program: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testnqn\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testnqn/namespaces/1\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./backing_file\x00', 0x42, 0x1ed) ftruncate(r0, 0x1000000) close(r0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r1, &(0x7f0000000480)='./backing_fi', 0xc) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testnqn/namespaces/1/buffered_io\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)='1\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/subsystems/testnqn/namespaces/1/enable\x00', 0x2, 0x0) write(r3, &(0x7f0000000580)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1\x00', 0x1ed) write(0xffffffffffffffff, &(0x7f0000000680)='loop\x00', 0x4) symlinkat(&(0x7f00000006c0)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/subsystems/testnqn\x00') [ 94.404725][ T4654] Bluetooth: hci0: command tx timeout [ 94.522681][ T5331] nvmet: adding nsid 1 to subsystem testnqn [ 94.591772][ T25] audit: type=1800 audit(1786043542.144:2): pid=5331 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="buffered_io" dev="configfs" ino=4249 res=0 errno=0 [ 94.622476][ T5331] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 94.627569][ T5331] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 94.631263][ T5331] CPU: 0 UID: 0 PID: 5331 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.635148][ T5331] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.639497][ T5331] RIP: 0010:strlen+0x29/0x70 [ 94.641616][ T5331] Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00 [ 94.649621][ T5331] RSP: 0018:ffffc9000f887978 EFLAGS: 00010246 [ 94.652190][ T5331] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000 [ 94.655214][ T5331] RDX: ffffc9000f01a000 RSI: 000000000000004c RDI: 0000000000000000 [ 94.658480][ T5331] RBP: ffffc9000f887ab8 R08: ffffffff9057c737 R09: 1ffffffff20af8e6 [ 94.662006][ T5331] R10: dffffc0000000000 R11: fffffbfff20af8e7 R12: 1ffff92001f10f40 [ 94.665458][ T5331] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff [ 94.668918][ T5331] FS: 00007f288e4b26c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 94.672805][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.675671][ T5331] CR2: 0000560d52ab54b0 CR3: 000000000e744000 CR4: 0000000000352ef0 [ 94.679130][ T5331] Call Trace: [ 94.680545][ T5331] [ 94.681804][ T5331] do_getname_kernel+0x1d/0x230 [ 94.683867][ T5331] ? getname_kernel+0xd/0x20 [ 94.685857][ T5331] filp_open+0x87/0x1d0 [ 94.687950][ T5331] ? __pfx_filp_open+0x10/0x10 [ 94.690128][ T5331] ? __pfx___mutex_lock+0x10/0x10 [ 94.692493][ T5331] ? nvmet_ns_enable_store+0xc8/0x170 [ 94.695076][ T5331] nvmet_file_ns_enable+0x74/0x350 [ 94.697474][ T5331] nvmet_ns_enable+0xaa/0x780 [ 94.699578][ T5331] ? configfs_write_iter+0x238/0x430 [ 94.701874][ T5331] nvmet_ns_enable_store+0xd7/0x170 [ 94.704033][ T5331] ? __pfx_nvmet_ns_enable_store+0x10/0x10 [ 94.706540][ T5331] ? down_read+0x2be/0x330 [ 94.708472][ T5331] ? __pfx_nvmet_ns_enable_store+0x10/0x10 [ 94.710938][ T5331] configfs_write_iter+0x337/0x430 [ 94.713314][ T5331] vfs_write+0x612/0xba0 [ 94.715130][ T5331] ? __pfx_vfs_write+0x10/0x10 [ 94.717306][ T5331] ? __fget_files+0x2a/0x420 [ 94.719228][ T5331] ksys_write+0x150/0x270 [ 94.725475][ T5331] ? __pfx_ksys_write+0x10/0x10 [ 94.727587][ T5331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.730173][ T5331] do_syscall_64+0x174/0x580 [ 94.732053][ T5331] ? clear_bhb_loop+0x70/0xc0 [ 94.734051][ T5331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.736543][ T5331] RIP: 0033:0x7f288d59e0d9 [ 94.738487][ T5331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.746290][ T5331] RSP: 002b:00007f288e4b1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 94.749795][ T5331] RAX: ffffffffffffffda RBX: 00007f288d825fa0 RCX: 00007f288d59e0d9 [ 94.753120][ T5331] RDX: 0000000000000001 RSI: 0000200000000580 RDI: 0000000000000004 [ 94.756273][ T5331] RBP: 00007f288d635024 R08: 0000000000000000 R09: 0000000000000000 [ 94.759346][ T5331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.762388][ T5331] R13: 00007f288d826038 R14: 00007f288d825fa0 R15: 00007ffd1425eb08 [ 94.765426][ T5331] [ 94.766684][ T5331] Modules linked in: [ 94.769265][ T5331] ---[ end trace 0000000000000000 ]--- [ 94.776820][ T25] audit: type=1800 audit(1786043542.174:3): pid=5331 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="enable" dev="configfs" ino=4251 res=0 errno=0 [ 94.801021][ T5331] RIP: 0010:strlen+0x29/0x70 [ 94.802873][ T5331] Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00 [ 94.812449][ T5331] RSP: 0018:ffffc9000f887978 EFLAGS: 00010246 [ 94.814754][ T5331] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000 [ 94.818402][ T5331] RDX: ffffc9000f01a000 RSI: 000000000000004c RDI: 0000000000000000 [ 94.821486][ T5331] RBP: ffffc9000f887ab8 R08: ffffffff9057c737 R09: 1ffffffff20af8e6 [ 94.824470][ T5331] R10: dffffc0000000000 R11: fffffbfff20af8e7 R12: 1ffff92001f10f40 [ 94.828412][ T5331] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff [ 94.831784][ T5331] FS: 00007f288e4b26c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 94.835709][ T5331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.839255][ T5331] CR2: 00007f288e490ff8 CR3: 000000000e744000 CR4: 0000000000352ef0 [ 94.842478][ T5331] Kernel panic - not syncing: Fatal exception [ 94.845205][ T5331] Kernel Offset: disabled [ 94.846967][ T5331] Rebooting in 86400 seconds..