)=0x6, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x20000080, &(0x7f00000000c0)={0xa, 0x4e1f, 0x80000004, @loopback, 0x55}, 0x1c) recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffd40}, 0x2141) executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe(0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, 0x0) setsockopt$inet_buf(r0, 0x0, 0x40, &(0x7f0000000080)="8c5d7b87b32ecae06ac8cfe890364ab911d8c33439477a7591f6914e91c6821ee7163f8ae1896184d48797997716158aad89f66dd67480ce8ff178ef748cfcdcf54127d5ff95cbcaebf10a3b7cddafa2c0fa6aa2eaef0d457680203c02d0c623", 0x7590) executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000240), 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) executing program 1: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000580)='./proc\x00', &(0x7f00000005c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./proc/sys/net/netfilter/nf_conntrack_buckets\x00', 0x2, 0x0) write$FUSE_STATX(r0, 0x0, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x0, 0x7, 0x8, 0x0, 0x5, 0xa, 0x98, 0x9, 0xb, 0x0, 0x9, 0x40, 0x0, 0x7, 0x0, 0x7, 0x2, 0xad, 0xda, '\x00', 0x4, 0x100000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 1: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000380), 0x0, 0x81) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000400)="cf", 0x1}], 0x1) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0xe7) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/sys/net/ipv6/conf/syz_tun/forwarding\x00', 0x2, 0xe0) write$cgroup_int(r0, &(0x7f0000000380)=0x9, 0x12) write$FUSE_POLL(r0, &(0x7f00000024c0)={0x18, 0x0, 0x0, {0x13}}, 0x18) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5] detailed listing: executing program 2: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x4, 0x1}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r2, 0x1, 0x70bd2a, 0x0, {{}, {}, {0x14, 0x19, {0x0, 0x1}}}}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x4080) executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000740), 0x3, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000780), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x4004743d, 0x110e22fff6) close(0x4) executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000938000/0x8000)=nil, 0x8000, 0x2, 0x22052, r0, 0xdfe7000) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0x8, &(0x7f0000000000)="511bd0", 0x3) getsockopt$inet_opts(r1, 0x0, 0x400000000000009, &(0x7f0000937fed)=""/16, &(0x7f0000000080)=0x2b) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./tracing\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) read$FUSE(r0, 0x0, 0x2d) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) executing program 2: r0 = socket$vsock_stream(0x28, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./file2\x00', 0x42, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000dc0)=0xffff, 0x8) executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) fsopen(&(0x7f0000000000)='proc\x00', 0x0) executing program 32: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) fsopen(&(0x7f0000000000)='proc\x00', 0x0) executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) close(r0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r0, 0x29, 0x7, 0x0, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/thread-self/fail-nth\x00', 0x402, 0x1c0) write(r0, &(0x7f0000000340)='7', 0x1) add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0x2, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x4, 0x0}, 0x4}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71012000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) executing program 4: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) r0 = socket(0x11, 0x3, 0x8000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@uid={'uid', 0x3d, r1}}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, &(0x7f0000000100)) program did not crash bisect: split chunks (needed=true): <11>, <9> bisect: split chunk #0 of len 11 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5] detailed listing: executing program 32: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) fsopen(&(0x7f0000000000)='proc\x00', 0x0) executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) close(r0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r0, 0x29, 0x7, 0x0, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/thread-self/fail-nth\x00', 0x402, 0x1c0) write(r0, &(0x7f0000000340)='7', 0x1) add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0x2, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x4, 0x0}, 0x4}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71012000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) executing program 4: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) r0 = socket(0x11, 0x3, 0x8000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@uid={'uid', 0x3d, r1}}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, &(0x7f0000000100)) executing program 3: r0 = syz_usb_connect(0x2, 0xb3, &(0x7f0000000080)=ANY=[@ANYBLOB="12010002ef0201406d0425080001000000010902a100df00008032080b00020903000009040000000e0100000d240100092700006cdc020101112402010102000000000000000002000009240302010100010009040100000e0200000e240101470081000200000001001b240401015955593200001000800000aa00389b711001000000001e240501008002e0010000000000000000006009001516050001"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, &(0x7f0000000240)={0x40, 0x18, 0x30, "ca47772c886563859a47111214be7d0905cb70bbe37b0bec244b6ed344567af0c523673c41d2dfc40957674ddb958687"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x571, 0x4) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000080)=0x6, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x20000080, &(0x7f00000000c0)={0xa, 0x4e1f, 0x80000004, @loopback, 0x55}, 0x1c) recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffd40}, 0x2141) executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) pipe(0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, 0x0) setsockopt$inet_buf(r0, 0x0, 0x40, &(0x7f0000000080)="8c5d7b87b32ecae06ac8cfe890364ab911d8c33439477a7591f6914e91c6821ee7163f8ae1896184d48797997716158aad89f66dd67480ce8ff178ef748cfcdcf54127d5ff95cbcaebf10a3b7cddafa2c0fa6aa2eaef0d457680203c02d0c623", 0x7590) executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000240), 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) executing program 1: setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000580)='./proc\x00', &(0x7f00000005c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./proc/sys/net/netfilter/nf_conntrack_buckets\x00', 0x2, 0x0) write$FUSE_STATX(r0, 0x0, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x0, 0x7, 0x8, 0x0, 0x5, 0xa, 0x98, 0x9, 0xb, 0x0, 0x9, 0x40, 0x0, 0x7, 0x0, 0x7, 0x2, 0xad, 0xda, '\x00', 0x4, 0x100000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 1: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000380), 0x0, 0x81) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000400)="cf", 0x1}], 0x1) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0xe7) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/sys/net/ipv6/conf/syz_tun/forwarding\x00', 0x2, 0xe0) write$cgroup_int(r0, &(0x7f0000000380)=0x9, 0x12) write$FUSE_POLL(r0, &(0x7f00000024c0)={0x18, 0x0, 0x0, {0x13}}, 0x18) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 9 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 5, 5, 5] detailed listing: executing program 32: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) fsopen(&(0x7f0000000000)='proc\x00', 0x0) executing program 0: mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) close(r0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r0, 0x29, 0x7, 0x0, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/thread-self/fail-nth\x00', 0x402, 0x1c0) write(r0, &(0x7f0000000340)='7', 0x1) add_key$keyring(&(0x7f0000000380), &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0x2, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x4, 0x0}, 0x4}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71012000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) executing program 4: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) r0 = socket(0x11, 0x3, 0x8000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@uid={'uid', 0x3d, r1}}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, &(0x7f0000000100)) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x0, 0x7, 0x8, 0x0, 0x5, 0xa, 0x98, 0x9, 0xb, 0x0, 0x9, 0x40, 0x0, 0x7, 0x0, 0x7, 0x2, 0xad, 0xda, '\x00', 0x4, 0x100000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 1: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000380), 0x0, 0x81) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000400)="cf", 0x1}], 0x1) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0xe7) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/sys/net/ipv6/conf/syz_tun/forwarding\x00', 0x2, 0xe0) write$cgroup_int(r0, &(0x7f0000000380)=0x9, 0x12) write$FUSE_POLL(r0, &(0x7f00000024c0)={0x18, 0x0, 0x0, {0x13}}, 0x18) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <5>, <4> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5] detailed listing: executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0x2, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x4, 0x0}, 0x4}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71012000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) executing program 4: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) r0 = socket(0x11, 0x3, 0x8000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@uid={'uid', 0x3d, r1}}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, &(0x7f0000000100)) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x0, 0x7, 0x8, 0x0, 0x5, 0xa, 0x98, 0x9, 0xb, 0x0, 0x9, 0x40, 0x0, 0x7, 0x0, 0x7, 0x2, 0xad, 0xda, '\x00', 0x4, 0x100000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 1: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000380), 0x0, 0x81) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000400)="cf", 0x1}], 0x1) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0xe7) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/sys/net/ipv6/conf/syz_tun/forwarding\x00', 0x2, 0xe0) write$cgroup_int(r0, &(0x7f0000000380)=0x9, 0x12) write$FUSE_POLL(r0, &(0x7f00000024c0)={0x18, 0x0, 0x0, {0x13}}, 0x18) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5] detailed listing: executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0x2, 0x4e22, 0x0, @initdev={0xfe, 0x88, '\x00', 0x4, 0x0}, 0x4}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71012000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) executing program 4: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) r0 = socket(0x11, 0x3, 0x8000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@uid={'uid', 0x3d, r1}}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, &(0x7f0000000100)) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0xe7) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/sys/net/ipv6/conf/syz_tun/forwarding\x00', 0x2, 0xe0) write$cgroup_int(r0, &(0x7f0000000380)=0x9, 0x12) write$FUSE_POLL(r0, &(0x7f00000024c0)={0x18, 0x0, 0x0, {0x13}}, 0x18) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <2>, <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5] detailed listing: executing program 4: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) r0 = socket(0x11, 0x3, 0x8000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@uid={'uid', 0x3d, r1}}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, &(0x7f0000000100)) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0xe7) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/sys/net/ipv6/conf/syz_tun/forwarding\x00', 0x2, 0xe0) write$cgroup_int(r0, &(0x7f0000000380)=0x9, 0x12) write$FUSE_POLL(r0, &(0x7f00000024c0)={0x18, 0x0, 0x0, {0x13}}, 0x18) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5] detailed listing: executing program 4: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) r0 = socket(0x11, 0x3, 0x8000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@uid={'uid', 0x3d, r1}}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, &(0x7f0000000100)) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./proc\x00', 0xe7) mount(0x0, &(0x7f00000002c0)='./proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./proc/sys/net/ipv6/conf/syz_tun/forwarding\x00', 0x2, 0xe0) write$cgroup_int(r0, &(0x7f0000000380)=0x9, 0x12) write$FUSE_POLL(r0, &(0x7f00000024c0)={0x18, 0x0, 0x0, {0x13}}, 0x18) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5] detailed listing: executing program 4: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) r0 = socket(0x11, 0x3, 0x8000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@uid={'uid', 0x3d, r1}}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, &(0x7f0000000100)) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <1>, <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: split chunk #1 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 2 programs left: executing program 4: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) r0 = socket(0x11, 0x3, 0x8000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@uid={'uid', 0x3d, r1}}]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, &(0x7f0000000100)) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) bisect: trying to concatenate bisect: concatenate 2 entries minimizing program #0 before concatenation testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 5] detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) r0 = socket(0x11, 0x3, 0x8000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$bpf(0x0, 0x0, 0x0, 0x5805040, &(0x7f0000000100)={[{@uid={'uid', 0x3d, r1}}]}) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) program crashed: WARNING in shmem_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 5] detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) r0 = socket(0x11, 0x3, 0x8000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) program crashed: WARNING in shmem_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 5] detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) socket(0x11, 0x3, 0x8000) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) program crashed: WARNING in shmem_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 5] detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) program crashed: WARNING in shmem_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5] detailed listing: executing program 0: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0xee01, 0x1000) program crashed: WARNING in shmem_rmdir minimized 5 calls -> 0 calls minimizing program #1 before concatenation testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4] detailed listing: executing program 4: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) chdir(&(0x7f00000005c0)='./bus\x00') program crashed: WARNING in shmem_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3] detailed listing: executing program 4: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2] detailed listing: executing program 4: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2] detailed listing: executing program 4: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x140, 0x70) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2] detailed listing: executing program 4: executing program 0: mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir minimized 5 calls -> 2 calls testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir bisect: concatenation succeeded found reproducer with 2 syscalls minimizing guilty program testing program (duration=44.028263028s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir detailed listing: executing program 0: mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) program did not crash testing program (duration=44.028263028s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount$incfs detailed listing: executing program 0: mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) program did not crash testing program (duration=44.028263028s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(0x0, 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) program did not crash testing program (duration=44.028263028s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(0x0, &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) program did not crash testing program (duration=44.028263028s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', 0x0, &(0x7f0000000580), 0xc002, 0x0) program did not crash testing program (duration=44.028263028s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', 0x0, 0xc002, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=44.028263028s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir simplifying C reproducer testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true testing program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true testing program (duration=44.028263028s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$incfs(&(0x7f0000000500)='.\x00', &(0x7f0000000540)='./bus\x00', &(0x7f0000000580), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true reproducing took 46m53.505373849s repro crashed as (corrupted=false): veth0_vlan: entered promiscuous mode veth1_macvtap: entered promiscuous mode ------------[ cut here ]------------ WARNING: CPU: 0 PID: 378 at fs/inode.c:340 drop_nlink+0xce/0x110 fs/inode.c:340 Modules linked in: CPU: 0 UID: 0 PID: 378 Comm: syz-executor Not tainted syzkaller #0 89738cdce93e33c1079eaf7360b55d01ca9e3330 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:drop_nlink+0xce/0x110 fs/inode.c:340 Code: 04 00 00 be 08 00 00 00 e8 1f 0b ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 58 88 b6 03 cc e8 b2 7a 94 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c RSP: 0018:ffffc9000119fc88 EFLAGS: 00010293 RAX: ffffffff81f4db8e RBX: ffff888114510428 RCX: ffff8881133b62c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000119fcb0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52000233f80 R12: dffffc0000000000 R13: 1ffff110228a208e R14: ffff888114510470 R15: 0000000000000000 FS: 0000555570fc4500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555570fe7958 CR3: 0000000112ea6000 CR4: 00000000003526b0 Call Trace: shmem_rmdir+0x5f/0x90 mm/shmem.c:3820 vfs_rmdir+0x3db/0x560 fs/namei.c:4348 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd2/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e8/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f68b53a0797 Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffdee29fb28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f68b53a0797 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdee29fbe0 RBP: 00007ffdee29fbe0 R08: 00007ffdee2a0be0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdee2a0c70 R13: 00007f68b5435f63 R14: 000000000000a83b R15: 00007ffdee2a0cb0 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 fs/inode.c:452 Write of size 4 at addr 0000000000000168 by task syz-executor/378 CPU: 0 UID: 0 PID: 378 Comm: syz-executor Tainted: G W syzkaller #0 89738cdce93e33c1079eaf7360b55d01ca9e3330 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_report+0x3d/0x70 mm/kasan/report.c:484 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x25a/0x2b0 mm/kasan/generic.c:189 __kasan_check_write+0x18/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] ihold+0x24/0x70 fs/inode.c:452 d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd2/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e8/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f68b53a0797 Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffdee29fb28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f68b53a0797 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdee29fbe0 RBP: 00007ffdee29fbe0 R08: 00007ffdee2a0be0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdee2a0c70 R13: 00007f68b5435f63 R14: 000000000000a83b R15: 00007ffdee2a0cb0 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000168 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 80000001155c3067 P4D 80000001155c3067 PUD 0 Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 378 Comm: syz-executor Tainted: G B W syzkaller #0 89738cdce93e33c1079eaf7360b55d01ca9e3330 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 9d 71 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 dc 01 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 ad RSP: 0018:ffffc9000119fcc8 EFLAGS: 00010246 RAX: ffff8881133b6200 RBX: 0000000000000000 RCX: ffff8881133b62c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000119fcd8 R08: ffffffff893cf947 R09: 1ffffffff1279f28 R10: dffffc0000000000 R11: fffffbfff1279f29 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 0000555570fc4500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 0000000112ea6000 CR4: 00000000003526b0 Call Trace: d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd2/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e8/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f68b53a0797 Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffdee29fb28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f68b53a0797 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdee29fbe0 RBP: 00007ffdee29fbe0 R08: 00007ffdee2a0be0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdee2a0c70 R13: 00007f68b5435f63 R14: 000000000000a83b R15: 00007ffdee2a0cb0 Modules linked in: CR2: 0000000000000168 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 9d 71 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 dc 01 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 ad RSP: 0018:ffffc9000119fcc8 EFLAGS: 00010246 RAX: ffff8881133b6200 RBX: 0000000000000000 RCX: ffff8881133b62c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000119fcd8 R08: ffffffff893cf947 R09: 1ffffffff1279f28 R10: dffffc0000000000 R11: fffffbfff1279f29 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 0000555570fc4500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 0000000112ea6000 CR4: 00000000003526b0 ---------------- Code disassembly (best guess): 0: f3 0f 1e fa endbr64 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 9d 71 94 ff call 0xff9471b0 13: 48 8d bb 68 01 00 00 lea 0x168(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 dc 01 ee ff call 0xffee0200 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 68 01 lock xadd %r14d,0x168(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: ad lods %ds:(%rsi),%eax final repro crashed as (corrupted=false): veth0_vlan: entered promiscuous mode veth1_macvtap: entered promiscuous mode ------------[ cut here ]------------ WARNING: CPU: 0 PID: 378 at fs/inode.c:340 drop_nlink+0xce/0x110 fs/inode.c:340 Modules linked in: CPU: 0 UID: 0 PID: 378 Comm: syz-executor Not tainted syzkaller #0 89738cdce93e33c1079eaf7360b55d01ca9e3330 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:drop_nlink+0xce/0x110 fs/inode.c:340 Code: 04 00 00 be 08 00 00 00 e8 1f 0b ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 58 88 b6 03 cc e8 b2 7a 94 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c RSP: 0018:ffffc9000119fc88 EFLAGS: 00010293 RAX: ffffffff81f4db8e RBX: ffff888114510428 RCX: ffff8881133b62c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000119fcb0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52000233f80 R12: dffffc0000000000 R13: 1ffff110228a208e R14: ffff888114510470 R15: 0000000000000000 FS: 0000555570fc4500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555570fe7958 CR3: 0000000112ea6000 CR4: 00000000003526b0 Call Trace: shmem_rmdir+0x5f/0x90 mm/shmem.c:3820 vfs_rmdir+0x3db/0x560 fs/namei.c:4348 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd2/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e8/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f68b53a0797 Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffdee29fb28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f68b53a0797 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdee29fbe0 RBP: 00007ffdee29fbe0 R08: 00007ffdee2a0be0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdee2a0c70 R13: 00007f68b5435f63 R14: 000000000000a83b R15: 00007ffdee2a0cb0 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 fs/inode.c:452 Write of size 4 at addr 0000000000000168 by task syz-executor/378 CPU: 0 UID: 0 PID: 378 Comm: syz-executor Tainted: G W syzkaller #0 89738cdce93e33c1079eaf7360b55d01ca9e3330 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_report+0x3d/0x70 mm/kasan/report.c:484 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x25a/0x2b0 mm/kasan/generic.c:189 __kasan_check_write+0x18/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] ihold+0x24/0x70 fs/inode.c:452 d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd2/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e8/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f68b53a0797 Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffdee29fb28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f68b53a0797 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdee29fbe0 RBP: 00007ffdee29fbe0 R08: 00007ffdee2a0be0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdee2a0c70 R13: 00007f68b5435f63 R14: 000000000000a83b R15: 00007ffdee2a0cb0 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000168 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 80000001155c3067 P4D 80000001155c3067 PUD 0 Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 378 Comm: syz-executor Tainted: G B W syzkaller #0 89738cdce93e33c1079eaf7360b55d01ca9e3330 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 9d 71 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 dc 01 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 ad RSP: 0018:ffffc9000119fcc8 EFLAGS: 00010246 RAX: ffff8881133b6200 RBX: 0000000000000000 RCX: ffff8881133b62c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000119fcd8 R08: ffffffff893cf947 R09: 1ffffffff1279f28 R10: dffffc0000000000 R11: fffffbfff1279f29 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 0000555570fc4500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 0000000112ea6000 CR4: 00000000003526b0 Call Trace: d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd2/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e8/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f68b53a0797 Code: a2 c7 05 5c 9f 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffdee29fb28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f68b53a0797 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdee29fbe0 RBP: 00007ffdee29fbe0 R08: 00007ffdee2a0be0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdee2a0c70 R13: 00007f68b5435f63 R14: 000000000000a83b R15: 00007ffdee2a0cb0 Modules linked in: CR2: 0000000000000168 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 9d 71 94 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 dc 01 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 ad RSP: 0018:ffffc9000119fcc8 EFLAGS: 00010246 RAX: ffff8881133b6200 RBX: 0000000000000000 RCX: ffff8881133b62c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000119fcd8 R08: ffffffff893cf947 R09: 1ffffffff1279f28 R10: dffffc0000000000 R11: fffffbfff1279f29 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 0000555570fc4500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 0000000112ea6000 CR4: 00000000003526b0 ---------------- Code disassembly (best guess): 0: f3 0f 1e fa endbr64 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 9d 71 94 ff call 0xff9471b0 13: 48 8d bb 68 01 00 00 lea 0x168(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 dc 01 ee ff call 0xffee0200 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 68 01 lock xadd %r14d,0x168(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: ad lods %ds:(%rsi),%eax