Extracting prog: 3m38.700834996s Minimizing prog: 27m34.945039943s Simplifying prog options: 5m18.428352103s Extracting C: 2m34.889481173s Simplifying C: 0s extracting reproducer from 20 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-pipe2-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) pipe2(0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash single: failed to extract reproducer bisect: bisecting 20 programs with base timeout 30s testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 5, 3, 2, 8, 2, 7, 3, 1, 7, 9, 10, 3, 7, 2, 4, 3, 3, 2, 2] detailed listing: executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000bab000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, 0x0}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000240)={0x1, 0x0, [{0x490, 0x0, 0xffffffff}]}) executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) pipe2(0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) executing program 3: close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) executing program 3: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000010c0)=ANY=[@ANYBLOB="200000001600010a00000000000000000a", @ANYRES16=r0], 0x20}, 0x1, 0x0, 0x0, 0x200c0801}, 0x0) executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x4, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_BOOT_CPU_ID(r1, 0xae78, &(0x7f0000000000)=0x1) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xeeee8000, 0xeeee0000, 0xc, 0x1, 0x81, 0xc, 0x0, 0x7}, {0xf000, 0xdddd1000, 0xc, 0xfc, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x5, 0xfb}, {0x2, 0x8080000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, 0x4}, {0x80a0000, 0xffff1000, 0x3, 0x0, 0x0, 0x8, 0x0, 0x7}, {0x5000, 0x0, 0xf, 0x6, 0xfe, 0x10, 0x3, 0xc, 0x58, 0x9, 0x4}, {0x4000, 0x1000, 0xb, 0xfc, 0x0, 0xfd, 0xfc, 0x0, 0x0, 0x5, 0xc0}, {0x2fff, 0x100000, 0x10, 0x8, 0x7, 0xfb, 0x0, 0x7, 0x1a, 0x2, 0x0, 0x2}, {0x5000, 0x3000, 0xe, 0x2, 0x2, 0x54, 0x7, 0xfd, 0x0, 0x9, 0x7, 0x5}, {0x9000, 0x1}, {}, 0x9df9ffdf, 0x0, 0x0, 0x220, 0x8, 0x8000, 0x2000, [0xdd41, 0x0, 0x2]}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/address_bits', 0x800940, 0x41) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000001280)={0x0, 0xdddd0000, 0x2, 0x1c, 0x50}) executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r0, 0x107, 0x3c, 0x0, &(0x7f0000000100)) executing program 3: lseek(0xffffffffffffffff, 0xf800100000000000, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_clone3(&(0x7f0000000080)={0x180801600, &(0x7f0000000000), 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58) executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x7800, 0x8000, 0x1, 0x5, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x3, 0x0, 0x1, 0x4, 0x0, @local, @private=0x10000}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f3, 0x0) executing program 0: syslog(0x2, &(0x7f0000001640)=""/172, 0xac) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x9) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000100)={0x8000000, 0x10000}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r2, 0x4010ae68, &(0x7f0000000040)={0xdddd0000}) executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioprio_get$uid(0x3, 0x0) executing program 1: syz_create_resource$binfmt(0x0) r0 = syz_open_dev$loop(&(0x7f0000000240), 0x75f, 0xa8182) r1 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0xffffffffffffffff}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) vmsplice(r0, &(0x7f0000000380)=[{&(0x7f0000013580)='\r', 0x1}], 0x1, 0x0) write(0xffffffffffffffff, 0x0, 0x0) executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) sendmmsg$inet(r0, &(0x7f00000036c0)=[{{&(0x7f0000000200)={0x2, 0x4e25, @multicast1}, 0x10, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x4a080) executing program 0: r0 = userfaultfd(0x80001) r1 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x90000010}) executing program 1: r0 = socket(0x2, 0x3, 0xff) bind$inet(r0, &(0x7f0000000080)={0x2, 0x404, @empty}, 0x10) executing program 0: r0 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000780)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24ba0305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b730000eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4df0010000000000000fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3bd00cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-pipe2-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) pipe2(0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program crashed: WARNING: kobject bug in __scsi_remove_device single: successfully extracted reproducer found reproducer with 5 syscalls minimizing guilty program testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-pipe2-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) pipe2(0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) program did not crash testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-pipe2-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) pipe2(0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program crashed: WARNING: kobject bug in __scsi_remove_device testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write detailed listing: executing program 0: mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, 0x0, 0x0) program did not crash testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program did not crash simplifying guilty program options testing program (duration=2m30.805737439s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash validation run: crashed=false testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash validation run: crashed=false testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program did not crash validation run: crashed=false testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program crashed: WARNING: kobject bug in __scsi_remove_device validation run: crashed=true testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program crashed: WARNING: kobject bug in __scsi_remove_device validation run: crashed=true testing program (duration=2m30.805737439s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r0, &(0x7f0000001400)='- - -', 0x5) program crashed: WARNING: kobject bug in __scsi_remove_device validation run: crashed=true reproducing took 51m51.938756742s repro crashed as (corrupted=false): ------------[ cut here ]------------ kobject: '(null)' (ffff88811c3ce548): is not initialized, yet kobject_put() is being called. WARNING: CPU: 1 PID: 426 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 lib/kobject.c:734 Modules linked in: CPU: 1 UID: 0 PID: 426 Comm: syz.6.22 Not tainted syzkaller #0 1b627ac51616646c2b03e03cc27ccf1d06a70c9d Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:kobject_put+0x8e/0x2a0 lib/kobject.c:734 Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 44 e1 44 fc 48 8b 33 48 c7 c7 a0 07 9b 86 48 89 da e8 22 dd 68 fb <0f> 0b eb 0f e8 e9 04 ec fb e9 9c 01 00 00 e8 df 04 ec fb 4c 8d 7b RSP: 0018:ffffc9000106f1f8 EFLAGS: 00010246 RAX: 32f33bd0e6809800 RBX: ffff88811c3ce548 RCX: ffff888130d48000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffffc9000106f220 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0e9f34c R12: 00000000fffffff4 R13: ffff88811c3ce584 R14: 1ffff11023879cb0 R15: 0000000000000000 FS: 00007f3e38cd46c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5e59758060 CR3: 000000011aef4000 CR4: 00000000003526b0 Call Trace: put_device+0x23/0x40 drivers/base/core.c:3800 __scsi_remove_device+0xc4/0x3c0 drivers/scsi/scsi_sysfs.c:1501 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x13e/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f3e37d9e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3e38cd4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3e38025fa0 RCX: 00007f3e37d9e0d9 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f3e37e35024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3e38026038 R14: 00007f3e38025fa0 R15: 00007fffea30c428 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 426 at lib/refcount.c:28 refcount_warn_saturate+0x119/0x1c0 lib/refcount.c:28 Modules linked in: CPU: 1 UID: 0 PID: 426 Comm: syz.6.22 Tainted: G W syzkaller #0 1b627ac51616646c2b03e03cc27ccf1d06a70c9d Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:refcount_warn_saturate+0x119/0x1c0 lib/refcount.c:28 Code: 05 01 48 c7 c7 c0 f0 51 86 e8 23 44 55 fe 0f 0b eb da e8 ea 6b d8 fe c6 05 68 49 36 05 01 48 c7 c7 20 f1 51 86 e8 07 44 55 fe <0f> 0b eb be e8 ce 6b d8 fe c6 05 49 49 36 05 01 48 c7 c7 60 f0 51 RSP: 0018:ffffc9000106f1d8 EFLAGS: 00010246 RAX: 32f33bd0e6809800 RBX: 0000000000000003 RCX: ffff888130d48000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffffc9000106f1e8 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0e9f34c R12: 0000000000000000 R13: ffff88811c3ce584 R14: ffff88811c3ce580 R15: ffff88811c3ce580 FS: 00007f3e38cd46c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5e59758060 CR3: 000000011aef4000 CR4: 00000000003526b0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] kref_put include/linux/kref.h:64 [inline] kobject_put+0x25a/0x2a0 lib/kobject.c:737 put_device+0x23/0x40 drivers/base/core.c:3800 __scsi_remove_device+0xc4/0x3c0 drivers/scsi/scsi_sysfs.c:1501 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x13e/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f3e37d9e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3e38cd4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3e38025fa0 RCX: 00007f3e37d9e0d9 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f3e37e35024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3e38026038 R14: 00007f3e38025fa0 R15: 00007fffea30c428 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ kobject: '(null)' (ffff88811c3ce1d0): is not initialized, yet kobject_put() is being called. WARNING: CPU: 1 PID: 426 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 lib/kobject.c:734 Modules linked in: CPU: 1 UID: 0 PID: 426 Comm: syz.6.22 Tainted: G W syzkaller #0 1b627ac51616646c2b03e03cc27ccf1d06a70c9d Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:kobject_put+0x8e/0x2a0 lib/kobject.c:734 Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 44 e1 44 fc 48 8b 33 48 c7 c7 a0 07 9b 86 48 89 da e8 22 dd 68 fb <0f> 0b eb 0f e8 e9 04 ec fb e9 9c 01 00 00 e8 df 04 ec fb 4c 8d 7b RSP: 0018:ffffc9000106f1f8 EFLAGS: 00010246 RAX: 32f33bd0e6809800 RBX: ffff88811c3ce1d0 RCX: ffff888130d48000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffffc9000106f220 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0e9f34c R12: ffffffff86630e90 R13: ffff88811c3ce20c R14: 1ffff11023879c41 R15: 0000000000000000 FS: 00007f3e38cd46c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5e59758060 CR3: 000000011aef4000 CR4: 00000000003526b0 Call Trace: put_device+0x23/0x40 drivers/base/core.c:3800 __scsi_remove_device+0x32d/0x3c0 drivers/scsi/scsi_sysfs.c:1527 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x13e/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f3e37d9e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3e38cd4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3e38025fa0 RCX: 00007f3e37d9e0d9 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f3e37e35024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3e38026038 R14: 00007f3e38025fa0 R15: 00007fffea30c428 ---[ end trace 0000000000000000 ]--- scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured ------------[ cut here ]------------ kernel BUG at drivers/scsi/scsi_scan.c:594! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 426 Comm: syz.6.22 Tainted: G W syzkaller #0 1b627ac51616646c2b03e03cc27ccf1d06a70c9d Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:scsi_target_reap+0x172/0x180 drivers/scsi/scsi_scan.c:594 Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 18 9b 81 fe e9 39 ff ff ff e8 fe be 28 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 2b f6 2b 24 90 90 90 RSP: 0018:ffffc9000106f7a8 EFLAGS: 00010293 RAX: ffffffff835eb2c2 RBX: ffff88811e138000 RCX: ffff888130d48000 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005 RBP: ffffc9000106f7d0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff5200020dee0 R12: ffff88811e138000 R13: ffff88811e1383c4 R14: 1ffff11023c27078 R15: 0000000000000005 FS: 00007f3e38cd46c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff4cfb4fe4 CR3: 000000011aef4000 CR4: 00000000003526b0 Call Trace: __scsi_scan_target+0x62c/0xc20 drivers/scsi/scsi_scan.c:1771 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x13e/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f3e37d9e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3e38cd4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3e38025fa0 RCX: 00007f3e37d9e0d9 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f3e37e35024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3e38026038 R14: 00007f3e38025fa0 R15: 00007fffea30c428 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:scsi_target_reap+0x172/0x180 drivers/scsi/scsi_scan.c:594 Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 18 9b 81 fe e9 39 ff ff ff e8 fe be 28 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 2b f6 2b 24 90 90 90 RSP: 0018:ffffc9000106f7a8 EFLAGS: 00010293 RAX: ffffffff835eb2c2 RBX: ffff88811e138000 RCX: ffff888130d48000 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005 RBP: ffffc9000106f7d0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff5200020dee0 R12: ffff88811e138000 R13: ffff88811e1383c4 R14: 1ffff11023c27078 R15: 0000000000000005 FS: 00007f3e38cd46c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5e58870000 CR3: 000000011aef4000 CR4: 00000000003526b0 final repro crashed as (corrupted=false): ------------[ cut here ]------------ kobject: '(null)' (ffff88811c3ce548): is not initialized, yet kobject_put() is being called. WARNING: CPU: 1 PID: 426 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 lib/kobject.c:734 Modules linked in: CPU: 1 UID: 0 PID: 426 Comm: syz.6.22 Not tainted syzkaller #0 1b627ac51616646c2b03e03cc27ccf1d06a70c9d Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:kobject_put+0x8e/0x2a0 lib/kobject.c:734 Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 44 e1 44 fc 48 8b 33 48 c7 c7 a0 07 9b 86 48 89 da e8 22 dd 68 fb <0f> 0b eb 0f e8 e9 04 ec fb e9 9c 01 00 00 e8 df 04 ec fb 4c 8d 7b RSP: 0018:ffffc9000106f1f8 EFLAGS: 00010246 RAX: 32f33bd0e6809800 RBX: ffff88811c3ce548 RCX: ffff888130d48000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffffc9000106f220 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0e9f34c R12: 00000000fffffff4 R13: ffff88811c3ce584 R14: 1ffff11023879cb0 R15: 0000000000000000 FS: 00007f3e38cd46c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5e59758060 CR3: 000000011aef4000 CR4: 00000000003526b0 Call Trace: put_device+0x23/0x40 drivers/base/core.c:3800 __scsi_remove_device+0xc4/0x3c0 drivers/scsi/scsi_sysfs.c:1501 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x13e/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f3e37d9e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3e38cd4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3e38025fa0 RCX: 00007f3e37d9e0d9 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f3e37e35024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3e38026038 R14: 00007f3e38025fa0 R15: 00007fffea30c428 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 426 at lib/refcount.c:28 refcount_warn_saturate+0x119/0x1c0 lib/refcount.c:28 Modules linked in: CPU: 1 UID: 0 PID: 426 Comm: syz.6.22 Tainted: G W syzkaller #0 1b627ac51616646c2b03e03cc27ccf1d06a70c9d Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:refcount_warn_saturate+0x119/0x1c0 lib/refcount.c:28 Code: 05 01 48 c7 c7 c0 f0 51 86 e8 23 44 55 fe 0f 0b eb da e8 ea 6b d8 fe c6 05 68 49 36 05 01 48 c7 c7 20 f1 51 86 e8 07 44 55 fe <0f> 0b eb be e8 ce 6b d8 fe c6 05 49 49 36 05 01 48 c7 c7 60 f0 51 RSP: 0018:ffffc9000106f1d8 EFLAGS: 00010246 RAX: 32f33bd0e6809800 RBX: 0000000000000003 RCX: ffff888130d48000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffffc9000106f1e8 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0e9f34c R12: 0000000000000000 R13: ffff88811c3ce584 R14: ffff88811c3ce580 R15: ffff88811c3ce580 FS: 00007f3e38cd46c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5e59758060 CR3: 000000011aef4000 CR4: 00000000003526b0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] kref_put include/linux/kref.h:64 [inline] kobject_put+0x25a/0x2a0 lib/kobject.c:737 put_device+0x23/0x40 drivers/base/core.c:3800 __scsi_remove_device+0xc4/0x3c0 drivers/scsi/scsi_sysfs.c:1501 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x13e/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f3e37d9e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3e38cd4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3e38025fa0 RCX: 00007f3e37d9e0d9 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f3e37e35024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3e38026038 R14: 00007f3e38025fa0 R15: 00007fffea30c428 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ kobject: '(null)' (ffff88811c3ce1d0): is not initialized, yet kobject_put() is being called. WARNING: CPU: 1 PID: 426 at lib/kobject.c:736 kobject_put+0x8e/0x2a0 lib/kobject.c:734 Modules linked in: CPU: 1 UID: 0 PID: 426 Comm: syz.6.22 Tainted: G W syzkaller #0 1b627ac51616646c2b03e03cc27ccf1d06a70c9d Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:kobject_put+0x8e/0x2a0 lib/kobject.c:734 Code: 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 44 e1 44 fc 48 8b 33 48 c7 c7 a0 07 9b 86 48 89 da e8 22 dd 68 fb <0f> 0b eb 0f e8 e9 04 ec fb e9 9c 01 00 00 e8 df 04 ec fb 4c 8d 7b RSP: 0018:ffffc9000106f1f8 EFLAGS: 00010246 RAX: 32f33bd0e6809800 RBX: ffff88811c3ce1d0 RCX: ffff888130d48000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 RBP: ffffc9000106f220 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0e9f34c R12: ffffffff86630e90 R13: ffff88811c3ce20c R14: 1ffff11023879c41 R15: 0000000000000000 FS: 00007f3e38cd46c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5e59758060 CR3: 000000011aef4000 CR4: 00000000003526b0 Call Trace: put_device+0x23/0x40 drivers/base/core.c:3800 __scsi_remove_device+0x32d/0x3c0 drivers/scsi/scsi_sysfs.c:1527 scsi_alloc_sdev+0x970/0xcc0 drivers/scsi/scsi_scan.c:379 scsi_probe_and_add_lun+0x1e9/0x3e60 drivers/scsi/scsi_scan.c:1207 __scsi_scan_target+0x1f1/0xc20 drivers/scsi/scsi_scan.c:1754 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x13e/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f3e37d9e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3e38cd4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3e38025fa0 RCX: 00007f3e37d9e0d9 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f3e37e35024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3e38026038 R14: 00007f3e38025fa0 R15: 00007fffea30c428 ---[ end trace 0000000000000000 ]--- scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured ------------[ cut here ]------------ kernel BUG at drivers/scsi/scsi_scan.c:594! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 426 Comm: syz.6.22 Tainted: G W syzkaller #0 1b627ac51616646c2b03e03cc27ccf1d06a70c9d Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:scsi_target_reap+0x172/0x180 drivers/scsi/scsi_scan.c:594 Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 18 9b 81 fe e9 39 ff ff ff e8 fe be 28 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 2b f6 2b 24 90 90 90 RSP: 0018:ffffc9000106f7a8 EFLAGS: 00010293 RAX: ffffffff835eb2c2 RBX: ffff88811e138000 RCX: ffff888130d48000 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005 RBP: ffffc9000106f7d0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff5200020dee0 R12: ffff88811e138000 R13: ffff88811e1383c4 R14: 1ffff11023c27078 R15: 0000000000000005 FS: 00007f3e38cd46c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff4cfb4fe4 CR3: 000000011aef4000 CR4: 00000000003526b0 Call Trace: __scsi_scan_target+0x62c/0xc20 drivers/scsi/scsi_scan.c:1771 scsi_scan_channel drivers/scsi/scsi_scan.c:1842 [inline] scsi_scan_host_selected+0x352/0x610 drivers/scsi/scsi_scan.c:1871 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline] store_scan+0x4ba/0x550 drivers/scsi/scsi_sysfs.c:191 dev_attr_store+0x76/0xa0 drivers/base/core.c:2440 sysfs_kf_write+0x13e/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x75f/0xfd0 fs/read_write.c:684 ksys_write+0x145/0x260 fs/read_write.c:737 __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x7f/0x90 fs/read_write.c:746 x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f3e37d9e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3e38cd4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3e38025fa0 RCX: 00007f3e37d9e0d9 RDX: 0000000000000005 RSI: 0000200000001400 RDI: 0000000000000003 RBP: 00007f3e37e35024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3e38026038 R14: 00007f3e38025fa0 R15: 00007fffea30c428 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:scsi_target_reap+0x172/0x180 drivers/scsi/scsi_scan.c:594 Code: 81 fe e9 ef fe ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 46 ff ff ff 4c 89 ef e8 18 9b 81 fe e9 39 ff ff ff e8 fe be 28 fe <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 2b f6 2b 24 90 90 90 RSP: 0018:ffffc9000106f7a8 EFLAGS: 00010293 RAX: ffffffff835eb2c2 RBX: ffff88811e138000 RCX: ffff888130d48000 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005 RBP: ffffc9000106f7d0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff5200020dee0 R12: ffff88811e138000 R13: ffff88811e1383c4 R14: 1ffff11023c27078 R15: 0000000000000005 FS: 00007f3e38cd46c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5e58870000 CR3: 000000011aef4000 CR4: 00000000003526b0