Extracting prog: 3m34.8040312s Minimizing prog: 17m11.276842778s Simplifying prog options: 4m16.978202167s Extracting C: 1m52.44724925s Simplifying C: 0s extracting reproducer from 31 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash single: failed to extract reproducer bisect: bisecting 31 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 4, 4, 4, 4, 4, 5, 5, 5, 5, 5, 4, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5] detailed listing: executing program 0: timer_create(0x0, &(0x7f0000002c00)={0x0, 0x22, 0x1, @thr={0x0, 0x0}}, &(0x7f0000002c40)=0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) timer_settime(r0, 0x1, &(0x7f0000000080)={{0x0, 0x989680}, {r1, r2+60000000}}, 0x0) timer_settime(r0, 0x1, &(0x7f0000000180)={{0x77359400}, {0x77359400}}, &(0x7f00000001c0)) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000006780)='./debug\x00', 0x1ff) mount(0x0, &(0x7f00000067c0)='./debug\x00', &(0x7f0000006800)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000006840)='./debug/kvm/mmu_shadow_zapped\x00', 0xf40, 0x0) read(r0, 0x0, 0xfffffe3a) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="940000000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff02000000040000000000000000000114000400000000f7000000000000ffffac1e00010800074000000001105d94f460a5036e17ac20b558ba2b98061a1c03ee4ba99340bc651450f01f3063ed384a0c5c36d7e36bc409457f0bac637ad422a9f9a309eb5d"], 0x94}}, 0x20044824) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0xac, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_DST={0x18, 0xd, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @mcast1}]}]}, 0xac}}, 0x0) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='./file0/file0/../file0\x00', 0x0, 0xa1c08, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0/file0/../file0\x00', &(0x7f0000000540)={0x2000, 0x0, 0x10}, 0x18) executing program 0: r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) sendto(r0, 0x0, 0x0, 0x800, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x44, &(0x7f0000000000)={0x0, 0x0}, 0x10) executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pnp/devices/00:00/resources\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='d', 0x1) executing program 32: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pnp/devices/00:00/resources\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='d', 0x1) executing program 1: r0 = openat$kvm(0x0, &(0x7f0000000100), 0x100800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000000)={0x1, 0x37d03030d7a92616}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x10000, 0x4000}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000280)={0x54000, 0x19000}) executing program 1: mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x66960000) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000003c0)={0xaa, 0x108}) ioctl$UFFDIO_MOVE(r0, 0xc028aa05, &(0x7f0000000580)={&(0x7f0000e36000/0x4000)=nil, &(0x7f0000b0d000/0x3000)=nil, 0x4000, 0x1}) executing program 1: rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffff9]}, 0x0, 0x8) r0 = gettid() tkill(r0, 0x14) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ppoll(0x0, 0x0, &(0x7f0000000140)={0x0, 0x989680}, &(0x7f00000001c0)={[0x6]}, 0x8) executing program 1: capset(0x0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) r0 = socket(0x11, 0xa, 0x5) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000040)={'ipvlan0\x00', {0x2, 0x4e20, @broadcast}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendto$inet(r0, &(0x7f0000000140)="9c91d7798c7f1b4ca046b42f0c3d", 0x5ee, 0x800, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_linger(r0, 0x1, 0x3d, &(0x7f0000000080)={0xb}, 0x8) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmmsg$sock(r0, &(0x7f0000003480)=[{{&(0x7f00000000c0)=@xdp={0x2c, 0x5, r2, 0xe}, 0x80, 0x0, 0x0, &(0x7f0000000300)=[@txtime={{0x18, 0x1, 0x3d, 0x7d51}}], 0x18}}], 0x1, 0x0) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) executing program 4: r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000004480)='.\x00', 0x400017e) mkdirat(0xffffffffffffff9c, &(0x7f00000044c0)='./file1\x00', 0xa4) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000004500)='./file1\x00', 0x2100, 0x1) readv(r1, 0x0, 0x0) executing program 4: r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000004c0)={0x0, &(0x7f0000000100)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @guest32=0x4810, 0x30000, 0x2, 0x3}}], 0x68}) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x3) ioprio_get$pid(0x2, 0x0) executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f00000009c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000a00)='./proc\x00', &(0x7f0000000a40)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/thread-self/fail-nth\x00', 0x8002, 0xa2) write(r0, &(0x7f0000000300)='7', 0x1) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040), 0x4100, 0x0) executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r1 = memfd_create(0x0, 0x2) r2 = epoll_create1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000007c40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000003580)=[@rights={{0x30, 0x1, 0x1, [r0, r2, r0, r0, r1, 0xffffffffffffffff, r4, r3]}}], 0x30, 0x20040050}}], 0x1, 0x0) executing program 2: unshare(0x6020400) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) executing program 2: openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1c, 0x0, &(0x7f0000000200)=[@enter_looper, @increfs, @request_freeze={0x400c6313, 0x0, 0x1}], 0x100, 0x0, &(0x7f0000000240)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000880)={0x1c, 0x0, &(0x7f00000008c0)=[@freeze_done={0x40086315, 0x1}, @clear_freeze={0x40046306, 0x0, 0x1}], 0x100, 0x0, &(0x7f0000000900)}) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./trace/events/irq/irq_handler_entry/filter\x00', 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000029c0)={0x30, 0x5, 0x0, {0x0, 0x4, 0x5, 0x342}}, 0x30) read$FUSE(r0, 0x0, 0x0) executing program 2: madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x15) executing program 3: mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0x9, 0x0, 0x7fff8000}]}) close_range(r0, 0xffffffffffffffff, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000100), 0x40081, 0x0) clock_settime(0xfffffffb, 0x0) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/kmsg\x00', 0x1, 0xe73ccd5d0d945a9d) r1 = dup(r0) pwritev(r1, &(0x7f00000033c0)=[{&(0x7f0000000280)="9f371831c4a5e10d2cd6c578634ef7360925cbbdb7f4449f145d4fe97331e2a196472a181fb724d5c0924bd6039428b0a87df5e4fcd6519bc329aa3989c384ffe73de9e1ffa67dc821a1e80ae36b438813946bbdbd359e41e66d78418e9786a920b92c3c2008e12dd5188b3c83740ff39b982fedfd60cef67c5af2fd0db1c9132f71529d28252321863bc3ac9330a52ed3fb279d9e7b5f781ed722b4dc275aced0eb7d28fb79988eb3c6bdb83fa35961ae40b336b633cd1afd8969cd541101f48dbff2558b7c01f51c9369ccfef9a68ca0e8544509999399a5b6fa6feab59b5e67", 0xe1}, {&(0x7f0000000380)="67806b6686bc3b436f58e8e43e14d3db4ee86a3435735781654954b0d0ad8d7c851e0cbe03e45d41373f153a3bfd5b793b3b2880f7c5ed327d11fd8fcd5de06d6e7e3130dedd5f0c2c08240e2acff20fc640accdafc32cd14afa8f8744184a250e5779c9c269d3", 0x67}, {&(0x7f0000000fc0)="ca70f6e6daeaa5ef18935119f28e92dcc1a13f03feb9698e499298605a562924cf2da639eccb559bec1aba02222917b59ebde067554b0d817e63739e15c7ebecca05b16803297f74ee033078c9023f054ebf8ae83f97b1dc4700f049bcce661b99e9ceb3026821ae01188acbd1201edf008b800c12171a3743c8642130fcc22861719303473856de53b3bf3a79ed13971a5e73b7af3742d0fd84bca10b09b10db62c77a03eab46ff5a73c5d624f01f143abd474b14a1a7785899fa918b6702fd7f712baeec6d15d422104d03f5d2914a16b80000062e9ee03df734749f1136e51f1b4837a4dba60e809c6a014d8d1044d5d1013e34e5972ad4afe0687c72b9cc0248f897a431a26b7c18916439235c45f769a80e189f9086fd456a179156dd8912cac60ac1b5adae2d5ef0e84ace870bc66575d1520b827a70acac05d926bd3f66473ad54b52225f1d428c1dd79e8a6fecb1439a4903cffd3c0fa41882ad6e838e6153f5a6fccd4f1d2d6d688b4a66ecc5baa2fbef227103dbd730160754942dd39c23affa1077e82ec022561e3eae8c3c91e3e5a1705e79ffd9ee83e70c1db8c5ee599a554db2a2491c5cdf56e8300cdc8618f5c83925de8d0e39838f63947875e9fdfb82cad474925623645fdf7803f20c311e0478ea17ca3fa3b6cff3cb38d6b6a0544510c8317ae3ae2ee48ac6d143865ef49f0b5b11750658a644bde6f92913e5d51983cd025e092337e9e2bb0e7dd2f68514294faf2a7ffcefa5706372803367048853dab806f40a574a0f68db19df28a6782f33dfde0c3b4ff477d6ac19f13567e0194c2f472070d9d723204dc7aa5f85fa5aaa9b28e0ac5f7fbbb455e0e2981d85eef2e8908e2897a714892f24cd6551af0f8a16e2b58ec8beb46f361a6bf38fc745bd5d1d96d9533f1e0a33eab30379fb0791f64ca15e371d0a2b7892edf9e60f20e44c7c2f51b88626126b774fd79832062afaa2", 0x2b9}], 0x3, 0x9, 0x1) executing program 3: setgroups(0x1, &(0x7f0000008540)=[0x0]) r0 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0xffffffffffffffff, r1) socket$inet_icmp(0x2, 0x2, 0x1) executing program 2: ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'veth0_macvtap\x00'}) r0 = socket$xdp(0x2c, 0x3, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/65, 0x328000, 0x800, 0x9, 0x2}, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x4, 0x1}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r2, 0x1, 0x70bd2a, 0x0, {{}, {}, {0x14, 0x19, {0x0, 0x1}}}}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x4080) executing program 3: setns(0xc9, 0x0) r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_RATE_GET(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000", @ANYRES16=r0, @ANYBLOB="0307fafff8fffddbdf253d000000"], 0x14}}, 0x40040) syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r1) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000100)=0x3) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x80402, 0x68) ioctl(r0, 0xc138fd01, &(0x7f00000002c0)="0400000000000000000000003801") executing program 4: syz_io_uring_setup(0x791c, 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000040)) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f00000009c0)={0x5, 0x802, 0x0, {0x0, 0x2710}, {0x0, 0xea60}, {0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "f33d8e7b847ec8b36f1107e036dd98fc469107485e371bcf5c6b77db54f3d984795c49eca9b92241dc9fc39f976ad52e581942d9fc2178681e6866aa6ef10d06"}}, 0x80}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)=ANY=[@ANYBLOB="05000000800d00"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="000000400100000000000040"], 0x80}}, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program crashed: WARNING: kobject bug in __scsi_remove_device single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write detailed listing: executing program 0: mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program did not crash simplifying guilty program options testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program crashed: WARNING: kobject bug in __scsi_remove_device extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program did not crash testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program crashed: WARNING: kobject bug in __scsi_remove_device validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program crashed: WARNING: kobject bug in __scsi_remove_device validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program crashed: WARNING: kobject bug in __scsi_remove_device validation run: crashed=true reproducing took 35m35.242420358s repro crashed as (corrupted=false): ------------[ cut here ]------------ kobject: '(null)' (ffff8881143f2548): is not initialized, yet kobject_put() is being called. WARNING: CPU: 0 PID: 398 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 lib/kobject.c:734 Modules linked in: CPU: 0 UID: 0 PID: 398 Comm: syz.2.19 Not tainted syzkaller #0 c7db6ca8d812f5bae3d5d94ae814da2ca1a33223 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:kobject_put+0x8e/0x2a0 lib/kobject.c:734 Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 d4 16 43 fc 48 8b 33 48 c7 c7 40 b9 9b 86 48 89 da e8 e2 7e 64 fb <0f> 0b eb 0f e8 69 89 e9 fb e9 9c 01 00 00 e8 5f 89 e9 fb 4c 8d 7b RSP: 0018:ffffc90000e4f1f8 EFLAGS: 00010246 RAX: a920f2152e38e700 RBX: ffff8881143f2548 RCX: ffff8881179d2780 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffffc90000e4f220 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520001c9da4 R12: 00000000fffffff4 R13: ffff8881143f2584 R14: 1ffff1102287e4b0 R15: 0000000000000000 FS: 00005555954d3500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffccc947f70 CR3: 0000000117960000 CR4: 00000000003526b0 Call Trace: put_device+0x23/0x40 drivers/base/core.c:3800 __scsi_remove_device+0xc4/0x3c0 drivers/scsi/scsi_sysfs.c:1501 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46af39f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff769e5728 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f46af625fa0 RCX: 00007f46af39f559 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f46af436b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f46af625fac R14: 00007f46af625fa0 R15: 00007f46af625fa0 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 398 at lib/refcount.c:28 refcount_warn_saturate+0x119/0x1c0 lib/refcount.c:28 Modules linked in: CPU: 1 UID: 0 PID: 398 Comm: syz.2.19 Tainted: G W syzkaller #0 c7db6ca8d812f5bae3d5d94ae814da2ca1a33223 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:refcount_warn_saturate+0x119/0x1c0 lib/refcount.c:28 Code: 05 01 48 c7 c7 00 3a 52 86 e8 23 50 52 fe 0f 0b eb da e8 aa 5a d7 fe c6 05 ae 25 b4 05 01 48 c7 c7 60 3a 52 86 e8 07 50 52 fe <0f> 0b eb be e8 8e 5a d7 fe c6 05 8f 25 b4 05 01 48 c7 c7 a0 39 52 RSP: 0018:ffffc90000e4f1d8 EFLAGS: 00010246 RAX: a920f2152e38e700 RBX: 0000000000000003 RCX: ffff8881179d2780 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffffc90000e4f1e8 R08: ffff8881f6d29593 R09: 1ffff1103eda52b2 R10: dffffc0000000000 R11: ffffed103eda52b3 R12: 0000000000000000 R13: ffff8881143f2584 R14: ffff8881143f2580 R15: ffff8881143f2580 FS: 00005555954d3500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055558468b4e8 CR3: 0000000117960000 CR4: 00000000003526b0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] kref_put include/linux/kref.h:64 [inline] kobject_put+0x25a/0x2a0 lib/kobject.c:737 put_device+0x23/0x40 drivers/base/core.c:3800 __scsi_remove_device+0xc4/0x3c0 drivers/scsi/scsi_sysfs.c:1501 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46af39f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff769e5728 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f46af625fa0 RCX: 00007f46af39f559 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f46af436b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f46af625fac R14: 00007f46af625fa0 R15: 00007f46af625fa0 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ kobject: '(null)' (ffff8881143f21d0): is not initialized, yet kobject_put() is being called. WARNING: CPU: 0 PID: 398 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 lib/kobject.c:734 Modules linked in: CPU: 0 UID: 0 PID: 398 Comm: syz.2.19 Tainted: G W syzkaller #0 c7db6ca8d812f5bae3d5d94ae814da2ca1a33223 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:kobject_put+0x8e/0x2a0 lib/kobject.c:734 Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 d4 16 43 fc 48 8b 33 48 c7 c7 40 b9 9b 86 48 89 da e8 e2 7e 64 fb <0f> 0b eb 0f e8 69 89 e9 fb e9 9c 01 00 00 e8 5f 89 e9 fb 4c 8d 7b RSP: 0018:ffffc90000e4f1f8 EFLAGS: 00010246 RAX: a920f2152e38e700 RBX: ffff8881143f21d0 RCX: ffff8881179d2780 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffffc90000e4f220 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0f9f334 R12: ffffffff86635950 R13: ffff8881143f220c R14: 1ffff1102287e441 R15: 0000000000000000 FS: 00005555954d3500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8dbb7ecc40 CR3: 0000000117960000 CR4: 00000000003526b0 Call Trace: put_device+0x23/0x40 drivers/base/core.c:3800 __scsi_remove_device+0x32d/0x3c0 drivers/scsi/scsi_sysfs.c:1527 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46af39f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff769e5728 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f46af625fa0 RCX: 00007f46af39f559 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f46af436b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f46af625fac R14: 00007f46af625fa0 R15: 00007f46af625fa0 ---[ end trace 0000000000000000 ]--- scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured ------------[ cut here ]------------ kernel BUG at drivers/scsi/scsi_scan.c:594! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 398 Comm: syz.2.19 Tainted: G W syzkaller #0 c7db6ca8d812f5bae3d5d94ae814da2ca1a33223 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:scsi_target_reap+0x172/0x180 drivers/scsi/scsi_scan.c:594 Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 78 24 81 fe e9 39 ff ff ff e8 4e 97 27 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 07 43 6b cb 90 90 90 RSP: 0018:ffffc90000e4f7a8 EFLAGS: 00010293 RAX: ffffffff8361bef2 RBX: ffff888115ce2800 RCX: ffff8881179d2780 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005 RBP: ffffc90000e4f7d0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520001c9ee0 R12: ffff888115ce2800 R13: ffff888115ce2bc4 R14: 1ffff11022b9c578 R15: 0000000000000005 FS: 00005555954d3500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8dbb7ecc40 CR3: 0000000117960000 CR4: 00000000003526b0 Call Trace: __scsi_scan_target+0x62c/0xc20 drivers/scsi/scsi_scan.c:1771 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46af39f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff769e5728 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f46af625fa0 RCX: 00007f46af39f559 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f46af436b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f46af625fac R14: 00007f46af625fa0 R15: 00007f46af625fa0 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:scsi_target_reap+0x172/0x180 drivers/scsi/scsi_scan.c:594 Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 78 24 81 fe e9 39 ff ff ff e8 4e 97 27 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 07 43 6b cb 90 90 90 RSP: 0018:ffffc90000e4f7a8 EFLAGS: 00010293 RAX: ffffffff8361bef2 RBX: ffff888115ce2800 RCX: ffff8881179d2780 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005 RBP: ffffc90000e4f7d0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520001c9ee0 R12: ffff888115ce2800 R13: ffff888115ce2bc4 R14: 1ffff11022b9c578 R15: 0000000000000005 FS: 00005555954d3500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffab9e71220 CR3: 0000000117960000 CR4: 00000000003526b0 final repro crashed as (corrupted=false): ------------[ cut here ]------------ kobject: '(null)' (ffff8881143f2548): is not initialized, yet kobject_put() is being called. WARNING: CPU: 0 PID: 398 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 lib/kobject.c:734 Modules linked in: CPU: 0 UID: 0 PID: 398 Comm: syz.2.19 Not tainted syzkaller #0 c7db6ca8d812f5bae3d5d94ae814da2ca1a33223 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:kobject_put+0x8e/0x2a0 lib/kobject.c:734 Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 d4 16 43 fc 48 8b 33 48 c7 c7 40 b9 9b 86 48 89 da e8 e2 7e 64 fb <0f> 0b eb 0f e8 69 89 e9 fb e9 9c 01 00 00 e8 5f 89 e9 fb 4c 8d 7b RSP: 0018:ffffc90000e4f1f8 EFLAGS: 00010246 RAX: a920f2152e38e700 RBX: ffff8881143f2548 RCX: ffff8881179d2780 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffffc90000e4f220 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520001c9da4 R12: 00000000fffffff4 R13: ffff8881143f2584 R14: 1ffff1102287e4b0 R15: 0000000000000000 FS: 00005555954d3500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffccc947f70 CR3: 0000000117960000 CR4: 00000000003526b0 Call Trace: put_device+0x23/0x40 drivers/base/core.c:3800 __scsi_remove_device+0xc4/0x3c0 drivers/scsi/scsi_sysfs.c:1501 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46af39f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff769e5728 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f46af625fa0 RCX: 00007f46af39f559 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f46af436b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f46af625fac R14: 00007f46af625fa0 R15: 00007f46af625fa0 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 398 at lib/refcount.c:28 refcount_warn_saturate+0x119/0x1c0 lib/refcount.c:28 Modules linked in: CPU: 1 UID: 0 PID: 398 Comm: syz.2.19 Tainted: G W syzkaller #0 c7db6ca8d812f5bae3d5d94ae814da2ca1a33223 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:refcount_warn_saturate+0x119/0x1c0 lib/refcount.c:28 Code: 05 01 48 c7 c7 00 3a 52 86 e8 23 50 52 fe 0f 0b eb da e8 aa 5a d7 fe c6 05 ae 25 b4 05 01 48 c7 c7 60 3a 52 86 e8 07 50 52 fe <0f> 0b eb be e8 8e 5a d7 fe c6 05 8f 25 b4 05 01 48 c7 c7 a0 39 52 RSP: 0018:ffffc90000e4f1d8 EFLAGS: 00010246 RAX: a920f2152e38e700 RBX: 0000000000000003 RCX: ffff8881179d2780 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffffc90000e4f1e8 R08: ffff8881f6d29593 R09: 1ffff1103eda52b2 R10: dffffc0000000000 R11: ffffed103eda52b3 R12: 0000000000000000 R13: ffff8881143f2584 R14: ffff8881143f2580 R15: ffff8881143f2580 FS: 00005555954d3500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055558468b4e8 CR3: 0000000117960000 CR4: 00000000003526b0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] kref_put include/linux/kref.h:64 [inline] kobject_put+0x25a/0x2a0 lib/kobject.c:737 put_device+0x23/0x40 drivers/base/core.c:3800 __scsi_remove_device+0xc4/0x3c0 drivers/scsi/scsi_sysfs.c:1501 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46af39f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff769e5728 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f46af625fa0 RCX: 00007f46af39f559 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f46af436b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f46af625fac R14: 00007f46af625fa0 R15: 00007f46af625fa0 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ kobject: '(null)' (ffff8881143f21d0): is not initialized, yet kobject_put() is being called. WARNING: CPU: 0 PID: 398 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 lib/kobject.c:734 Modules linked in: CPU: 0 UID: 0 PID: 398 Comm: syz.2.19 Tainted: G W syzkaller #0 c7db6ca8d812f5bae3d5d94ae814da2ca1a33223 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:kobject_put+0x8e/0x2a0 lib/kobject.c:734 Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 d4 16 43 fc 48 8b 33 48 c7 c7 40 b9 9b 86 48 89 da e8 e2 7e 64 fb <0f> 0b eb 0f e8 69 89 e9 fb e9 9c 01 00 00 e8 5f 89 e9 fb 4c 8d 7b RSP: 0018:ffffc90000e4f1f8 EFLAGS: 00010246 RAX: a920f2152e38e700 RBX: ffff8881143f21d0 RCX: ffff8881179d2780 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffffc90000e4f220 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0f9f334 R12: ffffffff86635950 R13: ffff8881143f220c R14: 1ffff1102287e441 R15: 0000000000000000 FS: 00005555954d3500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8dbb7ecc40 CR3: 0000000117960000 CR4: 00000000003526b0 Call Trace: put_device+0x23/0x40 drivers/base/core.c:3800 __scsi_remove_device+0x32d/0x3c0 drivers/scsi/scsi_sysfs.c:1527 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46af39f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff769e5728 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f46af625fa0 RCX: 00007f46af39f559 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f46af436b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f46af625fac R14: 00007f46af625fa0 R15: 00007f46af625fa0 ---[ end trace 0000000000000000 ]--- scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured ------------[ cut here ]------------ kernel BUG at drivers/scsi/scsi_scan.c:594! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 398 Comm: syz.2.19 Tainted: G W syzkaller #0 c7db6ca8d812f5bae3d5d94ae814da2ca1a33223 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:scsi_target_reap+0x172/0x180 drivers/scsi/scsi_scan.c:594 Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 78 24 81 fe e9 39 ff ff ff e8 4e 97 27 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 07 43 6b cb 90 90 90 RSP: 0018:ffffc90000e4f7a8 EFLAGS: 00010293 RAX: ffffffff8361bef2 RBX: ffff888115ce2800 RCX: ffff8881179d2780 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005 RBP: ffffc90000e4f7d0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520001c9ee0 R12: ffff888115ce2800 R13: ffff888115ce2bc4 R14: 1ffff11022b9c578 R15: 0000000000000005 FS: 00005555954d3500(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8dbb7ecc40 CR3: 0000000117960000 CR4: 00000000003526b0 Call Trace: __scsi_scan_target+0x62c/0xc20 drivers/scsi/scsi_scan.c:1771 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f46af39f559 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff769e5728 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f46af625fa0 RCX: 00007f46af39f559 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f46af436b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f46af625fac R14: 00007f46af625fa0 R15: 00007f46af625fa0 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:scsi_target_reap+0x172/0x180 drivers/scsi/scsi_scan.c:594 Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 78 24 81 fe e9 39 ff ff ff e8 4e 97 27 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 07 43 6b cb 90 90 90 RSP: 0018:ffffc90000e4f7a8 EFLAGS: 00010293 RAX: ffffffff8361bef2 RBX: ffff888115ce2800 RCX: ffff8881179d2780 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005 RBP: ffffc90000e4f7d0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520001c9ee0 R12: ffff888115ce2800 R13: ffff888115ce2bc4 R14: 1ffff11022b9c578 R15: 0000000000000005 FS: 00005555954d3500(0000) GS:ffff8881f6d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffab9e71220 CR3: 0000000117960000 CR4: 00000000003526b0