Extracting prog: 1m17.013012588s
Minimizing prog: 22m26.767207648s
Simplifying prog options: 0s
Extracting C: 28.614551895s
Simplifying C: 7m58.360733653s


extracting reproducer from 74 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-syz_mount_image$bfs-mount$overlay-open_tree-fchdir-close-chdir-openat$dir-ioctl$KDFONTOP_SET-ioctl$TCSETSF
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x4)
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901)
fchdir(r1)
close(r1)
chdir(&(0x7f0000000000)='./file0\x00')
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000000)={0x0, 0x0, 0x8, 0x1e, 0x200, &(0x7f0000000880)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309000000000000000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"})
ioctl$TCSETSF(r1, 0x5404, &(0x7f00000000c0)={0x0, 0xca, 0x120000, 0xb2, 0x2, "0fa5c9764e5831a8baebfb9a7bc835591e8209"})

program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
single: successfully extracted reproducer
found reproducer with 10 syscalls
minimizing guilty program
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-syz_mount_image$bfs-mount$overlay-open_tree-fchdir-close-chdir-openat$dir-ioctl$KDFONTOP_SET
detailed listing:
executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x4)
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901)
fchdir(r1)
close(r1)
chdir(&(0x7f0000000000)='./file0\x00')
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)
ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000000)={0x0, 0x0, 0x8, 0x1e, 0x200, &(0x7f0000000880)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309000000000000000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"})

program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-syz_mount_image$bfs-mount$overlay-open_tree-fchdir-close-chdir-openat$dir
detailed listing:
executing program 0:
syz_open_dev$tty1(0xc, 0x4, 0x4)
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901)
fchdir(r0)
close(r0)
chdir(&(0x7f0000000000)='./file0\x00')
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-syz_mount_image$bfs-mount$overlay-open_tree-fchdir-close-chdir
detailed listing:
executing program 0:
syz_open_dev$tty1(0xc, 0x4, 0x4)
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901)
fchdir(r0)
close(r0)
chdir(&(0x7f0000000000)='./file0\x00')

program did not crash
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-syz_mount_image$bfs-mount$overlay-open_tree-fchdir-close-openat$dir
detailed listing:
executing program 0:
syz_open_dev$tty1(0xc, 0x4, 0x4)
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901)
fchdir(r0)
close(r0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)

program did not crash
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-syz_mount_image$bfs-mount$overlay-open_tree-fchdir-chdir-openat$dir
detailed listing:
executing program 0:
syz_open_dev$tty1(0xc, 0x4, 0x4)
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901)
fchdir(r0)
chdir(&(0x7f0000000000)='./file0\x00')
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-syz_mount_image$bfs-mount$overlay-open_tree-chdir-openat$dir
detailed listing:
executing program 0:
syz_open_dev$tty1(0xc, 0x4, 0x4)
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901)
chdir(&(0x7f0000000000)='./file0\x00')
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-syz_mount_image$bfs-mount$overlay-chdir-openat$dir
detailed listing:
executing program 0:
syz_open_dev$tty1(0xc, 0x4, 0x4)
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(&(0x7f0000000000)='./file0\x00')
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-syz_mount_image$bfs-chdir-openat$dir
detailed listing:
executing program 0:
syz_open_dev$tty1(0xc, 0x4, 0x4)
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
chdir(&(0x7f0000000000)='./file0\x00')
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)

program did not crash
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$tty1-mount$overlay-chdir-openat$dir
detailed listing:
executing program 0:
syz_open_dev$tty1(0xc, 0x4, 0x4)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(&(0x7f0000000000)='./file0\x00')
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)

program did not crash
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
detailed listing:
executing program 0:
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(&(0x7f0000000000)='./file0\x00')
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)

program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
detailed listing:
executing program 0:
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(&(0x7f0000000000)='./file0\x00')
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)

program did not crash
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
detailed listing:
executing program 0:
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(&(0x7f0000000000)='./file0\x00')
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)

program did not crash
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
detailed listing:
executing program 0:
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, 0x0)
chdir(&(0x7f0000000000)='./file0\x00')
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)

program did not crash
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
detailed listing:
executing program 0:
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0)

program did not crash
testing program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
detailed listing:
executing program 0:
syz_mount_image$bfs(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x1000004, &(0x7f0000000200)=ANY=[], 0x0, 0xaf, &(0x7f00000003c0)="$eJzs17FJBFEQBuB/d3VXDWzAwFosRQQTzYwUwYpswgIswT40GXnrIsddeBx3B98XDMz/XjAw0Xz+vF/lMslbUlU1JjlPpiT19PzycPvY6pDmLP/ae3cSjl3fFrns9npYwptWxmnp5vSr+66q17s5Od3TsAAAwFb6fFys9t3Gj7+r7349GnY+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBB+A0AAP//MrQUNA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(&(0x7f0000000000)='./file0\x00')
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=53.096561532s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
simplifying C reproducer
testing compiled C program (duration=53.096561532s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
testing compiled C program (duration=53.096561532s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
testing compiled C program (duration=53.096561532s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
testing compiled C program (duration=53.096561532s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
testing compiled C program (duration=53.096561532s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
testing compiled C program (duration=53.096561532s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
testing compiled C program (duration=53.096561532s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bfs-mount$overlay-chdir-openat$dir
program crashed: BUG: unable to handle kernel NULL pointer dereference in __lookup_slow
reproducing took 32m10.755528615s
repro crashed as (corrupted=false):
loop0: detected capacity change from 0 to 64
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 20e46067 P4D 20e46067 PUD 2321a067 PMD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4161 Comm: syz-executor441 Not tainted 5.15.173-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90002a77318 EFLAGS: 00010246
RAX: 1ffffffff152df28 RBX: ffffffff8a96f940 RCX: ffff88802a821dc0
RDX: 0000000000000000 RSI: ffff8880174782f0 RDI: ffff88806ec4c018
RBP: ffffc90002a77430 R08: ffffffff81d86ead R09: fffffbfff2d1a861
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8880174782f0 R14: 1ffff11002e8f05e R15: 1ffff9200054ee68
FS:  000055556cc65380(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000007a933000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __lookup_slow+0x275/0x3d0 fs/namei.c:1663
 lookup_slow fs/namei.c:1680 [inline]
 lookup_one_unlocked+0x19c/0x280 fs/namei.c:2779
 ovl_lookup_positive_unlocked fs/overlayfs/namei.c:205 [inline]
 ovl_lookup_single+0x62/0x840 fs/overlayfs/namei.c:230
 ovl_lookup_layer+0x413/0x510 fs/overlayfs/namei.c:314
 ovl_lookup+0xb77/0x1f10 fs/overlayfs/namei.c:914
 lookup_open fs/namei.c:3440 [inline]
 open_last_lookups fs/namei.c:3532 [inline]
 path_openat+0x111d/0x2f20 fs/namei.c:3739
 do_filp_open+0x21c/0x460 fs/namei.c:3769
 do_sys_openat2+0x13b/0x4f0 fs/open.c:1253
 do_sys_open fs/open.c:1269 [inline]
 __do_sys_openat fs/open.c:1285 [inline]
 __se_sys_openat fs/open.c:1280 [inline]
 __x64_sys_openat+0x243/0x290 fs/open.c:1280
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fd7ffd1c709
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc74aff348 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fd7ffd1c709
RDX: 0000000000000000 RSI: 0000000020000040 RDI: ffffffffffffff9c
RBP: 00007fd7ffd8f610 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc74aff518 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace c1369ba438c8e51d ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90002a77318 EFLAGS: 00010246
RAX: 1ffffffff152df28 RBX: ffffffff8a96f940 RCX: ffff88802a821dc0
RDX: 0000000000000000 RSI: ffff8880174782f0 RDI: ffff88806ec4c018
RBP: ffffc90002a77430 R08: ffffffff81d86ead R09: fffffbfff2d1a861
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8880174782f0 R14: 1ffff11002e8f05e R15: 1ffff9200054ee68
FS:  000055556cc65380(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000007a933000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

final repro crashed as (corrupted=false):
loop0: detected capacity change from 0 to 64
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 20e46067 P4D 20e46067 PUD 2321a067 PMD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4161 Comm: syz-executor441 Not tainted 5.15.173-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90002a77318 EFLAGS: 00010246
RAX: 1ffffffff152df28 RBX: ffffffff8a96f940 RCX: ffff88802a821dc0
RDX: 0000000000000000 RSI: ffff8880174782f0 RDI: ffff88806ec4c018
RBP: ffffc90002a77430 R08: ffffffff81d86ead R09: fffffbfff2d1a861
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8880174782f0 R14: 1ffff11002e8f05e R15: 1ffff9200054ee68
FS:  000055556cc65380(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000007a933000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __lookup_slow+0x275/0x3d0 fs/namei.c:1663
 lookup_slow fs/namei.c:1680 [inline]
 lookup_one_unlocked+0x19c/0x280 fs/namei.c:2779
 ovl_lookup_positive_unlocked fs/overlayfs/namei.c:205 [inline]
 ovl_lookup_single+0x62/0x840 fs/overlayfs/namei.c:230
 ovl_lookup_layer+0x413/0x510 fs/overlayfs/namei.c:314
 ovl_lookup+0xb77/0x1f10 fs/overlayfs/namei.c:914
 lookup_open fs/namei.c:3440 [inline]
 open_last_lookups fs/namei.c:3532 [inline]
 path_openat+0x111d/0x2f20 fs/namei.c:3739
 do_filp_open+0x21c/0x460 fs/namei.c:3769
 do_sys_openat2+0x13b/0x4f0 fs/open.c:1253
 do_sys_open fs/open.c:1269 [inline]
 __do_sys_openat fs/open.c:1285 [inline]
 __se_sys_openat fs/open.c:1280 [inline]
 __x64_sys_openat+0x243/0x290 fs/open.c:1280
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fd7ffd1c709
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc74aff348 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fd7ffd1c709
RDX: 0000000000000000 RSI: 0000000020000040 RDI: ffffffffffffff9c
RBP: 00007fd7ffd8f610 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc74aff518 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace c1369ba438c8e51d ]---
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc90002a77318 EFLAGS: 00010246
RAX: 1ffffffff152df28 RBX: ffffffff8a96f940 RCX: ffff88802a821dc0
RDX: 0000000000000000 RSI: ffff8880174782f0 RDI: ffff88806ec4c018
RBP: ffffc90002a77430 R08: ffffffff81d86ead R09: fffffbfff2d1a861
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8880174782f0 R14: 1ffff11002e8f05e R15: 1ffff9200054ee68
FS:  000055556cc65380(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 000000007a933000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400