Extracting prog: 1m9.279441712s
Minimizing prog: 38m22.848218979s
Simplifying prog options: 0s
Extracting C: 27.113085537s
Simplifying C: 13m48.307537485s


extracting reproducer from 67 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6-openat$dir-umount2-getdents-mprotect-mprotect-syz_clone-ptrace-wait4-wait4-eventfd-keyctl$KEYCTL_PKEY_VERIFY-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-write$eventfd
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x0, 0x0)
umount2(&(0x7f0000000180)='./bus\x00', 0x1)
getdents(r6, 0x0, 0x58)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mprotect(&(0x7f000000d000/0x4000)=nil, 0x4000, 0x5)
r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x4207, 0xffffffffffffffff)
wait4(r7, 0x0, 0x40000000, 0x0) (async)
wait4(r7, 0x0, 0x40000000, 0x0)
r8 = eventfd(0x7f)
keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000640), &(0x7f0000000680)=ANY=[@ANYBLOB="656e630600617720ff6173683d736861312d6e6900"/77], 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x2d, 0x4, 0x1, 0x8010}]})
write$eventfd(r8, 0x0, 0x47)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
single: successfully extracted reproducer
found reproducer with 40 syscalls
minimizing guilty program
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6-openat$dir-umount2-getdents-mprotect-mprotect-syz_clone-ptrace-wait4-wait4-eventfd-keyctl$KEYCTL_PKEY_VERIFY-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x0, 0x0)
umount2(&(0x7f0000000180)='./bus\x00', 0x1)
getdents(r6, 0x0, 0x58)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mprotect(&(0x7f000000d000/0x4000)=nil, 0x4000, 0x5)
r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x4207, 0xffffffffffffffff)
wait4(r7, 0x0, 0x40000000, 0x0) (async)
wait4(r7, 0x0, 0x40000000, 0x0)
eventfd(0x7f)
keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000640), &(0x7f0000000680)=ANY=[@ANYBLOB="656e630600617720ff6173683d736861312d6e6900"/77], 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x2d, 0x4, 0x1, 0x8010}]})

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6-openat$dir-umount2-getdents-mprotect-mprotect-syz_clone-ptrace-wait4-wait4-eventfd-keyctl$KEYCTL_PKEY_VERIFY
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x0, 0x0)
umount2(&(0x7f0000000180)='./bus\x00', 0x1)
getdents(r6, 0x0, 0x58)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mprotect(&(0x7f000000d000/0x4000)=nil, 0x4000, 0x5)
r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x4207, 0xffffffffffffffff)
wait4(r7, 0x0, 0x40000000, 0x0) (async)
wait4(r7, 0x0, 0x40000000, 0x0)
eventfd(0x7f)
keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000640), &(0x7f0000000680)=ANY=[@ANYBLOB="656e630600617720ff6173683d736861312d6e6900"/77], 0x0, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6-openat$dir-umount2-getdents-mprotect-mprotect-syz_clone-ptrace-wait4-wait4-eventfd
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x0, 0x0)
umount2(&(0x7f0000000180)='./bus\x00', 0x1)
getdents(r6, 0x0, 0x58)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mprotect(&(0x7f000000d000/0x4000)=nil, 0x4000, 0x5)
r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x4207, 0xffffffffffffffff)
wait4(r7, 0x0, 0x40000000, 0x0) (async)
wait4(r7, 0x0, 0x40000000, 0x0)
eventfd(0x7f)

program crashed: lost connection to test machine
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6-openat$dir-umount2-getdents-mprotect-mprotect-syz_clone-ptrace-wait4-wait4
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x0, 0x0)
umount2(&(0x7f0000000180)='./bus\x00', 0x1)
getdents(r6, 0x0, 0x58)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mprotect(&(0x7f000000d000/0x4000)=nil, 0x4000, 0x5)
r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x4207, 0xffffffffffffffff)
wait4(r7, 0x0, 0x40000000, 0x0) (async)
wait4(r7, 0x0, 0x40000000, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6-openat$dir-umount2-getdents-mprotect-mprotect-syz_clone-ptrace-wait4
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x0, 0x0)
umount2(&(0x7f0000000180)='./bus\x00', 0x1)
getdents(r6, 0x0, 0x58)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mprotect(&(0x7f000000d000/0x4000)=nil, 0x4000, 0x5)
r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x4207, 0xffffffffffffffff)
wait4(r7, 0x0, 0x40000000, 0x0) (async)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6-openat$dir-umount2-getdents-mprotect-mprotect-syz_clone-ptrace
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x0, 0x0)
umount2(&(0x7f0000000180)='./bus\x00', 0x1)
getdents(r6, 0x0, 0x58)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mprotect(&(0x7f000000d000/0x4000)=nil, 0x4000, 0x5)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x4207, 0xffffffffffffffff)

program crashed: KASAN: use-after-free Read in incfs_free_mount_info
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6-openat$dir-umount2-getdents-mprotect-mprotect-syz_clone
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x0, 0x0)
umount2(&(0x7f0000000180)='./bus\x00', 0x1)
getdents(r6, 0x0, 0x58)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mprotect(&(0x7f000000d000/0x4000)=nil, 0x4000, 0x5)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)

program crashed: KASAN: use-after-free Read in incfs_free_mount_info
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6-openat$dir-umount2-getdents-mprotect-mprotect
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x0, 0x0)
umount2(&(0x7f0000000180)='./bus\x00', 0x1)
getdents(r6, 0x0, 0x58)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
mprotect(&(0x7f000000d000/0x4000)=nil, 0x4000, 0x5)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6-openat$dir-umount2-getdents-mprotect
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x0, 0x0)
umount2(&(0x7f0000000180)='./bus\x00', 0x1)
getdents(r6, 0x0, 0x58)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6-openat$dir-umount2-getdents
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x0, 0x0)
umount2(&(0x7f0000000180)='./bus\x00', 0x1)
getdents(r6, 0x0, 0x58)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6-openat$dir-umount2
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)
openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x0, 0x0)
umount2(&(0x7f0000000180)='./bus\x00', 0x1)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6-openat$dir
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)
openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x0, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6-sendmmsg$inet6
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN-sendmmsg$inet6
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002500)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[], 0x60}}], 0x1, 0x48845) (async)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL-ioctl$MON_IOCQ_URB_LEN
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})
ioctl$MON_IOCQ_URB_LEN(r5, 0x9201)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE-ioctl$INCFS_IOC_PERMIT_FILL
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r5 = ioctl$KVM_GET_STATS_FD_vm(r4, 0xaece)
read$FUSE(r5, 0x0, 0x0)
ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000000)={r2})

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm-read$FUSE
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
r4 = ioctl$KVM_GET_STATS_FD_vm(r3, 0xaece)
read$FUSE(r4, 0x0, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create-ioctl$KVM_GET_STATS_FD_vm
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))
ioctl$KVM_GET_STATS_FD_vm(r3, 0xaece)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-timer_create
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
timer_create(0x4, &(0x7f00000001c0)={0x0, 0x14, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000240))

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm-openat$kvm
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc-openat$kvm
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
socket$tipc(0x1e, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER-socket$tipc
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)
socket$tipc(0x1e, 0x2, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER-ioctl$KVM_X86_SET_MSR_FILTER
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_X86_SET_MSR_FILTER
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, 0x0) (async)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs-openat$kvm
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs-mount$incfs
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir-mount$incfs
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mkdir
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)

program did not crash
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mkdir-mount$incfs
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-timer_settime-mount$incfs
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)

program did not crash
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-mkdir-mount$incfs
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-mkdir-mount$incfs
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000020000009500000000000000"], &(0x7f0000000080)='syzkaller\x00'}, 0x80) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-mkdir-mount$incfs
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
socket$nl_route(0x10, 0x3, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-mkdir-mount$incfs
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0) (async)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program did not crash
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(0x0, &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program did not crash
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', 0x0, &(0x7f0000000840), 0x1004002, 0x0)

program did not crash
testing program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', 0x0, 0x1004002, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=34.744696953s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
simplifying C reproducer
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program did not crash
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program did not crash
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program did not crash
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
validation run: crashed=true
testing program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
validation run: crashed=true
testing program (duration=34.744696953s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
validation run: crashed=true
reproducing took 55m54.57126693s
repro crashed as (corrupted=false):
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe59bcc980
RBP: 00007ffe59bcc980 R08: 00007ffe59bcd980 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe59bcda10
R13: 00007f799b512048 R14: 0000000000006373 R15: 00007ffe59bcda50
 </TASK>
---[ end trace b176204595157565 ]---
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:188 [inline]
BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:454
Write of size 4 at addr 0000000000000170 by task syz-executor/355

CPU: 1 PID: 355 Comm: syz-executor Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 __kasan_report mm/kasan/report.c:431 [inline]
 kasan_report+0xe7/0x140 mm/kasan/report.c:444
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_inc_return include/linux/atomic/atomic-instrumented.h:188 [inline]
 ihold+0x20/0x60 fs/inode.c:454
 d_delete_notify include/linux/fsnotify.h:275 [inline]
 vfs_rmdir+0x1f0/0x460 fs/namei.c:4170
 incfs_kill_sb+0x105/0x220 fs/incfs/vfs.c:1989
 deactivate_locked_super+0xa0/0x100 fs/super.c:335
 deactivate_super+0xaf/0xe0 fs/super.c:366
 cleanup_mnt+0x45b/0x510 fs/namespace.c:1148
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1155
 task_work_run+0x127/0x190 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f799b47da57
Code: a2 c7 05 9c fc 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffe59bcc8c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f799b47da57
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe59bcc980
RBP: 00007ffe59bcc980 R08: 00007ffe59bcd980 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe59bcda10
R13: 00007f799b512048 R14: 0000000000006373 R15: 00007ffe59bcda50
 </TASK>
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000170
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 128a0b067 P4D 128a0b067 PUD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 355 Comm: syz-executor Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:370 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:189 [inline]
RIP: 0010:ihold+0x26/0x60 fs/inode.c:454
Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 f1 ca b2 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 90 fb f1 ff 41 be 01 00 00 00 <f0> 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 71
RSP: 0018:ffffc90000b17ce8 EFLAGS: 00010246
RAX: ffff88811019a700 RBX: 0000000000000000 RCX: ffff88811019a780
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc90000b17cf8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e18a4c R12: 1ffff11021a2db7c
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  00005555725e6500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 000000010f2ab000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 d_delete_notify include/linux/fsnotify.h:275 [inline]
 vfs_rmdir+0x1f0/0x460 fs/namei.c:4170
 incfs_kill_sb+0x105/0x220 fs/incfs/vfs.c:1989
 deactivate_locked_super+0xa0/0x100 fs/super.c:335
 deactivate_super+0xaf/0xe0 fs/super.c:366
 cleanup_mnt+0x45b/0x510 fs/namespace.c:1148
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1155
 task_work_run+0x127/0x190 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f799b47da57
Code: a2 c7 05 9c fc 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffe59bcc8c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f799b47da57
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe59bcc980
RBP: 00007ffe59bcc980 R08: 00007ffe59bcd980 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe59bcda10
R13: 00007f799b512048 R14: 0000000000006373 R15: 00007ffe59bcda50
 </TASK>
Modules linked in:
CR2: 0000000000000170
---[ end trace b176204595157566 ]---
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:370 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:189 [inline]
RIP: 0010:ihold+0x26/0x60 fs/inode.c:454
Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 f1 ca b2 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 90 fb f1 ff 41 be 01 00 00 00 <f0> 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 71
RSP: 0018:ffffc90000b17ce8 EFLAGS: 00010246
RAX: ffff88811019a700 RBX: 0000000000000000 RCX: ffff88811019a780
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc90000b17cf8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e18a4c R12: 1ffff11021a2db7c
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  00005555725e6500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 000000010f2ab000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 00                	add    %al,(%rax)
   4:	55                   	push   %rbp
   5:	48 89 e5             	mov    %rsp,%rbp
   8:	41 56                	push   %r14
   a:	53                   	push   %rbx
   b:	48 89 fb             	mov    %rdi,%rbx
   e:	e8 f1 ca b2 ff       	call   0xffb2cb04
  13:	48 8d bb 70 01 00 00 	lea    0x170(%rbx),%rdi
  1a:	be 04 00 00 00       	mov    $0x4,%esi
  1f:	e8 90 fb f1 ff       	call   0xfff1fbb4
  24:	41 be 01 00 00 00    	mov    $0x1,%r14d
* 2a:	f0 44 0f c1 b3 70 01 	lock xadd %r14d,0x170(%rbx) <-- trapping instruction
  31:	00 00
  33:	41 ff c6             	inc    %r14d
  36:	bf 02 00 00 00       	mov    $0x2,%edi
  3b:	44 89 f6             	mov    %r14d,%esi
  3e:	e8                   	.byte 0xe8
  3f:	71                   	.byte 0x71

final repro crashed as (corrupted=false):
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe59bcc980
RBP: 00007ffe59bcc980 R08: 00007ffe59bcd980 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe59bcda10
R13: 00007f799b512048 R14: 0000000000006373 R15: 00007ffe59bcda50
 </TASK>
---[ end trace b176204595157565 ]---
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:188 [inline]
BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:454
Write of size 4 at addr 0000000000000170 by task syz-executor/355

CPU: 1 PID: 355 Comm: syz-executor Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 __kasan_report mm/kasan/report.c:431 [inline]
 kasan_report+0xe7/0x140 mm/kasan/report.c:444
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_inc_return include/linux/atomic/atomic-instrumented.h:188 [inline]
 ihold+0x20/0x60 fs/inode.c:454
 d_delete_notify include/linux/fsnotify.h:275 [inline]
 vfs_rmdir+0x1f0/0x460 fs/namei.c:4170
 incfs_kill_sb+0x105/0x220 fs/incfs/vfs.c:1989
 deactivate_locked_super+0xa0/0x100 fs/super.c:335
 deactivate_super+0xaf/0xe0 fs/super.c:366
 cleanup_mnt+0x45b/0x510 fs/namespace.c:1148
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1155
 task_work_run+0x127/0x190 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f799b47da57
Code: a2 c7 05 9c fc 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffe59bcc8c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f799b47da57
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe59bcc980
RBP: 00007ffe59bcc980 R08: 00007ffe59bcd980 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe59bcda10
R13: 00007f799b512048 R14: 0000000000006373 R15: 00007ffe59bcda50
 </TASK>
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000170
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 128a0b067 P4D 128a0b067 PUD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 355 Comm: syz-executor Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:370 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:189 [inline]
RIP: 0010:ihold+0x26/0x60 fs/inode.c:454
Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 f1 ca b2 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 90 fb f1 ff 41 be 01 00 00 00 <f0> 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 71
RSP: 0018:ffffc90000b17ce8 EFLAGS: 00010246
RAX: ffff88811019a700 RBX: 0000000000000000 RCX: ffff88811019a780
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc90000b17cf8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e18a4c R12: 1ffff11021a2db7c
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  00005555725e6500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 000000010f2ab000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 d_delete_notify include/linux/fsnotify.h:275 [inline]
 vfs_rmdir+0x1f0/0x460 fs/namei.c:4170
 incfs_kill_sb+0x105/0x220 fs/incfs/vfs.c:1989
 deactivate_locked_super+0xa0/0x100 fs/super.c:335
 deactivate_super+0xaf/0xe0 fs/super.c:366
 cleanup_mnt+0x45b/0x510 fs/namespace.c:1148
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1155
 task_work_run+0x127/0x190 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f799b47da57
Code: a2 c7 05 9c fc 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffe59bcc8c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f799b47da57
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe59bcc980
RBP: 00007ffe59bcc980 R08: 00007ffe59bcd980 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe59bcda10
R13: 00007f799b512048 R14: 0000000000006373 R15: 00007ffe59bcda50
 </TASK>
Modules linked in:
CR2: 0000000000000170
---[ end trace b176204595157566 ]---
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:370 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:189 [inline]
RIP: 0010:ihold+0x26/0x60 fs/inode.c:454
Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 f1 ca b2 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 90 fb f1 ff 41 be 01 00 00 00 <f0> 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 71
RSP: 0018:ffffc90000b17ce8 EFLAGS: 00010246
RAX: ffff88811019a700 RBX: 0000000000000000 RCX: ffff88811019a780
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc90000b17cf8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e18a4c R12: 1ffff11021a2db7c
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  00005555725e6500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 000000010f2ab000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 00                	add    %al,(%rax)
   4:	55                   	push   %rbp
   5:	48 89 e5             	mov    %rsp,%rbp
   8:	41 56                	push   %r14
   a:	53                   	push   %rbx
   b:	48 89 fb             	mov    %rdi,%rbx
   e:	e8 f1 ca b2 ff       	call   0xffb2cb04
  13:	48 8d bb 70 01 00 00 	lea    0x170(%rbx),%rdi
  1a:	be 04 00 00 00       	mov    $0x4,%esi
  1f:	e8 90 fb f1 ff       	call   0xfff1fbb4
  24:	41 be 01 00 00 00    	mov    $0x1,%r14d
* 2a:	f0 44 0f c1 b3 70 01 	lock xadd %r14d,0x170(%rbx) <-- trapping instruction
  31:	00 00
  33:	41 ff c6             	inc    %r14d
  36:	bf 02 00 00 00       	mov    $0x2,%edi
  3b:	44 89 f6             	mov    %r14d,%esi
  3e:	e8                   	.byte 0xe8
  3f:	71                   	.byte 0x71