Extracting prog: 1m3.609971169s Minimizing prog: 22m12.826719656s Simplifying prog options: 0s Extracting C: 55.379881715s Simplifying C: 12m13.596943419s extracting reproducer from 70 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir-openat-mount$overlay-chdir-mount$fuse-open-mkdirat-open-renameat2-syz_open_dev$usbmon-syz_open_procfs-unshare-pselect6-renameat2 detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(r2, &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r3 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0xdb5cc6aa2476f800) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r3, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x4) syz_open_dev$usbmon(&(0x7f0000000180), 0x80000001, 0x82002) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') unshare(0x22020600) pselect6(0x40, &(0x7f0000000140)={0x2, 0x0, 0x5, 0x3, 0x200000000002, 0x0, 0x100, 0x5}, &(0x7f0000000040)={0x1d, 0xfffffffffffffffe, 0x40, 0x7eff, 0xfffffffffffffffc, 0xfffffffffffffffe, 0x71e7, 0x4}, 0x0, 0x0, 0x0) renameat2(r2, &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r3, &(0x7f00000002c0)='./file0\x00', 0x2) program crashed: general protection fault in mntget single: successfully extracted reproducer found reproducer with 22 syscalls minimizing guilty program testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir-openat-mount$overlay-chdir-mount$fuse-open-mkdirat-open-renameat2-syz_open_dev$usbmon-syz_open_procfs-unshare-pselect6 detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(r2, &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r3 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0xdb5cc6aa2476f800) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r3, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x4) syz_open_dev$usbmon(&(0x7f0000000180), 0x80000001, 0x82002) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') unshare(0x22020600) pselect6(0x40, &(0x7f0000000140)={0x2, 0x0, 0x5, 0x3, 0x200000000002, 0x0, 0x100, 0x5}, &(0x7f0000000040)={0x1d, 0xfffffffffffffffe, 0x40, 0x7eff, 0xfffffffffffffffc, 0xfffffffffffffffe, 0x71e7, 0x4}, 0x0, 0x0, 0x0) program crashed: general protection fault in mntget testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir-openat-mount$overlay-chdir-mount$fuse-open-mkdirat-open-renameat2-syz_open_dev$usbmon-syz_open_procfs-unshare detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(r2, &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r3 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0xdb5cc6aa2476f800) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r3, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x4) syz_open_dev$usbmon(&(0x7f0000000180), 0x80000001, 0x82002) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') unshare(0x22020600) program crashed: general protection fault in mntget testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir-openat-mount$overlay-chdir-mount$fuse-open-mkdirat-open-renameat2-syz_open_dev$usbmon-syz_open_procfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(r2, &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r3 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0xdb5cc6aa2476f800) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r3, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x4) syz_open_dev$usbmon(&(0x7f0000000180), 0x80000001, 0x82002) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') program crashed: general protection fault in mntget testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir-openat-mount$overlay-chdir-mount$fuse-open-mkdirat-open-renameat2-syz_open_dev$usbmon detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(r2, &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r3 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0xdb5cc6aa2476f800) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r3, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x4) syz_open_dev$usbmon(&(0x7f0000000180), 0x80000001, 0x82002) program crashed: general protection fault in mntget testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir-openat-mount$overlay-chdir-mount$fuse-open-mkdirat-open-renameat2 detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(r2, &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r3 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0xdb5cc6aa2476f800) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r3, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x4) program crashed: general protection fault in mntget testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir-openat-mount$overlay-chdir-mount$fuse-open-mkdirat-open detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(r2, &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) open(&(0x7f0000000180)='./file0\x00', 0x0, 0xdb5cc6aa2476f800) program crashed: general protection fault in mntget testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir-openat-mount$overlay-chdir-mount$fuse-open-mkdirat detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) mkdirat(r2, &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir-openat-mount$overlay-chdir-mount$fuse-open detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) open(&(0x7f0000000300)='.\x00', 0x0, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir-openat-mount$overlay-chdir-mount$fuse detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir-openat-mount$overlay-chdir detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir-openat-mount$overlay detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir-openat detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x40040, 0x6ab858183a7ef6ba) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs-chdir detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mkdir detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) program did not crash testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-syz_mount_image$vfat-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file1\x00', 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="666c7573682c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6d697865642c756e695f786c6174653d302c6e6f6e756d7461696c3d302c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c00a56dc300a96c9b20f3fabdcb10cad696323259cc0500e5f91620d7b9dc000000000057c51b98cfb3b59f8db941abb77112000000b8ff"], 0x8, 0x250, &(0x7f0000000b80)="$eJzs2k9rHHUYB/BnYqUxJd2I/2hB+kMP6mVocvIgkiAtiAFFG6EK0qmZ6JJxN2SWwIrYeNGLB1+CZ/HoTZCKFy+5+Ao8eMslxx7EkXbTNhtWyKJxS/P5XPZhn/0uz/AMw+8wu69888n6Wp2vFb2YyrKYWoztuJXFXEzFXdvx0gtXf332navvvbG0vHzp7ZQuL12ZX0gpnb3w0/ufff/czd6Zd384++Pp2Jn7YHfviz92nt45t/vXlY/bdWrXqdPtpSJd73Z7xfWqTKvtej1P6a2qLOoytTt1uTnUX6u6Gxv9VHRWZ2c2Nsu6TkWnn9bLfup1U2+zn4qPinYn5XmeZmeCf2Plu1tNE3vNo9ciu/vd7O/RiuzxlD2xmD11LXtmOzu31zStyQ7KMbm3/6ZpHvs2zty0/xPlwEN9OqL6amtla2XwOegvrUU7qijjYrTiz7h9m+wb1JdfX750Md0xF19WN/bzN7ZWHhnOz0cr5kbn5wf5NJw/HTMH8wvRiidH5xdG5qfjxecP5PNoxW8fRjeqWI3b2fv5z+dTeu3N5UP583d+BwDwsMnTPSPPb3n+T/1Bfozz4aHz1ak4f2qy105E3f90vaiqclMxTnFh3NT05GeeeHH8N1uTRTwIV3qk4pefX335ARhjv1g8vJ1JP5n4P9xf+lET08c7EAAAAAAAAAAAAEfy371F+PX+Pw61snHeLAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE6mvwMAAP//cOvMBw==") mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program did not crash testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-sendfile-mkdir-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-openat$procfs-mkdir-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-openat$ttyS3-mkdir-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-openat-mkdir-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mkdir-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x4, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program did not crash testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(0x0, &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program did not crash testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', 0x0, &(0x7f0000000840), 0x1804002, 0x0) program did not crash testing program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', 0x0, 0x1804002, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=32.260618249s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir simplifying C reproducer testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true testing program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true testing program (duration=32.260618249s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true reproducing took 38m55.590117377s repro crashed as (corrupted=false): RBP: 00007fffe9f906c0 R08: 00007fffe9f916c0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffe9f91750 R13: 00007f83330d32ca R14: 0000000000006f45 R15: 00007fffe9f91790 ---[ end trace 98715df1650147f0 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:423 Write of size 4 at addr 0000000000000170 by task syz-executor/365 CPU: 1 PID: 365 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:439 [inline] kasan_report+0xbd/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] ihold+0x20/0x60 fs/inode.c:423 d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x2d5/0x3c0 fs/namei.c:3873 incfs_kill_sb+0xf7/0x200 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x44f/0x500 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f833303f097 Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fffe9f90608 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f833303f097 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffe9f906c0 RBP: 00007fffe9f906c0 R08: 00007fffe9f916c0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffe9f91750 R13: 00007f83330d32ca R14: 0000000000006f45 R15: 00007fffe9f91790 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000170 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 11198b067 P4D 11198b067 PUD 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 1 PID: 365 Comm: syz-executor Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 b1 7d b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 a0 f5 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 31 RSP: 0018:ffffc90002d17d38 EFLAGS: 00010246 RAX: ffff88810c65a700 RBX: 0000000000000000 RCX: ffff88810c65a780 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90002d17d48 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf648 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000555559a33500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000010fabb000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x2d5/0x3c0 fs/namei.c:3873 incfs_kill_sb+0xf7/0x200 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x44f/0x500 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f833303f097 Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fffe9f90608 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f833303f097 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffe9f906c0 RBP: 00007fffe9f906c0 R08: 00007fffe9f916c0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffe9f91750 R13: 00007f83330d32ca R14: 0000000000006f45 R15: 00007fffe9f91790 Modules linked in: CR2: 0000000000000170 ---[ end trace 98715df1650147f1 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 b1 7d b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 a0 f5 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 31 RSP: 0018:ffffc90002d17d38 EFLAGS: 00010246 RAX: ffff88810c65a700 RBX: 0000000000000000 RCX: ffff88810c65a780 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90002d17d48 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf648 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000555559a33500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000010fabb000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 b1 7d b7 ff call 0xffb77dc4 13: 48 8d bb 70 01 00 00 lea 0x170(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 a0 f5 f1 ff call 0xfff1f5c4 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 70 01 lock xadd %r14d,0x170(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 31 .byte 0x31 final repro crashed as (corrupted=false): RBP: 00007fffe9f906c0 R08: 00007fffe9f916c0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffe9f91750 R13: 00007f83330d32ca R14: 0000000000006f45 R15: 00007fffe9f91790 ---[ end trace 98715df1650147f0 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:423 Write of size 4 at addr 0000000000000170 by task syz-executor/365 CPU: 1 PID: 365 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:439 [inline] kasan_report+0xbd/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] ihold+0x20/0x60 fs/inode.c:423 d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x2d5/0x3c0 fs/namei.c:3873 incfs_kill_sb+0xf7/0x200 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x44f/0x500 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f833303f097 Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fffe9f90608 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f833303f097 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffe9f906c0 RBP: 00007fffe9f906c0 R08: 00007fffe9f916c0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffe9f91750 R13: 00007f83330d32ca R14: 0000000000006f45 R15: 00007fffe9f91790 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000170 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 11198b067 P4D 11198b067 PUD 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 1 PID: 365 Comm: syz-executor Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 b1 7d b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 a0 f5 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 31 RSP: 0018:ffffc90002d17d38 EFLAGS: 00010246 RAX: ffff88810c65a700 RBX: 0000000000000000 RCX: ffff88810c65a780 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90002d17d48 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf648 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000555559a33500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000010fabb000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x2d5/0x3c0 fs/namei.c:3873 incfs_kill_sb+0xf7/0x200 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x44f/0x500 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f833303f097 Code: a2 c7 05 5c 26 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fffe9f90608 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f833303f097 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffe9f906c0 RBP: 00007fffe9f906c0 R08: 00007fffe9f916c0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffe9f91750 R13: 00007f83330d32ca R14: 0000000000006f45 R15: 00007fffe9f91790 Modules linked in: CR2: 0000000000000170 ---[ end trace 98715df1650147f1 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 b1 7d b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 a0 f5 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 31 RSP: 0018:ffffc90002d17d38 EFLAGS: 00010246 RAX: ffff88810c65a700 RBX: 0000000000000000 RCX: ffff88810c65a780 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90002d17d48 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf648 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 0000555559a33500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000010fabb000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 b1 7d b7 ff call 0xffb77dc4 13: 48 8d bb 70 01 00 00 lea 0x170(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 a0 f5 f1 ff call 0xfff1f5c4 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 70 01 lock xadd %r14d,0x170(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 31 .byte 0x31