Extracting prog: 17m22.203660879s
Minimizing prog: 28m11.926793568s
Simplifying prog options: 0s
Extracting C: 33.72738582s
Simplifying C: 12m57.099015764s


extracting reproducer from 84 programs
testing a last program of every proc
single: executing 34 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-openat$uinput-ioctl$UI_BEGIN_FF_ERASE-socket$inet6_icmp_raw-gettid-syz_open_dev$loop-fallocate-syz_clone-sendmsg-inotify_init-sendmsg$nl_route_sched-socket$packet-setsockopt$packet_fanout-close_range-mount$9p_virtio-timer_create-timer_settime-mmap$IORING_OFF_SQ_RING-setsockopt$inet6_IPV6_ADDRFORM-ioctl$UI_BEGIN_FF_UPLOAD-mkdirat-mount-openat-socket$nl_netfilter-write$tcp_mem-read-openat-tee-socket$xdp-mount$9p_fd
detailed listing:
executing program 0:
syz_emit_ethernet(0x11f, &(0x7f00000000c0)={@broadcast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0xe9, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, [{0x1c, 0x9, "bd3e6d4706598080a8030037ffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34116d42ca0a5c15b37adac15084dbaf736b41e5af0302"}, {0x1, 0x1, "000000050000000026000400"}, {0x3, 0x10, "77f9290b6e87290b6e871e02f278e94724e20c43c95f9b49204a64d614d4cc9d0d46d954fda9a75d076993e3c57aa99b2454a86662e37b42678a74974ddd50b21e499efae61e3a816a367d019bc7f892d8975f1fc8a3e27139041cd21d2d12f30ee6f029d8d73f80f9b19d138598345b9c0feda226b333c55c668fb17b5b39"}]}}}}}}, 0x0)
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0)
ioctl$UI_BEGIN_FF_ERASE(r0, 0xc00c55ca, 0x0)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r2 = gettid()
r3 = syz_open_dev$loop(&(0x7f0000000280), 0x10, 0x80082)
fallocate(r3, 0x11, 0x0, 0x5345)
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
sendmsg(r1, &(0x7f0000000c40)={&(0x7f0000000180)=@isdn={0x22, 0x6, 0x6, 0xa, 0xcf}, 0x80, &(0x7f0000000700)=[{&(0x7f0000000280)="50610d72350fc82e633e2a34a83bebf000b37fb324b322695c87289f9c726fe522d6a107ce2f034488393abd68cdda15f9de2f37cdc1cccd2b3551d4d7ed19280185c129230dbaf53fcdcb66efbc77209e3525c428a1726366587d98e28dd9ef958d1ddf838c9f49d8a37783e2d4fa77b82800c1926de2a44839c7e18fbae610d86dbf0a17e0b1524e6ebee25fdabe514ff59d8cfe3cc3b9d644cfb110a9a6c231fb9509ff5c88ca7dd9f6c68f503a31f3aa7f5233bc997e987f1ce6f040cc3f21b0cdb21bea2b516f2b56b0a3b6a8d05ce78b156707917888f6536eb0d2850299f8abc8c90d81722625c943a61075", 0xef}, {&(0x7f0000000380)="a326f89be61403da68e678df0fa0fb91fb4b1b3adc2c4794ece871a5587110a3d23cbc13f1675ff136a59e766729564f22eeb26a1366bef1fb775aec8f40864ee3b1b286f4f0b39f1a073d33fbe7043e073bb4b23116b5c256e4f41f97b1310035bcc68f7a49b29dd3f1df6f1e52c1f43dc18840f5414e21e50c70c7b67dcb96ca8c57d71c5a23920b430859d6ac9d3a9586b9afcafe5c6b7483a08d534476e3f0bff2fa266a4f556c3fb72b4d615a717dad3927a6c1062c45e711cf131e2f356628ed9e868a7219fd30deb03f81f67af26797e670035542c2657b1079091e", 0xdf}, {&(0x7f0000000480)="74d60a48cdd555e44be58b98d850522862a667f1e02b14d6fc2686a6d66b39d3e3e84f61652d1b2386c5ad3b26de6bdd8b58f7b39fc612cf802a57e7fabe170fb4", 0x41}, {&(0x7f0000000500)="9b1631ecb48b740082bc8169c23e4401fa7a36efa33f8c24f45d7a247709", 0x1e}, {&(0x7f0000000540)="7222df9264b94838d9690d858c2d419a272d1a4aa84580e21c09f8a73101931414fa7cfaac0fe8123f736acc8ebede88dcd27b2cca601e0640a76274abaa52c877c0827edfacd8546c9d99bb5b1ca5935d507311e36ed08acc726347867df634ad3f4b70bab655ca370c13ccacf066381abc5bfb2e4ceb968035a54fac8b0d1983c42775ebbfa9ac4c15e9b48de75f2ee99ddf04d827f8a9f63c85d5798ab93c1c23512062215176de17c722252959b78bb8b4bf0936db8d76dc5064265f3e35b0dc2580a3e9b8a26c7439306bb2cd3b5bf3aa74c0f7a1e6a6", 0xd9}, {&(0x7f0000000640)="25d78f32bbac030f4d6a7897c87032fae0604b49f1c7d5a35d5cd0e80dd2e97054b6cdf84ee9e6c22841261c9f254332f87cca45a2b5c8ef089f6a27dcff61a96ba1301c030ea5fa5a484011dd682532835d492700fd6c22531e1f8be57b2f7ebef61ecfbe8270f194f4b76e282e5acd88116844c4ef1b6f0d1f3327371d4f1faf4bcf44ae648ea70ccb720f92082615789c32b88a92336b086b", 0x9a}], 0x6, &(0x7f0000000780)}, 0x2000011)
r4 = inotify_init()
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@getqdisc={0x24, 0x26, 0x1, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xd, 0xfff1}, {0xa, 0xffe3}, {0x6, 0xfff2}}}, 0x24}}, 0x0)
r5 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000), 0x8)
close_range(r4, 0xffffffffffffffff, 0x0)
mount$9p_virtio(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', &(0x7f0000000200), 0x80000, &(0x7f0000000900)={'trans=virtio,', {[{@version_u}, {@cache_fscache}], [{@dont_appraise}, {@fscontext={'fscontext', 0x3d, 'unconfined_u'}}, {@subj_type={'subj_type', 0x3d, ']+$$])(('}}, {@context={'context', 0x3d, 'root'}}, {@seclabel}, {@uid_eq}, {@smackfshat={'smackfshat', 0x3d, '\"\'\x0fB&\x970epw\x00\x00'}}, {@defcontext={'defcontext', 0x3d, 'root'}}, {@appraise}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x0, 0x33, 0x31, 0x39, 0x31, 0x38, 0x38, 0x64], 0x2d, [0x36, 0x34, 0x39, 0x35], 0x2d, [0x65, 0x36, 0x33, 0x37], 0x2d, [0x65, 0x61, 0x66, 0x30], 0x2d, [0x36, 0x36, 0x65, 0x30, 0x33, 0x33, 0x31, 0x61]}}}]}})
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x800000000004, @tid=r2}, 0x0)
timer_settime(0x0, 0x0, 0x0, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
setsockopt$inet6_IPV6_ADDRFORM(r1, 0x3a, 0x1, 0x0, 0x0)
ioctl$UI_BEGIN_FF_UPLOAD(r0, 0xc06855c8, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers_autoprobe\x00', 0x481, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
write$tcp_mem(r6, &(0x7f0000000780)={0x3000000000, 0x20, 0x8001, 0x20, 0x1}, 0x48)
read(r0, &(0x7f0000000000)=""/43, 0x2b)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0)
tee(r1, r0, 0x0, 0xf)
r8 = socket$xdp(0x2c, 0x3, 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140), 0x8440, &(0x7f00000192c0)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r8}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-syz_usb_connect$midi-openat-truncate-mmap-bpf$PROG_LOAD-getsockopt$inet6_int-openat-fallocate
detailed listing:
executing program 0:
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x200000, &(0x7f0000000180)={[{@noblock_validity}, {}, {@sysvgroups}, {@resuid}, {@init_itable}, {@nouser_xattr}, {@grpid}, {@noauto_da_alloc}, {@nomblk_io_submit}]}, 0x3, 0x56a, &(0x7f00000015c0)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwFy9SBBEL4h/g3WPxH/CvKGihSAl68BKZzWy7TbL5uXW3zucD0743M5s3b998335nZ5cNoLBGsn9KEa9GxDdJxOG2bYORbxxZ2W/p8Y3JbEliefmzP5NI8nWt/ZP8/4N55ZWI+PWriJOlte3WFxZnKtVqOpfXRxuzV0frC4unLs9WptPp9Mr4xMSZdybG33/v3a719c0Lf3//6f2Pznx9fOm7nx8euZvEuTiUb2vvxy7caq+MxEj+nAzFuVU7jnWhsX6S9PoA2JGBPM6HIpsDDsdAHvXA/9/NiFgGCioR/1BQrTygdW3fpevgF8ajD1cugNb2f3DlvZHY17w2OrCUPHNllF3vDneh/ayNX/64dzdbYpP3IW52oT2Allu3I+L04ODa+S/J57+dO91883hjq9so2usP9NL9LP95a738p/Qk/4l18p+D68TuTmwe/6WHXWimoyz/+2Dd/PfJ1DU8kNdeauZ8Q8mly9X0dES8HBEnYmhvVt/ofs6ZpQfLnba153/ZkrXfygXz43g4uPfZx0xVGpXd9Lndo9sRrz3Nf5NYM//va+a6q8c/ez4ubLGNY+m91ztt27z/7bqfAS//FPHGuuP/9I5WsvH9ydHm+TDaOivW+uvOsd86tb+9/ndfNv4HNu7/cNJ+v7a+/TZ+3PdP2mnbTs//PcnnzfKefN31SqMxNxaxJ/lk7frxp49t1Vv7Z/0/cXzj+W+9839/RHyxxf7fOXqn4679MP5T2xr/7RcefPzlD53a39r4v90sncjXbGX+2+oB7ua5AwAAAAAAgH5TiohDkZTKT8qlUrm88vmOo3GgVK3VGycv1eavTEXzu7LDMVRq3ek+3PZ5iLH887Ct+viq+kREHImIbwf2N+vlyVp1qtedBwAAAAAAAAAAAAAAAAAAgD5xsMP3/zO/D/T66IDnzk9+Q3FtGv/d+KUnoC95/YfiEv9QXOIfikv8Q3GJfygu8Q/FJf6huMQ/AAAAAAAAAAAAAAAAAAAAAAAAAAAAdNWF8+ezZXnp8Y3JrD51bWF+pnbt1FRanynPzk+WJ2tzV8vTtdp0NS1P1mY3+3vVWu3q2HjMXx9tpPXGaH1h8eJsbf5K4+Ll2cp0ejEd+k96BQAAAAAAAAAAAAAAAAAAAC+W+sLiTKVaTecUOhbORl8cxo4LyWajfDY/GXbUxGDvO6jwHAo9npgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoM2/AQAA///fKTPH")
syz_usb_connect$midi(0x0, 0x54, &(0x7f0000000340)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x499, 0x101a, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x42, 0x1, 0x1, 0x4, 0x80, 0x26, "", {{{0x9, 0x4, 0x0, 0x0, 0x3, 0x1, 0x3, 0x30, 0x5, [@midi_out_jack={0x7, 0x24, 0x3, 0x3, 0x7f, 0x0, [], 0x2}], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0xb7, 0x7, 0x4, {0x4}}}, {{0x9, 0x5, 0x6, 0x10, 0x20, 0x8, 0x4, 0x10, {0x6, 0x25, 0x1, 0x2, "87ba"}}}, {{0x9, 0x5, 0x5, 0x3, 0x8, 0x16, 0x3, 0x40, {0x4}}}]}}}}}]}}, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0})
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0)
truncate(&(0x7f0000000900)='./file1\x00', 0x3000000)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x13, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x73, 0x11, 0x39}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x76}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70)
getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x43, 0x0, &(0x7f00000029c0))
r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x48042, 0x18c)
fallocate(r1, 0x10, 0x6, 0x10001)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$cdc_ncm-syz_usb_connect$cdc_ecm-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-pipe2-fcntl$setpipe-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_LINK_SET-prctl$PR_SET_TAGGED_ADDR_CTRL-socket$inet6-ioctl$sock_SIOCETHTOOL-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect$cdc_ncm(0x0, 0x7a, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0)
syz_usb_connect$cdc_ecm(0x1, 0xeb, &(0x7f0000000780)=ANY=[@ANYBLOB="12011001020000402505a1970990e87127f15b33c54faa2bd3d904a44000010203010902d900010110500609040010020206000309240600009af41ef905240004000d240f0104000000460e02000112241882000002001c0d050000000209070006241a0700110524150900052401020308241c000007e50067241308c6dbf749805b70a04b3dcde51e6c63949fbd68a3f8ce4bb2826e70bd7afa3da768fb17e3d332f393fdc887944e6e60b3413244d9a778184289e38432d850a0d2d9b9b9d652e3eb84d23d0d5b3385f3bfb24c3a0801336cb8398ef064d757b5c649b8c109058103ff0357f70609058202409dadb89bf4abd83db645f945d60005070e0905030220000d070b"], &(0x7f0000000500)={0xa, &(0x7f0000000300)={0xa, 0x6, 0xd261cb4d973c681c, 0x1, 0x7, 0x4, 0x8, 0xf8}, 0x2b, &(0x7f0000000340)={0x5, 0xf, 0x2b, 0x3, [@ssp_cap={0x18, 0x10, 0xa, 0x9, 0x3, 0x0, 0xf00f, 0x4, [0xffffcf, 0xff0030, 0xff00cf]}, @ext_cap={0x7, 0x10, 0x2, 0xa, 0x3, 0xf, 0xcb}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x0, 0x3, 0x7}]}, 0x3, [{0x41, &(0x7f0000000380)=@string={0x41, 0x3, "0cb97a2a7737a787ada373d2ab6d0d2f78a3c1f21aabda20468ab241ff8cb5e92303eabe7212bdedbf5103c986ed758d3aa13b0ce34fbb7949414d1467b454"}}, {0x89, &(0x7f0000000400)=@string={0x89, 0x3, "1cde88fa5b8160d2e415a090cc2c140b5c904981782f2e16c54185ee294514792d9f2184243d85fabdc6ba9731d68eab03aecd44122e9e93c62168cf9f33922ce9b067c5660ae5b20e462f27bff656f73836b1d1160dc8425891238577d3a3319a4e5cc361de5b2445543d7664e7adb5c1f8df43abdf09d928e2d866da07e10397801d8ea20f05"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x438}}]})
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]})
pipe2(&(0x7f00000002c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x0)
fcntl$setpipe(r2, 0x407, 0x100000)
r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r1)
sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r3, 0x300, 0x70bd27, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x48000}, 0x4100)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r4 = socket$inet6(0xa, 0x3, 0x8)
ioctl$sock_SIOCETHTOOL(r4, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0x7, 0x0, 0x20000001, 0x0, 0x1, 0x900, 0x0, 0xfffffffc}})
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000700)={0x44, 0x0, 0x0, 0x0, &(0x7f00000005c0)={0x20, 0x80, 0x1c, {0x8001, 0x4, 0x7fff, 0x9, 0x8001, 0x6, 0x40, 0x80, 0x0, 0xeba9, 0x200, 0x80}}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$selinux_checkreqprot-write$hidraw-ioctl$SIOCSIFHWADDR-syz_mount_image$ext4-setrlimit-openat-pwrite64-socket$packet-setsockopt$packet_fanout-syz_open_dev$rtc-ioctl$XFS_IOC_GET_RESBLKS-setsockopt$packet_int-socket$nl_generic-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_BEARER_ENABLE-socketpair$tipc-sendmsg$tipc-socket$nl_route-socket$inet6-ioctl$sock_SIOCGIFINDEX-setsockopt$inet6_mreq-sendmsg$nl_route_sched-setsockopt$inet6_mreq-recvmmsg-capset-bpf$MAP_CREATE_TAIL_CALL-keyctl$instantiate-mprotect-futex-bpf$PROG_LOAD
detailed listing:
executing program 0:
r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280), 0x802, 0x0)
write$hidraw(r0, &(0x7f0000000000)="9e5ee1", 0x3)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0)
syz_mount_image$ext4(&(0x7f0000000080)='ext2\x00', &(0x7f00000000c0)='./file1\x00', 0x88, &(0x7f0000000340)={[{@dioread_lock}, {@nombcache}, {@max_batch_time={'max_batch_time', 0x3d, 0x6}}, {@jqfmt_vfsold}, {@noinit_itable}, {@auto_da_alloc}]}, 0x3, 0x438, &(0x7f0000000d80)="$eJzs289rHFUcAPDv7GZT01+Jpf5oWjVaxeCPpElr7cGLouBBQdBDPcYkLbHbRpoItgSNIvUoBe/iUfAv8KQXUU8Fr3oXoUgurZ5WZncm2d1sfnaTrd3PByb5vpm3vPfNzNt9My8bQNcaSn8kEfsj4veI6K8VGysM1X7dXlqY/GdpYTKJSuXtv5NqvVtLC5N51fx1+/JCT0Th8ySOtmh37srVCxPl8vTlrDw6f/GD0bkrV5+fuThxfvr89KXxM2dOnRx78fT4C23JM83r1uDHs8eOvP7u9Tcnz15/75fvkjz/pjzaZGi9g09VKm1urrMO1MVJTwc7wpYUa8M0StXx3x/FWDl5/fHaZx3tHLCjKpVK5cG1Dy9WgHtYEp3uAdAZ+Qd9ev+bb7s09bgr3Hy5dgOU5n0722pHeqKQ1Sk13d+201BEnF389+t0i515DgEA0OCHdP7zXKv5XyHqnwsdzNZQBiLi/og4FBGnI+JwRDwQUa37UEQ8vMX2mxdJVs9/Dm4rr81K538vZWtbjfO/fPYXA8WsdKCafyk5N1OePpH1bDhKe9Ly2Dpt/Pjqb1+2PJA1kc//0i1tP58LZpX+6tnT+LKpifmJO8m53s1PIwZ7WuWfLK8EJBFxJCIGt9nGzDPfHlvr2NCG+a+jDetMlW8inq6d/8Voyj+XrL8+OXpflKdPjOZXxWq/3rj21lrt31H+bZCe/70tr//l/AeS+vXaua23ce2PL9a8p9k4/9bXf2/yTsO+jybm5y+PRfQmb9Q6Xb9/vKne+Er9NP/h463H/6FY+UscjYj0In4kIh6NiMeyvj8eEU9ExPHVqd3ozYKfX3ny/WpQ2k7+OyvNf2pL538l6I3mPa2D4oWfvm9odGAr+afn/1Q1Gs72bOb9bzP92t7VDAAAAP8/hYjYH0lhZDkuFEZGav/Dfzj2Fsqzc/PPnpv98NJU7TsCA1Eq5E+6+uueh45lt/V5ebypfDJ7bvxVsa9aHpmcLU91OnnocvvWGP+pP4ud7h2w43xfC7qX8Q/dy/iH7mX8Q/dqMf77OtEPYPe1+vz/pAP9AHZf0/i37AddxP0/dC/jH7qX8Q9daa4vNv6SvECwKojCXdENwQ4FnX5nAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaI//AgAA//9Lr+a0")
setrlimit(0x1, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff})
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x0)
pwrite64(r1, &(0x7f0000000300)="640e30f924", 0x5, 0x404043000)
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000051c0)={0x1, 0x1000}, 0x4)
r3 = syz_open_dev$rtc(&(0x7f00000003c0), 0x7, 0x4040)
ioctl$XFS_IOC_GET_RESBLKS(r3, 0x80105873, &(0x7f0000000400))
setsockopt$packet_int(r0, 0x107, 0x13, &(0x7f0000000440)=0x9, 0x4)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff)
sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000200)=ANY=[@ANYBLOB="18010000", @ANYRES16=r5, @ANYBLOB="010000000000fcdbdf2503000000040101800c000280080001000c000000080003000100010044000400200001000a004e200000010100000000000000000000ffffac1414bb03000000200002000a004e21fffffffffe8000000000000000000000000000340200000008000300010000002c0004001400010002004e21ac1414390000000000000000140002000200552164010102000000000000000054000280080001001f00000008000200ff0f0000080004000400000008000300020000000800010016000000080001001b000000080002000700000008000400ff000000080001000700000008000200c60a000008000300560f00000e0001"], 0x118}}, 0x20000050)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
sendmsg$tipc(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0)
r7 = socket$nl_route(0x10, 0x3, 0x0)
r8 = socket$inet6(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'veth1_virt_wifi\x00', <r9=>0x0})
setsockopt$inet6_mreq(r8, 0x29, 0x1b, &(0x7f0000000000)={@remote, r9}, 0x14)
sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=@newtfilter={0x24, 0x11, 0xd27, 0x2000, 0x0, {0x0, 0x0, 0x74, r9, {0x0, 0xfff2}, {0xafabc05531515610, 0xfff3}, {0x8, 0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x1c005}, 0x24048004)
setsockopt$inet6_mreq(r8, 0x29, 0x1c, &(0x7f0000000040)={@remote, r9}, 0x14)
recvmmsg(r2, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000900)=""/19, 0x13}], 0x1}, 0xf1a2}, {{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f0000001080)=""/52, 0x34}, {0x0}, {0x0}], 0x3}, 0x40}, {{0x0, 0x0, 0x0}, 0x200}], 0x3, 0x0, 0x0)
capset(&(0x7f0000000040)={0x20071026}, &(0x7f00000002c0)={0x6, 0x6, 0x1000002, 0x87, 0xffffffff, 0x3fe})
r10 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='u'], 0x1d, 0xfffffffffffffffd)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
futex(&(0x7f000000cffc), 0x3, 0x801, 0x0, &(0x7f0000000040), 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000ed00181200", @ANYRES32=r10, @ANYBLOB="0000000000000000b703000000200000850000000c000000b709000000000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000760000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-syz_open_procfs-preadv-openat-openat-close-close-openat$fuse-mount$fuse-read$FUSE-read$FUSE-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-sendmmsg$unix-recvmmsg-openat$snapshot-openat$snapshot-ioctl$SNAPSHOT_AVAIL_SWAP_SIZE-socket$packet-socket$packet-ioctl$sock_SIOCGIFINDEX-bind$packet-openat-mmap$IORING_OFF_CQ_RING-syz_genetlink_get_family_id$batadv-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-pipe2-pipe2-ioctl$int_in-mount$9p_fd-mount$9p_fd
detailed listing:
executing program 0:
syz_open_procfs(0x0, &(0x7f0000000640)='timerslack_ns\x00') (async)
r0 = syz_open_procfs(0x0, &(0x7f0000000640)='timerslack_ns\x00')
preadv(r0, &(0x7f0000001ac0)=[{&(0x7f0000000940)=""/4096, 0x1000}], 0x1, 0x8, 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) (async)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1)
close(r1) (async)
close(r1)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000000), 0x1000000, &(0x7f0000000100)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}})
read$FUSE(r2, &(0x7f00000020c0)={0x2020}, 0x2020) (async)
read$FUSE(r2, &(0x7f00000020c0)={0x2020}, 0x2020)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r3 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r3, 0x1, &(0x7f0000000240)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) (async)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x4000087, 0x2, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100), 0x103000, 0x0) (async)
r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100), 0x103000, 0x0)
ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r6, 0x80083313, 0x0)
socket$packet(0x11, 0x2, 0x300) (async)
socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
bind$packet(0xffffffffffffffff, 0x0, 0x0)
r7 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0)
mmap$IORING_OFF_CQ_RING(0x7fffffffc000, 0x2dc1, 0x300000f, 0x12, r7, 0x8000000)
syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_SQ_RING(0x7ffff7ffe000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) (async)
mmap$IORING_OFF_SQ_RING(0x7ffff7ffe000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000280), 0x0) (async)
pipe2(&(0x7f0000000280)={<r8=>0xffffffffffffffff}, 0x0)
ioctl$int_in(r8, 0x5452, &(0x7f0000000080)=0x8)
mount$9p_fd(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x84, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@loose}, {@access_any}, {@cache_mmap}]}}) (async)
mount$9p_fd(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x84, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@loose}, {@access_any}, {@cache_mmap}]}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_mount_image$fuse-symlinkat-syz_mount_image$ext4-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10, 0x0)
syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x400a8, &(0x7f0000000380)=ANY=[], 0x5, 0x0, 0x0)
symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000280)={[{@noload}, {@init_itable_val={'init_itable', 0x3d, 0xff}}, {@resgid}]}, 0x0, 0x48f, &(0x7f00000006c0)="$eJzs281rXOUaAPDnnHy0vf1Ibm/vvbYWjBYhKCZNWrULN4qCSEVBFxVXMZmW0GkjSRRbik1F6kaQgq7Fpehf4E4UUVeCW924kkLRbtq6ipwz5+RjmkmbZjKnNr8fTOZ957wz53nO17znfScBbFoD2Z8kYkdE/BIRfY3q8gYDjafrV8+N37h6bjyJ+flX/kjydteunhsvm5bv215UBtOI9P2kWMlyM2fOnhyr12vTRX149tSbwzNnzj729qmxE7UTtdOjR44cPjTy5BOjj7clzyyva/vendq/9/nXLr04fuzSGz98mcW7o1i+NI92GcgS/3M+17zs4XavrGI7l5ST7goDYU26IiLbXT35+d8XXbG48/riufcqDQ7YUNl305bWi+fmgXtYElVHAFSj/KLP7n/LR4e6HneFK083boCyvK8Xj8aS7kiLNj1N97ftNBARx+b++jR7xAaNQwAALPXh+CdHeyPm+2588ULW9+hbWJLG//Ln3/K/u4o5lP6I+HdE7I6I/0TEnoj4b0Te9v8Rcd8647m5/5NeXudHrirr/z1VzG0t7/+Vvb/o7ypqO/P8e5Ljk/XawWKbDEbPlqw+sso6vn72549aLVva/8se2frLvmARx+XupgG6ibHZsbxT2gZXLkTs614p/2RhJiCJiL0RsW9tH72rLEw+8vn+Vo1unf8q2jDPNP9Zlt5clv9cNOVfSpbOT07eND85vDXqtYPD5VFxc4Q//nTx5VbrX1f+bXCl1nhesv+bm/QnixujNj2z9nVc/PWDlvc0d3j8p73Jq/k8c2/x2jtjs7PTIxG9ydG8vuz10cX3lvWyfXb8Dx5Y+fzfXbwnS/7+iNi/eE2IB4rYH4yIhyLiwCr5f/9M62Vl/pFWtP8vREyseP1bOP6z/V/M1yfJ9MLE/e0Xuk5+91Wr9d/e/j+clwaLV/Lr3y2sFE52MjYHuJ5tBwAAAP8Uaf4b+CQdWiin6dBQ4zf8e+JfaX1qZvbR41NvnZ5o/Fa+P3rScqSrrxgPrU/WayPJXPGJjfHR0WKsuBwvPVSMG3/ctS2vD41P1Scqzh02u+0tzv/M711VRwdssG0rvjra2/FAgAo0z6Ony6vnXwoXA7hX+X9t2Lxucf6nnYoD6LzuVautvb4BsQCdtdIJf76pbi4A7k3u/2Hzcv7DJpV+U3UEQIV8/8OmdAf/zt+JwtbpmW/v7gg3sLDWlLujgxFGlIW08g2lsIGFii9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbfJ3AAAA//9Uv+Io")
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1}, 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x57, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x2000000, 0xe, 0x48, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_mount_image$fuse-symlinkat-syz_mount_image$ext4-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10, 0x0)
syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x400a8, &(0x7f0000000380)=ANY=[], 0x5, 0x0, 0x0)
symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000280)={[{@noload}, {@init_itable_val={'init_itable', 0x3d, 0xff}}, {@resgid}]}, 0x0, 0x48f, &(0x7f00000006c0)="$eJzs281rXOUaAPDnnHy0vf1Ibm/vvbYWjBYhKCZNWrULN4qCSEVBFxVXMZmW0GkjSRRbik1F6kaQgq7Fpehf4E4UUVeCW924kkLRbtq6ipwz5+RjmkmbZjKnNr8fTOZ957wz53nO17znfScBbFoD2Z8kYkdE/BIRfY3q8gYDjafrV8+N37h6bjyJ+flX/kjydteunhsvm5bv215UBtOI9P2kWMlyM2fOnhyr12vTRX149tSbwzNnzj729qmxE7UTtdOjR44cPjTy5BOjj7clzyyva/vendq/9/nXLr04fuzSGz98mcW7o1i+NI92GcgS/3M+17zs4XavrGI7l5ST7goDYU26IiLbXT35+d8XXbG48/riufcqDQ7YUNl305bWi+fmgXtYElVHAFSj/KLP7n/LR4e6HneFK083boCyvK8Xj8aS7kiLNj1N97ftNBARx+b++jR7xAaNQwAALPXh+CdHeyPm+2588ULW9+hbWJLG//Ln3/K/u4o5lP6I+HdE7I6I/0TEnoj4b0Te9v8Rcd8647m5/5NeXudHrirr/z1VzG0t7/+Vvb/o7ypqO/P8e5Ljk/XawWKbDEbPlqw+sso6vn72549aLVva/8se2frLvmARx+XupgG6ibHZsbxT2gZXLkTs614p/2RhJiCJiL0RsW9tH72rLEw+8vn+Vo1unf8q2jDPNP9Zlt5clv9cNOVfSpbOT07eND85vDXqtYPD5VFxc4Q//nTx5VbrX1f+bXCl1nhesv+bm/QnixujNj2z9nVc/PWDlvc0d3j8p73Jq/k8c2/x2jtjs7PTIxG9ydG8vuz10cX3lvWyfXb8Dx5Y+fzfXbwnS/7+iNi/eE2IB4rYH4yIhyLiwCr5f/9M62Vl/pFWtP8vREyseP1bOP6z/V/M1yfJ9MLE/e0Xuk5+91Wr9d/e/j+clwaLV/Lr3y2sFE52MjYHuJ5tBwAAAP8Uaf4b+CQdWiin6dBQ4zf8e+JfaX1qZvbR41NvnZ5o/Fa+P3rScqSrrxgPrU/WayPJXPGJjfHR0WKsuBwvPVSMG3/ctS2vD41P1Scqzh02u+0tzv/M711VRwdssG0rvjra2/FAgAo0z6Ony6vnXwoXA7hX+X9t2Lxucf6nnYoD6LzuVautvb4BsQCdtdIJf76pbi4A7k3u/2Hzcv7DJpV+U3UEQIV8/8OmdAf/zt+JwtbpmW/v7gg3sLDWlLujgxFGlIW08g2lsIGFii9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbfJ3AAAA//9Uv+Io")
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x80000000, 0x1}, 0x50)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x57, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x2000000, 0xe, 0x48, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet_udp-pipe-setsockopt$IPT_SO_SET_REPLACE-ioctl$XFS_IOC_GETBMAPX-socket$inet_icmp_raw-socket$vsock_stream-syz_mount_image$ext4-open-syz_mount_image$ext4-openat$dir-recvmsg-mknod-open-ioctl$EXT4_IOC_MOVE_EXT-open-mount_setattr-write$FUSE_CREATE_OPEN-mmap-fallocate-openat-write$P9_RUNLINKAT-connect$vsock_stream-connect$vsock_stream-socketpair$tipc-setsockopt$TIPC_MCAST_BROADCAST-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$PROG_LOAD-mprotect-sendto$inet
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
pipe(&(0x7f0000000140)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000006c0)=@raw={'raw\x00', 0x4001, 0x3, 0x3e8, 0x158, 0x0, 0x148, 0x158, 0x148, 0x350, 0x240, 0x240, 0x350, 0x240, 0x7fffffe, 0x0, {[{{@ip={@private=0xa010102, @local, 0x0, 0x0, 'ip6gretap0\x00', 'nicvf0\x00', {}, {}, 0x88, 0x3, 0x10}, 0x0, 0xf8, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'wg1\x00', {0x0, 0x0, 0x1ff, 0x100000, 0x0, 0xed, 0x10000007}}}, @common=@unspec=@connmark={{0x30}, {0xfffffff9, 0x8}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 0x85d, 0xb, [0x10, 0x31, 0x1e, 0x32, 0x2b, 0x25, 0x3f, 0x17, 0x19, 0x22, 0x2c, 0x3d, 0x7, 0x3f, 0x1e, 0x31], 0x0, 0x2, 0x2}}}, {{@ip={@rand_addr=0x64010101, @local, 0xff, 0x0, 'tunl0\x00', 'lo\x00', {0xff}, {}, 0x2e, 0x3, 0x4}, 0x0, 0x190, 0x1f8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x8, 0x9, 0x1, 0x1, 'syz1\x00', 0x2}}, @inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0xfff, 0x7e, 0x1c, 'netbios-ns\x00', 'syz0\x00', {0x3}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x448)
ioctl$XFS_IOC_GETBMAPX(r1, 0xc0205838, &(0x7f00000005c0)={0x0, 0x1f59c0000, 0x5, 0x3, 0x3, 0x3f, 0xf})
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = socket$vsock_stream(0x28, 0x1, 0x0)
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x10, &(0x7f00000000c0)={[{@errors_continue}]}, 0x5, 0x7ef, &(0x7f0000000ac0)="$eJzs3d9rXFkdAPDvnUx+mLYmgmDrU0DQQMnE1Ngq+FDxQQQLBX22HSbTUDPJlMykNCHQFhF8EbT4IOhLn6vWN1/98ar/gr64y9LS3U3DtuzDkuXOj2aSzGQn3cnMbvP5wG3OuffcOed7f57pPdwJ4MSaSv/JRJyLiN8kERON+UlEDNdS2YjL9XIvtjYL6ZTEzs5P3ktqZba3NgvRsk6Mj8epRuZsRPzzlxHnMwfrraxvLOVLpeJqIz9bXb41W1nfmLm5nF8sLhZXLs7Nz1+49O1Lo72L9YP/bJx++tsffuMvlz/8xVce//pfSVyO041lrXH0ylRM1bdJDKebcI8f9LqyAUsG3QBeS3pqDtXP8jgXE9kY6X7d7HE2DAA4NncjYgcAOGES938AOGGaD262tzYL6bRzd9D/I9Ffz74fEWP1+JvPN+tLso1ndmO156Dj28me5x3pZpvsQf1TEfHHv/3sT+kUx/QcEqCde/cj4vrkVPP6v3v9SQ6MWajrfkDGN5uJQwYHTO3Lu/5B//w97f98Z7f/t721Gfcay5r9n2jT/xltc+6+jqnYO+Lk4PmfedKDajpK+3/fG94d27bb/3s1aG1yqJE7U+vzDSc3bpaK6bXtixExHcOjaX6u/cfXhpdNP//o+Z65LRG39v/ef/DzR2n96d/dEpkn2X2X3IV8Nd+L2FPP7kd8Ndsu/uTV/k869H+vdlnHj777qz90WpbGn8bbnPbG37xxtBlA2CM7DyO+Hu3jb0oOG594cbZ2OMw2D4o2/vr/3493qr91/6dTWn/9u8CZ3gfbRrr/xw+PfzJpHa9ZOXod/3448Y9OyzrH39T++B9JflpLN0+lO/lqdXUuYiT58cH5F3bXbeab5dP4p7/W/vw/7PhPvxNe7zL+7NN3//yJ8TdnHIi/YazLyo4ojX/hSPu/bSL9KtxhUb70+MXSUKf6u9v/82liaLoxp5vrX8eW5kulkZYyr73hAAAAAAAAAAAAAAAAAAAAAAAAAOAIMrWXlCaZ3Kt0JpPLRe03vL8c45lSuVI9f6O8trJQf5npZAyPRkTtVZcTLe9DnWu8D7+Zv7Av/62I+FJE/G70C7V8rlAuLQw6eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABoONXh9/9T74zW/74caAsBgN57q5tCz4vH3xAAoJ/Guik0evztAAD6p6v7PwDwRnH/B4CTZywz6BYAAP02FpEddBsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4o129ciWddl5ubRbS/MLt9bWl8u2ZhWJlKbe8VsgVyqu3covl8mKpmCuUl1tW/W+7zyuVy7fmY2Xtzmy1WKnOVtY3ri2X11aq124u5xeL14rDfYsMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALpXWd9YypdKxdVG4tF4xN45fUoMNRrUy0+eOd3vKPqR2Jmob6nPSnu6SWSOUnhs/5y3Z/539rC1Hhw4jCU+dWKQVyUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAz4+PAwAA//8FRxnd")
r4 = open(&(0x7f0000000280)='./file1\x00', 0x21123bfef05014e, 0x1c1)
r5 = syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000540)='./bus\x00', 0x32010, &(0x7f0000000240), 0x1, 0x51a, &(0x7f0000000f00)="$eJzs3c9vI1cdAPCvnThxfnSTlh4AQbu0hQWt1km8bVT1AOWIUCVEjyBtQ+KNothxFDulCXtIz1yRqMSJHvkDOPfEgRsXBDcuywGJHxFog8TBaMaTrDdrb6xNYqfx5yON5r2ZWX+/L868t36O/QIYWTcj4iAiJiLig4iYy47nsi3ebW/JdY8OH6weHT5YzUWr9f4/c+n55Fh0/JvETPaYxYj44acRP8k9Hbext7+5Uq1WdrL6QrO2vdDY27+zUVtZr6xXtsrl5aXlxbfvvlW+sLa+WpvISl99+IeDb/0sSWs2O9LZjovUbnrhJE5iPCK+fxnBhmAsa8/EsBPhueQj4qWIeC29/+diLH02AYDrrNWai9ZcZx0AuO7y6RxYLl/K5gJmI58vldpzeC/HdL5abzRv36/vbq2158rmo5C/v1GtLGZzhfNRyCX1pbT8uF4+Vb8bES9GxC8mp9J6abVeXRvmf3wAYITNnBr//zPZHv8BgGuuOOwEAICB6zH+Hww6DwBgcLz+B4DRY/wHgNFTTL/DYWrYaQAAA+T1PwCMHuM/AIyUH7z3XrK1jrLvv177cG93s/7hnbVKY7NU210trdZ3tkvr9fp6+p09tbMer1qvby+9GbsfzX97u9FcaOzt36vVd7ea99Lv9b5XKaRX+WQBAAzTi69+9udcMiK/M5Vu0bGWQ2GomQGXLT/sBIChGetRBq4/q33B6DrHa3zTA3BNdFmi9wnF6PIBoVar1bq8lIBLdutL5v9hVHXM//srYBgx5vxhdJn/h9HVauX6XfM/+r0QALjazPEDPd7/fynb/yZ7c+DHa6ev+OQyswIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICr7Xj931K2Fvhs5POlUsQLETEfhdz9jWplMSJuRMSfJguTSX1pyDkDAOeV/1suW//r1twbs0+cemXmpDgRET/91fu//Gil2dz5Y8RE7l+Tx8ebn2THy4PPHgA42/E4ne47Xsg/OnywerwNMp+/fzciiu34R4cTcXQSfzzG030xChEx/e9cVm/LdcxdnMfBxxHxxW7tz8VsOgfSXvn0dPwk9gsDjZ9/In4+PdfeJz+LL1xALjBqPkv6n3e73X/5uJnuu9//xbSHOr+s/0seavUo7QMfxz/u/8Z69H83+43x5u++1y5NPX3u44gvj0ccxz7q6H+O4+d6xH+jz/h/+corr/U61/p1xK3oHr8z1kKztr3Q2Nu/s1FbWa+sV7bK5eWl5cW3775VXkjnqBd6jwb/eOf2jV7nkvZP94hfPKP9X++z/Z/+74Mffe0Z8b/5erf4+Xj5GfGTMfEbfcZfmf5tsde5JP5aj/af9fzf7jP+w7/uP7VsOAAwPI29/c2VarWy86zCjaOIs675XBaiv4t/n/2wrkTOI11InoUrkEbXwnc6jszEJcaa6HEz/vz19q/pZETnL3ar9VyxevUYFzHrBlwFJzd9RPx32MkAAAAAAAAAAAAAAABdDeLTUcNuIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANfX/wMAAP//jMfJaQ==")
r6 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0)
recvmsg(r4, &(0x7f0000000580)={&(0x7f00000001c0)=@pppoe, 0x80, &(0x7f0000000440)=[{&(0x7f0000000240)}, {&(0x7f0000000380)=""/90, 0x5a}, {&(0x7f0000000400)=""/38, 0x26}], 0x3, &(0x7f0000000480)=""/181, 0xb5}, 0x20)
mknod(&(0x7f0000000080)='./bus\x00', 0x1000, 0x1)
open(0x0, 0x143142, 0xa2)
ioctl$EXT4_IOC_MOVE_EXT(r6, 0x8004587d, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x8000200000000000, 0x0, 0x85c, 0x2})
open(0x0, 0x8c00, 0x5)
mount_setattr(r5, 0x0, 0x800, 0x0, 0x0)
write$FUSE_CREATE_OPEN(r1, 0x0, 0x27)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17ffffa, 0x4002011, r4, 0xc000)
fallocate(r4, 0x0, 0x0, 0x8800000)
r7 = openat(0xffffffffffffff9c, 0x0, 0x84042, 0x1fa)
write$P9_RUNLINKAT(r7, 0x0, 0x0)
connect$vsock_stream(r3, &(0x7f0000000300)={0x28, 0x0, 0xffffffff}, 0x10)
connect$vsock_stream(r3, &(0x7f0000000000)={0x28, 0x0, 0x1, @host}, 0x10)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
setsockopt$TIPC_MCAST_BROADCAST(r8, 0x10f, 0x85)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80)
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x3, 0x1c, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0}, 0x94)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
sendto$inet(r2, &(0x7f0000000000)="0c00a40b", 0x4, 0x0, &(0x7f0000000340)={0x2, 0x80, @empty}, 0x10)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet_udp-pipe-setsockopt$IPT_SO_SET_REPLACE-ioctl$XFS_IOC_GETBMAPX-socket$inet_icmp_raw-socket$vsock_stream-syz_mount_image$ext4-open-syz_mount_image$ext4-openat$dir-recvmsg-mknod-open-ioctl$EXT4_IOC_MOVE_EXT-open-mount_setattr-write$FUSE_CREATE_OPEN-mmap-fallocate-openat-write$P9_RUNLINKAT-connect$vsock_stream-connect$vsock_stream-socketpair$tipc-setsockopt$TIPC_MCAST_BROADCAST-bpf$BPF_PROG_WITH_BTFID_LOAD-bpf$PROG_LOAD-mprotect-sendto$inet
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
pipe(&(0x7f0000000140)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000006c0)=@raw={'raw\x00', 0x4001, 0x3, 0x3e8, 0x158, 0x0, 0x148, 0x158, 0x148, 0x350, 0x240, 0x240, 0x350, 0x240, 0x7fffffe, 0x0, {[{{@ip={@private=0xa010102, @local, 0x0, 0x0, 'ip6gretap0\x00', 'nicvf0\x00', {}, {}, 0x88, 0x3, 0x10}, 0x0, 0xf8, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'wg1\x00', {0x0, 0x0, 0x1ff, 0x100000, 0x0, 0xed, 0x10000007}}}, @common=@unspec=@connmark={{0x30}, {0xfffffff9, 0x8}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 0x85d, 0xb, [0x10, 0x31, 0x1e, 0x32, 0x2b, 0x25, 0x3f, 0x17, 0x19, 0x22, 0x2c, 0x3d, 0x7, 0x3f, 0x1e, 0x31], 0x0, 0x2, 0x2}}}, {{@ip={@rand_addr=0x64010101, @local, 0xff, 0x0, 'tunl0\x00', 'lo\x00', {0xff}, {}, 0x2e, 0x3, 0x4}, 0x0, 0x190, 0x1f8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x8, 0x9, 0x1, 0x1, 'syz1\x00', 0x2}}, @inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0xfff, 0x7e, 0x1c, 'netbios-ns\x00', 'syz0\x00', {0x3}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x448)
ioctl$XFS_IOC_GETBMAPX(r1, 0xc0205838, &(0x7f00000005c0)={0x0, 0x1f59c0000, 0x5, 0x3, 0x3, 0x3f, 0xf})
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = socket$vsock_stream(0x28, 0x1, 0x0)
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x10, &(0x7f00000000c0)={[{@errors_continue}]}, 0x5, 0x7ef, &(0x7f0000000ac0)="$eJzs3d9rXFkdAPDvnUx+mLYmgmDrU0DQQMnE1Ngq+FDxQQQLBX22HSbTUDPJlMykNCHQFhF8EbT4IOhLn6vWN1/98ar/gr64y9LS3U3DtuzDkuXOj2aSzGQn3cnMbvP5wG3OuffcOed7f57pPdwJ4MSaSv/JRJyLiN8kERON+UlEDNdS2YjL9XIvtjYL6ZTEzs5P3ktqZba3NgvRsk6Mj8epRuZsRPzzlxHnMwfrraxvLOVLpeJqIz9bXb41W1nfmLm5nF8sLhZXLs7Nz1+49O1Lo72L9YP/bJx++tsffuMvlz/8xVce//pfSVyO041lrXH0ylRM1bdJDKebcI8f9LqyAUsG3QBeS3pqDtXP8jgXE9kY6X7d7HE2DAA4NncjYgcAOGES938AOGGaD262tzYL6bRzd9D/I9Ffz74fEWP1+JvPN+tLso1ndmO156Dj28me5x3pZpvsQf1TEfHHv/3sT+kUx/QcEqCde/cj4vrkVPP6v3v9SQ6MWajrfkDGN5uJQwYHTO3Lu/5B//w97f98Z7f/t721Gfcay5r9n2jT/xltc+6+jqnYO+Lk4PmfedKDajpK+3/fG94d27bb/3s1aG1yqJE7U+vzDSc3bpaK6bXtixExHcOjaX6u/cfXhpdNP//o+Z65LRG39v/ef/DzR2n96d/dEpkn2X2X3IV8Nd+L2FPP7kd8Ndsu/uTV/k869H+vdlnHj777qz90WpbGn8bbnPbG37xxtBlA2CM7DyO+Hu3jb0oOG594cbZ2OMw2D4o2/vr/3493qr91/6dTWn/9u8CZ3gfbRrr/xw+PfzJpHa9ZOXod/3448Y9OyzrH39T++B9JflpLN0+lO/lqdXUuYiT58cH5F3bXbeab5dP4p7/W/vw/7PhPvxNe7zL+7NN3//yJ8TdnHIi/YazLyo4ojX/hSPu/bSL9KtxhUb70+MXSUKf6u9v/82liaLoxp5vrX8eW5kulkZYyr73hAAAAAAAAAAAAAAAAAAAAAAAAAOAIMrWXlCaZ3Kt0JpPLRe03vL8c45lSuVI9f6O8trJQf5npZAyPRkTtVZcTLe9DnWu8D7+Zv7Av/62I+FJE/G70C7V8rlAuLQw6eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABoONXh9/9T74zW/74caAsBgN57q5tCz4vH3xAAoJ/Guik0evztAAD6p6v7PwDwRnH/B4CTZywz6BYAAP02FpEddBsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4o129ciWddl5ubRbS/MLt9bWl8u2ZhWJlKbe8VsgVyqu3covl8mKpmCuUl1tW/W+7zyuVy7fmY2Xtzmy1WKnOVtY3ri2X11aq124u5xeL14rDfYsMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALpXWd9YypdKxdVG4tF4xN45fUoMNRrUy0+eOd3vKPqR2Jmob6nPSnu6SWSOUnhs/5y3Z/539rC1Hhw4jCU+dWKQVyUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAz4+PAwAA//8FRxnd")
r4 = open(&(0x7f0000000280)='./file1\x00', 0x21123bfef05014e, 0x1c1)
r5 = syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000540)='./bus\x00', 0x32010, &(0x7f0000000240), 0x1, 0x51a, &(0x7f0000000f00)="$eJzs3c9vI1cdAPCvnThxfnSTlh4AQbu0hQWt1km8bVT1AOWIUCVEjyBtQ+KNothxFDulCXtIz1yRqMSJHvkDOPfEgRsXBDcuywGJHxFog8TBaMaTrDdrb6xNYqfx5yON5r2ZWX+/L868t36O/QIYWTcj4iAiJiLig4iYy47nsi3ebW/JdY8OH6weHT5YzUWr9f4/c+n55Fh0/JvETPaYxYj44acRP8k9Hbext7+5Uq1WdrL6QrO2vdDY27+zUVtZr6xXtsrl5aXlxbfvvlW+sLa+WpvISl99+IeDb/0sSWs2O9LZjovUbnrhJE5iPCK+fxnBhmAsa8/EsBPhueQj4qWIeC29/+diLH02AYDrrNWai9ZcZx0AuO7y6RxYLl/K5gJmI58vldpzeC/HdL5abzRv36/vbq2158rmo5C/v1GtLGZzhfNRyCX1pbT8uF4+Vb8bES9GxC8mp9J6abVeXRvmf3wAYITNnBr//zPZHv8BgGuuOOwEAICB6zH+Hww6DwBgcLz+B4DRY/wHgNFTTL/DYWrYaQAAA+T1PwCMHuM/AIyUH7z3XrK1jrLvv177cG93s/7hnbVKY7NU210trdZ3tkvr9fp6+p09tbMer1qvby+9GbsfzX97u9FcaOzt36vVd7ea99Lv9b5XKaRX+WQBAAzTi69+9udcMiK/M5Vu0bGWQ2GomQGXLT/sBIChGetRBq4/q33B6DrHa3zTA3BNdFmi9wnF6PIBoVar1bq8lIBLdutL5v9hVHXM//srYBgx5vxhdJn/h9HVauX6XfM/+r0QALjazPEDPd7/fynb/yZ7c+DHa6ev+OQyswIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICr7Xj931K2Fvhs5POlUsQLETEfhdz9jWplMSJuRMSfJguTSX1pyDkDAOeV/1suW//r1twbs0+cemXmpDgRET/91fu//Gil2dz5Y8RE7l+Tx8ebn2THy4PPHgA42/E4ne47Xsg/OnywerwNMp+/fzciiu34R4cTcXQSfzzG030xChEx/e9cVm/LdcxdnMfBxxHxxW7tz8VsOgfSXvn0dPwk9gsDjZ9/In4+PdfeJz+LL1xALjBqPkv6n3e73X/5uJnuu9//xbSHOr+s/0seavUo7QMfxz/u/8Z69H83+43x5u++1y5NPX3u44gvj0ccxz7q6H+O4+d6xH+jz/h/+corr/U61/p1xK3oHr8z1kKztr3Q2Nu/s1FbWa+sV7bK5eWl5cW3775VXkjnqBd6jwb/eOf2jV7nkvZP94hfPKP9X++z/Z/+74Mffe0Z8b/5erf4+Xj5GfGTMfEbfcZfmf5tsde5JP5aj/af9fzf7jP+w7/uP7VsOAAwPI29/c2VarWy86zCjaOIs675XBaiv4t/n/2wrkTOI11InoUrkEbXwnc6jszEJcaa6HEz/vz19q/pZETnL3ar9VyxevUYFzHrBlwFJzd9RPx32MkAAAAAAAAAAAAAAABdDeLTUcNuIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANfX/wMAAP//jMfJaQ==")
r6 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0)
recvmsg(r4, &(0x7f0000000580)={&(0x7f00000001c0)=@pppoe, 0x80, &(0x7f0000000440)=[{&(0x7f0000000240)}, {&(0x7f0000000380)=""/90, 0x5a}, {&(0x7f0000000400)=""/38, 0x26}], 0x3, &(0x7f0000000480)=""/181, 0xb5}, 0x20)
mknod(&(0x7f0000000080)='./bus\x00', 0x1000, 0x1)
open(0x0, 0x143142, 0xa2)
ioctl$EXT4_IOC_MOVE_EXT(r6, 0x8004587d, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x8000200000000000, 0x0, 0x85c, 0x2})
open(0x0, 0x8c00, 0x5)
mount_setattr(r5, 0x0, 0x800, 0x0, 0x0)
write$FUSE_CREATE_OPEN(r1, 0x0, 0x27)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17ffffa, 0x4002011, r4, 0xc000)
fallocate(r4, 0x0, 0x0, 0x8800000)
r7 = openat(0xffffffffffffff9c, 0x0, 0x84042, 0x1fa)
write$P9_RUNLINKAT(r7, 0x0, 0x0)
connect$vsock_stream(r3, &(0x7f0000000300)={0x28, 0x0, 0xffffffff}, 0x10)
connect$vsock_stream(r3, &(0x7f0000000000)={0x28, 0x0, 0x1, @host}, 0x10)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r8=>0xffffffffffffffff})
setsockopt$TIPC_MCAST_BROADCAST(r8, 0x10f, 0x85)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80)
bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x3, 0x1c, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0}, 0x94)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
sendto$inet(r2, &(0x7f0000000000)="0c00a40b", 0x4, 0x0, &(0x7f0000000340)={0x2, 0x80, @empty}, 0x10)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket-socket$nl_route-pipe2$9p-write$P9_RRENAME-sendmsg$nl_route
detailed listing:
executing program 0:
socket(0x400000000010, 0x2, 0x0) (async)
r0 = socket(0x400000000010, 0x2, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x86000)
write$P9_RRENAME(r2, &(0x7f0000000080)={0x7, 0x15, 0x2}, 0x7)
sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYBLOB="6c0000001000390428e06800fedbdf2500000600", @ANYRES32=0x0, @ANYBLOB="80000000800404004c0012800b000100697036746e6c00003c000280140002000000000000000000000000000000000108001400ff01000014000300", @ANYRES8=r0], 0x6c}, 0x1, 0x0, 0x0, 0x81}, 0x2400c0d4)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket-socket$nl_route-pipe2$9p-write$P9_RRENAME-sendmsg$nl_route
detailed listing:
executing program 0:
socket(0x400000000010, 0x2, 0x0) (async)
r0 = socket(0x400000000010, 0x2, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x86000)
write$P9_RRENAME(r2, &(0x7f0000000080)={0x7, 0x15, 0x2}, 0x7)
sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYBLOB="6c0000001000390428e06800fedbdf2500000600", @ANYRES32=0x0, @ANYBLOB="80000000800404004c0012800b000100697036746e6c00003c000280140002000000000000000000000000000000000108001400ff01000014000300", @ANYRES8=r0], 0x6c}, 0x1, 0x0, 0x0, 0x81}, 0x2400c0d4)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_icmp_raw-connect$inet6-sendmmsg$inet6
detailed listing:
executing program 0:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000000bc0)=[{{0x0, 0x0, &(0x7f0000000200)=[{0x0}], 0x1}}], 0x1, 0x4404c880)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_icmp_raw-connect$inet6-sendmmsg$inet6
detailed listing:
executing program 0:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000000bc0)=[{{0x0, 0x0, &(0x7f0000000200)=[{0x0}], 0x1}}], 0x1, 0x4404c880)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mmap-socket$nl_route-mprotect-socket$igmp6-socket$inet6_icmp_raw-sendmmsg$inet6-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-socket$inet6_tcp-socket$nl_generic-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$ETHTOOL_MSG_PAUSE_SET-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_SET_MESH_CONFIG-syz_genetlink_get_family_id$tipc2-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_SET_REGS-ioctl$TUNSETIFF-ioctl$KVM_RUN-mkdirat-accept4$packet
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000003880), &(0x7f0000000e80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='utf8=1ppy,iocharset=cp862,debug,gid=', @ANYRESHEX=0x0, @ANYBLOB=',shortname=win95,utf8=1,shortname=winnt,shortname=lower,nonumtail=0,codepage=864,nonumtail=0,uni_xlate=1,utf8=0,check=relaxed,shortname=mixed,uni_xlate=0,\x00'], 0xfd, 0x2cb, &(0x7f0000000a80)="$eJzs3U+LG2UYAPBndrPJqIfk4EkUB/TgqXT7CbLIFos5KTn4B1RsC9IEoQsL/sHYk+DJi0c/gSD05tEv4MVv4AcQ9GQPhVdmMpNMukk0lLRqf7/LvvvO88zzvDMTlj3Mm/efn966XsTNO5//GnmexcEwhnEvi0EcROPLWDH8JgCA/7J7KcXvaW6XvCwi8v21BQDs0c5//+/uvSUAYM/efOvt109Go9M3iiKPq9Ovzsflf/blz/nxk5vxUUziRlyOftyPSAvz8dWU0qxTlAbx8nR2Pi4zp+/9XJ//5LeIKv84+jGoplbzr41Oj4u5Vv6s7OPpuv6wzL8S/Xh2Tf1ro9Mra/Jj3I1XXmr1fyn68cuH8XFM4nrVxDL/i+OieDV9++dn75TtlfnZ7Hzcq+KW0uEjvjUAAAAAAAAAAAAAAAAAAAAAAPyPXar3zulFtX9POVXvv3N4v/zlKIrGYHV/nnl+1pzogf2BZim+a/bXuVwURaoDl/mdeK4TncezagAAAAAAAAAAAAAAAAAAAPh3Ofvk01sfTCY3bleDP6IeLGZ2GzS7ATSv9e9+nrtV1rA182Jsz+pF3tQ6qMtuKRGHTUwWsbWfchEPdzXqQXMxNsc8tann739ozbzbxERksalo/vf9HJXnyR9+XYtBc7tbM4slZ+uvYW8RnDcPyY/NTEopdVsL3Npqd9OhtNPj1117qH8xuGnstfVPePeZajDbUiuyTY19/cLyc1kfyh4s0d38IB3Vg1b62WE7OF+5F3WhnzZ+Ui7I7NYBAAAAAAAAAAAAAAAAAAB7deF94LY7W1MPUm9vbQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAI7X8/v8dBrM6+R8Ed+P22WNeIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE+AvwIAAP//VbNPlA==")
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
socket$igmp6(0xa, 0x3, 0x2)
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
sendmmsg$inet6(r0, &(0x7f0000004140)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x20c5, @empty, 0x8}, 0x1c, 0x0, 0xffffffffffffff7e, &(0x7f0000000a40)=ANY=[@ANYBLOB="147dfafcba90ad380000000019a3c10600cba8183d1bfcc19fcaf5006b28dc264ddeb5de1d0000"], 0x18}}], 0x1, 0x40080)
syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket(0x27, 0x0, 0x2)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', <r4=>0x0})
sendmsg$ETHTOOL_MSG_PAUSE_SET(r2, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=ANY=[@ANYBLOB="44000800d387d6ff0fd41253ea6faaef99", @ANYRES16=r1, @ANYBLOB="010427bd7000efdbdf25160000000500020000000000280001801400020076657468305f746f5f7465616d000000080003000200000008000100", @ANYRES32=r4, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x24000800}, 0x14048005)
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60)
r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r8)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000200)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_SET_MESH_CONFIG(r8, &(0x7f0000000900)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000940)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="2000279810140db7b7888598cb486301c37000fddbdf251d00000008000300", @ANYRES32=r10, @ANYBLOB="0c009900070000003a0000000c00990000000000690000000800010034000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040084)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r8)
ioctl$KVM_SET_IRQCHIP(r6, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0x2, 0x2, 0x4, 0x41, 0x1, 0xf0}})
ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x1, 0xb, 0x5, 0x0, 0x8000], 0x1, 0x3c4210})
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02})
ioctl$KVM_RUN(r7, 0xae80, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000005c0), 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-mmap-socket$nl_route-mprotect-socket$igmp6-socket$inet6_icmp_raw-sendmmsg$inet6-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-socket$inet6_tcp-socket$nl_generic-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$ETHTOOL_MSG_PAUSE_SET-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_SET_MESH_CONFIG-syz_genetlink_get_family_id$tipc2-ioctl$KVM_SET_IRQCHIP-ioctl$KVM_SET_REGS-ioctl$TUNSETIFF-ioctl$KVM_RUN-mkdirat-accept4$packet
detailed listing:
executing program 0:
syz_mount_image$vfat(&(0x7f0000003880), &(0x7f0000000e80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='utf8=1ppy,iocharset=cp862,debug,gid=', @ANYRESHEX=0x0, @ANYBLOB=',shortname=win95,utf8=1,shortname=winnt,shortname=lower,nonumtail=0,codepage=864,nonumtail=0,uni_xlate=1,utf8=0,check=relaxed,shortname=mixed,uni_xlate=0,\x00'], 0xfd, 0x2cb, &(0x7f0000000a80)="$eJzs3U+LG2UYAPBndrPJqIfk4EkUB/TgqXT7CbLIFos5KTn4B1RsC9IEoQsL/sHYk+DJi0c/gSD05tEv4MVv4AcQ9GQPhVdmMpNMukk0lLRqf7/LvvvO88zzvDMTlj3Mm/efn966XsTNO5//GnmexcEwhnEvi0EcROPLWDH8JgCA/7J7KcXvaW6XvCwi8v21BQDs0c5//+/uvSUAYM/efOvt109Go9M3iiKPq9Ovzsflf/blz/nxk5vxUUziRlyOftyPSAvz8dWU0qxTlAbx8nR2Pi4zp+/9XJ//5LeIKv84+jGoplbzr41Oj4u5Vv6s7OPpuv6wzL8S/Xh2Tf1ro9Mra/Jj3I1XXmr1fyn68cuH8XFM4nrVxDL/i+OieDV9++dn75TtlfnZ7Hzcq+KW0uEjvjUAAAAAAAAAAAAAAAAAAAAAAPyPXar3zulFtX9POVXvv3N4v/zlKIrGYHV/nnl+1pzogf2BZim+a/bXuVwURaoDl/mdeK4TncezagAAAAAAAAAAAAAAAAAAAPh3Ofvk01sfTCY3bleDP6IeLGZ2GzS7ATSv9e9+nrtV1rA182Jsz+pF3tQ6qMtuKRGHTUwWsbWfchEPdzXqQXMxNsc8tann739ozbzbxERksalo/vf9HJXnyR9+XYtBc7tbM4slZ+uvYW8RnDcPyY/NTEopdVsL3Npqd9OhtNPj1117qH8xuGnstfVPePeZajDbUiuyTY19/cLyc1kfyh4s0d38IB3Vg1b62WE7OF+5F3WhnzZ+Ui7I7NYBAAAAAAAAAAAAAAAAAAB7deF94LY7W1MPUm9vbQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAI7X8/v8dBrM6+R8Ed+P22WNeIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE+AvwIAAP//VbNPlA==")
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
socket$igmp6(0xa, 0x3, 0x2)
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
sendmmsg$inet6(r0, &(0x7f0000004140)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x20c5, @empty, 0x8}, 0x1c, 0x0, 0xffffffffffffff7e, &(0x7f0000000a40)=ANY=[@ANYBLOB="147dfafcba90ad380000000019a3c10600cba8183d1bfcc19fcaf5006b28dc264ddeb5de1d0000"], 0x18}}], 0x1, 0x40080)
syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket(0x27, 0x0, 0x2)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', <r4=>0x0})
sendmsg$ETHTOOL_MSG_PAUSE_SET(r2, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)=ANY=[@ANYBLOB="44000800d387d6ff0fd41253ea6faaef99", @ANYRES16=r1, @ANYBLOB="010427bd7000efdbdf25160000000500020000000000280001801400020076657468305f746f5f7465616d000000080003000200000008000100", @ANYRES32=r4, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x24000800}, 0x14048005)
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60)
r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f00000001c0)={0x205, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r8)
ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000200)={'wlan1\x00', <r10=>0x0})
sendmsg$NL80211_CMD_SET_MESH_CONFIG(r8, &(0x7f0000000900)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000940)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="2000279810140db7b7888598cb486301c37000fddbdf251d00000008000300", @ANYRES32=r10, @ANYBLOB="0c009900070000003a0000000c00990000000000690000000800010034000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040084)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r8)
ioctl$KVM_SET_IRQCHIP(r6, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0x2, 0x2, 0x4, 0x41, 0x1, 0xf0}})
ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x1, 0xb, 0x5, 0x0, 0x8000], 0x1, 0x3c4210})
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02})
ioctl$KVM_RUN(r7, 0xae80, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff)
accept4$packet(0xffffffffffffffff, 0x0, &(0x7f00000005c0), 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a00)=ANY=[@ANYBLOB="800100001700010000000000000000007f000001000000000000000000000000000004d600000000fe8000"/52, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc02000000000000000000fe00ac14140000000010000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000a000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000020200000000f9ffffff02000000000000000000000044000500ffffffff000000000000000000000000000004d2330000000200000000000000000000000000000000000000000000000101050000080000010400000500000008001f00040000000c0015"], 0x180}, 0x1, 0x0, 0x0, 0x80}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-socket$nl_xfrm-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_xfrm-socket$inet6-connect$inet6-syz_clone3-waitid$P_PIDFD-openat$tun-ioctl$TUNSETIFF-write$cgroup_subtree-prctl$PR_SET_MM_MAP
detailed listing:
executing program 0:
r0 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000100)='./file2\x00', 0x220881f, &(0x7f0000000140)={[{@norecovery}], [{@context={'context', 0x3d, 'unconfined_u'}}]}, 0x4, 0x580, &(0x7f00000007c0)="$eJzs3dFrHHkdAPDvTHbbps25ORWpB14P76Qt2k1zsXfBh1NRfDtQzvca0k0I2XRLkt41oXgp/gGCiAq+6NMhCIKvivRPEOHAexJBVBTRnj74UB2Z3dlkm+xuUrO70c3nA9P5zfx+M9/fb6f72/3NTGYDOLVeiIgrEZFlWXY1Iiox3VyfFlPstKa83PuP7i/mUxJZ9sZfk0iKde19nS3mF4rNzrUzkoNxN7a2VxfK9dp6sTyzuZY8zrLtaytrC8u15drtubnZV+Zfnb8xf30g7cxb9doX//idb77zpdd+8am3fnfzz1e+3mpgS2c7BqnV9PLeaxERpYj4wk9/fmEY8U5CqdnClhsnXBcAAPqrRMQHI+LjEXE1KjHR/DYHAAAAjJPss1PxOGld/wMAAADGUxoRU5Gk1eJ+36lI02q1dQ/vh+N8Wm9sbH4yq+yeL/jtb8rp0kq9dr24d2A6ykm+PFts315+ubjntr08FxHPRsS3K5PJ0oOoVRcb9VsneuYDAAAATo8L+8b//6i0xv8AAADAmJnuneVpAAAAADAmnhz/l0+sHgAAAMCQlPpe/wcAAAD+/3359dfzKWv//vWtN7furjbevHartrFaXbu7WF1srN+pLjcay/VadbGxdtj+6o3GnU/H7bv3ZjZrG5szG1vbN9cad29v3lx54iewW94eUqMAAACAJzx76eF7aUTsfGYyn2VJR145IpvoLOxhADBW0qcp/Ifh1QMYvYm+uedHVg9g9Lp/pU92Rl4RYOQO/WN/Y34Ye4f1Awdv3in8cvB1AQAAhuPyRx++l7Su/zen3Jki71KWZYdsfnboFQSGprj+nyQnXRFg5Cae9h4gYGx42DecXuV+dwAaFMDYS4/wVj/+9f9DzyUCAABDNtWckrRajAOmIk2r1Yhnmj8LWE6WVuq16xHxgYj4daV8Nl+ebW6ZOD0AAAAAAAAAAAAAAAAAAAAAAAAAAEeUZUlkPUzuljko0u7rAQAAgP89EemfkuL3vy5XXpraf37gTPLPSnMeEW99/43v3lvY3Fyfzdf/bXf95veK9S+P+uwFAAAA0E17nN4exwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAIL3/KInYyVP3F0cZ9y+fj4jpPP79xfbUyinFueb8XJQj4vzfkyh1bJdExMQA4u88iIiLHfHTvQjTzaq1arE/fl5schjxd9t/ePwLA4gPp9nDvP/5XLf3XxovNOfd33+lYjqu3v1futv/TfTo/57ptsP04Krn3v3JTM/4DyKeK3Xvf9rxk2b8jyztj//iEdv4ta9ub/fKy34YcTm6x++MNZOU7sxsbG1fW1lbWK4t127Pzc2+Mv/q/I356zNLK/Va8W/XGN/62M/+3a/95w/Gzz9ymv3vXvsPvv4vHbH9/3r33qMPtZLlfVnl+EGWXXmx+/G/2CN++7PvE8Xhzpcvt9M7rXSn53/8q+cv9Wn/rY72l3oe/4Ptv7K32POjOC939Svf+P3hrxIAMCobW9urC/V6bf0YiYl6Lf/8X11of0HYV6YU+7Y6030/Fw+siW47LMUA6izx3x/u7ke5X2LyaQofN7EQ/cq0/4+OoD5vP/0LdazEO3H8/fxoot0njLYfAgAAhm/v2/9RtxjEVW8AAAAAAAAAAAAAAAAAAACg02HPA4vuWVmWZb03L0fEeu8nC+ycSEsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPr7TwAAAP//RiS0Ag==")
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', <r2=>0x0})
sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2b, 0x0, {{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x0, 0x0, r2, 0xffffffffffffffff}, {0x0, 0xc, 0xfffffffffffffffe, 0x6, 0x3c, 0xffffffffffffffff, 0x200000000000, 0x4000000000000000}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0xffff, 0x0, 0x1}}, 0xb8}}, 0x0) (async)
r3 = socket$inet6(0xa, 0x3, 0x1)
connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c)
syz_clone3(0x0, 0x0)
waitid$P_PIDFD(0x3, 0xffffffffffffffff, 0x0, 0x40000004, 0x0) (async)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1a41, 0x0)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'wlan1\x00', 0xd132})
write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="9601"], 0x6e8a)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000001c0)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fef000/0x11000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000180)="a7481b1fe97d62dfdfd0a9bfa01c05c21418a1b8b63a965b02f7e7cdfa658d577314129ab182", 0x26, r0}, 0x68)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-openat$kvm-add_key$fscrypt_provisioning-socketpair$unix-socketpair$unix-sendmsg$inet-mmap-mremap-newfstatat-setresuid-setresuid-mmap-mmap-socketpair$unix-sendmmsg$unix-mincore-mremap-mremap-mremap-recvmmsg-recvmmsg-recvmsg$unix-recvmsg$unix-getsockopt$SO_TIMESTAMPING-getsockopt$SO_TIMESTAMPING-openat$kvm-ioctl$KVM_CREATE_VM-syz_mount_image$exfat-syz_mount_image$exfat-ioctl$KVM_CREATE_VCPU-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$NILFS_IOCTL_CHANGE_CPMODE-setsockopt$inet6_IPV6_IPSEC_POLICY-setsockopt$inet6_IPV6_IPSEC_POLICY-fcntl$F_GET_FILE_RW_HINT-bpf$PROG_LOAD-mprotect-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
add_key$fscrypt_provisioning(&(0x7f0000000400), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="030000000000000a6162636465666768696a6b6c6d6e6f707172737475767778797a3031323334353634884eadf299ffe70afe6a62587a6e0751882dc9f01fac4529ed"], 0x29, 0xffffffffffffffff)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)) (async)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000)
mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000001, 0x6031, 0xffffffffffffffff, 0x0)
mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
newfstatat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, <r3=>0x0}, 0x0)
setresuid(0x0, r3, 0x0) (async)
setresuid(0x0, r3, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, 0xffffffffffffffff, 0xffffc000) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, 0xffffffffffffffff, 0xffffc000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0)
mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000d82000/0x1000)=nil)
mremap(&(0x7f0000186000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000ffb000/0x3000)=nil) (async)
mremap(&(0x7f0000186000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f0000ffb000/0x3000)=nil)
recvmmsg(r1, &(0x7f0000003340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=""/64, 0x40}, 0x4}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000003040)=""/243, 0xf3}, 0x1}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000032c0)=""/71, 0x47}, 0x81}], 0x3, 0x40000002, 0x0) (async)
recvmmsg(r1, &(0x7f0000003340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=""/64, 0x40}, 0x4}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000003040)=""/243, 0xf3}, 0x1}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000032c0)=""/71, 0x47}, 0x81}], 0x3, 0x40000002, 0x0)
recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) (async)
recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0)
getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000200)=0x4) (async)
getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000200)=0x4)
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x901800, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
syz_mount_image$exfat(&(0x7f0000002bc0), &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x300c84d, &(0x7f0000001b00)=ANY=[@ANYBLOB="757466382c646d61736b3d30303030303030303030303030303030303030303030342c646973636172642c6572726f72733d636f6e74696e75652c6572726f72733d636f6e74696e75652c696f636861727365743d63703836312c666d61736b3d30303030303030303030003030303030303030303030352c696f636861727365743d69736f383835392d31342c696f636861727365743d63703836312c696f63686172736501006d6163637972696c6c69632c00"], 0xfe, 0x152f, &(0x7f00000005c0)="$eJzs3AucTtX6OPDnWWvtMSbpbZLLsNZ6Nm9yWSRJLklyqSRJkuSWkCQ5kpAYcksakpDck8sQksvEpHG/3y8JSXImSUJyS9b/MzHH6ej86/xOJ7/fmef7+ezPrDVrP2s/e555923ed77pNLh6gxpV6hER/FvwwpdEAIgFgP4AcA0ABABQJr5MfMZ4domJ/95G2B/r4eQrnQG7krj+WRvXP2vj+mdtXP+sjeuftXH9szauf9bG9WcsK9s0Ld+1vGTdhZ//Z2V8/v8vkl5i9JdrSlzfGSDm94Zw/f/vw38jluv/Xyv4PStx/bM2rn9WFXulE2D/C/DrPyvI9k9HuP5ZG9efsazs758Fx8KVfx79Zy8Q+U/+DcT3uPBT/qfrdLhYhiu3/4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHG2J/gtL9EAUBm+0rnxRhjjDHGGGOMsT+Oz3alM2CMMcYYY4wxxth/HoIACQoCiIFsEAvZIQ4EQEzm+LUQD9dBLrgeckMeyAv5IAHyQwHQYMACQQgFoRBE4QYoDDdCESgKxaA4OCgBJeEmKAU3Q2m4BcrArVAWboNyUB4qQEW4HSrBHVAZ7oQqcBdUhWpQHWrA3XAP3As14T6oBfdDbXgA6sCDUBcegnrwMNSHR6ABPAoN4TFoBI2hCTSFZv+j+BehG7wE3aEHJEJP6AUvQ2/oA32hH/SHV2AAvAoD4TVIgkEwGF6HIfAGDIU3YRgMhxHwFoyEt2EUjIYxMBbGwXiYAO/ARHgXJsFkmAJTIRmmwXR4D2bATJgF78Ns+ADmwFyYB/MhBT6EBbAQUuEjWAQfQxoshiWwFJbBclgBK2EVrIY1sBbWwXrYABthE2yGLbAVtsF22AGfwE74FHbBbtgDn8Fe+PxfjD/1D/GdERBQoECFCmMwBmMxFuMwDnNgDsyJOTGCEYzHeMyFuTA35sa8mBcTMAELYAE0aJCQsCAWxChGsTAWxiJYBIthMXTosCSWxFJ4M5bG0lgGy2BZLIvlsDyWx4pYESthJayMlbEKVsGqWBWrY3W8G+/GnlgTa2ItrIW1sXbm4ymsh/WwPtbHBtgAG2JDbISNsAk2wWbYDJtjc2yBLbAVtsLW2BrbYBtsi22xHbbD9tgeO2AH7IgdsRN2ws7YBbukv5gN8CV8CXtgVdETe2Ev7I1J2fpiP+yHr+AAfBVfxdcwCQfhYHwdX8c3cCiexGHnh+MIHIGVxNs4CkcjibE4DsfhBJyAE3EiTsLJOBmnYjJOw+k4HWfgTJyJ7+Ns/AA/wLk4F+djCqbgAlyIqZiKi/AUpuFiXIJLcRkux2W4ElfhSlyDa3ENrsf1uBE34mbcjFtxK27H7fgJKgD8FHfjbkzCvbgX9+E+3I/78QAewHRMx4N4EA/hITyMh/EIHsGjeAyP4zE8gSfwJJ7C03gaz+JZPIfPJ3xV/5Oiq5NAZFBCiRgRI2JFrIgTcSKHyCFyipwiIiIiXsSLXCKXyC1yi7wir0gQCaKAKCCMMIJEmHGkEFERFYVFYVFEFBHFRDHhhBMlRUlRSpQSpUVpUUbcKsqK20Q5UV60dBVFRVFJtHKVxZ2iiqgiqopqorqoIWqIe8Q9oqaoKWqJWqK2qC3qiAdFXdET++LDIqMyDcQgbCgGYyPRWMiLR6jmYii2EC1FK/GkGI7DsI1o7tqKZ0Q7MQrbi7+I0fic6CjGYifxgugsuoiu4kXRTbRw3UUPMQl7il5iKvYWfURf0U/MwGrifZydvbp4TSSJQWKweF3MxzfEUPGmGCaGixHiLTFSvC1GidFijBgrxonxYoJ4R0wU74pJYrKYIqaKZDFNTBfviRlippgl3hezxQdijpgr5on5IkV8KBaIhSJVfCQWiY9FmlgsloilYplYLlaIlWKVWC3WiLVinVgvNoiNYpPYLLaIrWKb2C52iE/ETvGp2CV2iz3iM7FXfC72iS/EfvGlOCD+KtLFV+Kg+FocEt+Iw+JbcUR8J46KY+K4+F6cED+Ik+KUOC3OiLPiR3FO/CTOCy9AohRSSiUDGSOzyViZXcbJq2QOGWQe/2W8vE7mktfL3DKPzCvzyQSZXxaQWhppJclQFpSFZFTeIAvLG2URWVQWk8WlkyVkSXmTLCVvlqXlLbKMvFWWlbfJcrK8rCAryttlJXmHhMiFbVSV1WR1WUPeLRPhXllT3idryftlbfmArCMflHXlQ7KefFjWl4/IBvJR2VA+JhvJxrKJbCqbycdlc/mEbCFbylbySdlaPiXbyKdlW/mMbCf9xV+R52RH+bzsJF+QnWUX2VX+JM9LL7vLHhJ6guwlX5a9ZR/ZV/aT/eUrcoB8VQ6Ur8kkOUgOlq/LIfINOVS+KYfJ4XKEfEuOlG/LUXK0HCPHynFyvJwg35ET5btykpwsp8ipMllOk30vzjRLyt+Mf+dX4gf+vPWNcpPcLLfIrXKb3C53yE/kTrlT7pK75B65R+6Ve+U+uU/ul/vlAXlApst0eVAelIfkIXlYHpZH5BF5VB6TZ+T38oT8QZ6Up+QpeUaelWfluYs/A1CohJJKqUDFqGwqVmVXceoqlUNdrXKqa1REXavi1XUql7pe5VZ5VF6VTyWo/KqA0sooq0iFqqAqpKLqBrz4C6OKqeLKqRKqpLrpX4lXhdWNqogq+ov4zPwS/0l+zVQz1Vw1Vy1UC9VKtVKtVWvVRrVRbVVb1U61U+1Ve9VBdVAdVUfVSXVSnVVn1VV1Vd1UN9VddVeJKlH1Ui+r3qqP6qv6qf7qFZGxDwPVQJWkktRgNVgNUUPUUDVUDVPD1Ag1Qo1UI9UoNUqNUWPUODVOTVATlFQT1SQ1SU1RU1SySlbT1XQ1Q81Qs9QsNVvNVnPUHDVPzVMpKkUtUAtUqkpVi9QilaYWq8VqqVqqlqvlaqVaqVar1WqtWqvWq/UqTW1Sm9QWtUVtU9vUDrVD7VQ71S61S+1Re9RetVftU/vUfrVfHVAHVLpKVwfVQXVIHVKH1WF1RB1RR9VRdVwdVyfUCXVSnVSn1Wl1Vp1V59Q5dV6dz7jsC0QgAhWoICaICWKD2CAuiAtyBDmCnEHOIBJEgvggPsgVXB/kDvIEeYN8QUKQPygQ6MAENhAXix4NbggKBzcGRYKiQbGgeOCCEkHJ4KagVHBzUDq4JSgT3BqUDW4LygXlgwpBxeD2oFJwR1A5uDOoEtwVVA2qBdWDGsHdwT3BvUHN4L6gVnB/UDt4IKgTPBjUDR4K6gUPB/WDR4IGwaNBw+CxoFHQOGgSNA2a/aHze38yzxOuu+6hE3VP3Uu/rHvrPrqv7qf761f0AP2qHqhf00l6kB6sX9dD9Bt6qH5TD9PD9Qj9lh6p39aj9Gg9Ro/V4/R4PUG/oyfqd/UkPVlP0VN1sp6mp+v39Aw9U8/S7+vZ+gM9R8/V8/R8naI/1Av0Qp2qP9KL9Mc6TS/WS/RSvUwv1yv0Sr1Kr9Zr9Fq9Tq/XG/RGvUlv1lv0Vr1Nb9c79Cd6p/5U79K79R79md6rP9f79Bd6v/5SH9B/1en6K31Qf60P6W/0Yf2tPqK/00f1MV1af69P6B/0SX1Kn9Zn9Fn9oz6nf9Lntc+4uM84vRtllIkxMSbWxJo4E2dymBwmp8lpIiZi4k28yWVymdwmt8lr8poEk2AKmAImAxkyBU1BEzVRU9gUNkVMEVPMFDPOOFPSlDSlTClT2pQ2ZUwZU9aUNeVMOVPBVDC3m9vNHeYOc6e509xl7jLVTDWTeSaqaWqaWqaWqW1qmzqmjqlr6pp6pp6pb+qbBqaBaWgamkamkWlimphmpplpbpqbFqaFaWVamdamtWlj2pi2pq1pZ9qZ9qa96WA6mI6mo+lkOpnOprPparqabqab6W66m0STaHqZXqa36W36mr6mv+lvBpgBZqAZaJJMkhlsBpshZogZaoaaYWa4GZFxoWreNqPMaDPGjDXjzDgzwUwwE81EM8lMMlPMFJNsks10M93MMDPMLDPLzDazzRwzx8wz80yKSTELzAKTalLNIrPIpJk0s8QsMcvMMrPCrDCrzCqzxqwx62Cd2WA2mE1mk9litphtZpvZYXaYnWan2WV2mT1mj9lr9pp9Zp/Zb/abA+aASTfp5qA5aA6ZQ+awOWyOmCPmqDlqjpvj5oQ5YU6ak+a0OW3OmjwXz5fexNrsNs5eZXPYq21Oe439x35em88m2Py2gNU2t83zi76x1haxRW0xW9w6W8KWtDdd1i9ny9sKtqK93Vayd9jKl/XvsffamvY+W8veb2vYu3/Rr20fsHXso7YuIoBtbOvbpraBfdQ2tI/ZRraxbWKb2tb2KdvGPm3b2mdsO/vsZf0FdqFdZVfbNXat3WV329P2jD1kv7Fn7Y+2u+1h+9tX7AD7qh1oX7NJdtBl/RH2LTvSvm1H2dF2jB17WX+KnWqT7TQ73b5nZ9iZl/VT7Id2tk21c+xcO8/O/7mfkVOq/cgush/bNBvAErvULrPL7Qq78m+5LrXr7Qa70e60n9otdqvdZrfbHZkXwna33WM/s3vt5/ag/drut1/aA/awTbdf/dzP2L/D9lt7xH5nj9pj9rj93p6wP6jM6Ix9/97+ZM9bb4GQgCQpCiiGslEsZac4uopy0NWUk66hCF1L8XQd5aLrKTflobyUjxIoPxUgTYYsEYVUkApRlG6gzPSKUXFyVIJK0k1Uim6m0nQLlaFbqSzdRuWoPFWginQ7VaI7qDLdSVXoLqpK1ag61aC76R66l2rSfVSL7qfa9ADVoQepLj1E9ehhqk+PUAN6lBrSY9SIGlMTakrN6HFqTk9QC2pJrehJak1PURt6mtrSM9SOnqX29BfqQM9RR3qeOtEL1Jm6UFd6kbrRS9SdelAi9aRe9DL1pj7Ul/pRf3qFBtCrNJBeoyQaRIPpdRpCb9BQepOG0XAaQW/RSHqbRtFoGkNjaRyNpwn0Dk2kd2kSTaYpNJWSaRpNp/doBs2kWfQ+zaYPaA7NpXk0n1LoQ1pACymVPqJF9DGl0WJaQktpGS2nFbSSVtFqWkNraR2tpw20kTbRZtpCW2kbbacd9AntpE9pF+2mPfQZ7aXPaR99QfvpSzpAf6V0+ooO0td0iL6hw/St70Hf0VE6RsfpezpBP9BJOkWn6QydpR/pHP1E58kThBiKUIYqDMKYMFsYG2YP48Krwhzh1WHO8JowEl4bxofXhbnC68PcYZ4wb5gvTAjzhwVCHZrQhhSGYcGwUBgNbwgLhzeGRcKiYbGweOjCEmHJ8KawVHhzWDq8JSwT3hqWDW8Ly4Xlw0fvrxjeHlYK7wgrh3eGVcK7wqphtbB6WCO8O7wnvDesGd4X1grvD0uHD4R1wgfDuuFDYb3w4bB++EjYIHw0bBg+FjYKG4dNwqZhs/DxsHn4RNgibBm2Cq8KW4dPhW3Cp8O24TNhu/DZn8cfWJg5/uRl44lhz7BX+HL4cuj9fXJedH40JfphdEF0YTQ1+lF0UfTjaFp0cXRJdGl0WXR5dEV0ZXRVdHV0TXRtdF10fXRDdGPU+xrZwKETTjrlAhfjsrlYl93FuatcDne1y+mucRF3rYt317lc7nqX2+VxeV0+l+DyuwJOO+OsIxe6gq6Qi7obXGF3oyviirpirrhzroQr6Zq6Zq6Za+6ecC1cS9fKPemedE+5p9zT7mn3jGvnnnXt3V9cB/ec6+ied8+7F1xn18V1dS+6bm58zguvyUTXy/VyvV1v19f1df1dfzfADXAD3UCX5JLcYDfYDXFD3FA31A1zw9wIN8KNdCPdKDfKjXFj3Dg3zk1wE9xEN9FNcpPcFDfFJbtkN91NdzPcDFdp5oWtzHFz3Dw3z6W4FLfAZVwzprpFbpFLc2luiVvilrllboVb4Va5VW6NW+PWuXVug9vgNrlNbovb4ra5bW6H2+F2up1ul7/mwqRur9vn9rn9br874P7q0t1X7qD72h1y37jD7lt3xH3njrpj7rj73p1wP7iT7pQ77c64s+5Hd8795M4778ZFxkcmRN6JTIy8G5kUmRyZEpkaSY5Mi0yPvBeZEZkZmRV5PzI78kFkTmRuZF5kfiQl8mFkQWRhJDXyUWRR5ONIWmRxZElkaWRZZHnE+/xbQl/QF/JRf4Mv7G/0RXxRX8wX986X8CX9Tb7UhbzTvL/Vl/W3+XK+vK/gH/ONfGPfxDf1zfzjvrl/wrfwLX0r/6Rv7Z/ybfzTvq1/xrfzz/r2/i++g3/Od/TP+07+Bd/Zd/Fd/Yu+m3/Jd/c9fKLv6Xv5l31v38f39f18f/+KH+Bf9QP9az7JD/KD/et+iH/DD/Vv+mF+uB8R85YfmXmLDGP9OD/eT/Dv+In+XT/JT/ZT/FSf7Kf56f49P8PP9LP8+362/8DP8XP9PD/fp/gP/QK/0Kf6j/wi/7FP84szHxr7FX6lX+VX+zV+rV/n1/sNfqPf5Df7LX6r3+a3+x3+E7/Tf+p3+d1+j//M7/Wf+33+C7//fOYn0L7yB/3X/pD/xh/23/oj/jt/1B/zx/33/oT/wZ/0p/xpf8af9T/6c/4nf54/s8YYY4wx9ruMv9QUvxy58Di/56/E4N+t3AsArt6aL/3vxzOuKNflvtDuIxJiM74+06PTw5lL1aqJiYkX102TEBSaC5D5l6AMP7/14GJ/MbSCp6AttIRSv5p/H9HlLP3G/NFbAeL+LiYjocz+pfm/AMDEX5n/8SdHLCgbno7//8w/F6BIoUsx2eFSfzG0+vn5Skso/U/yz9P8N/LP/uU4gBZ/m/mCFpflXxKegGeh7d9GGGOMMcYYY4yxS/qICh0y7z8z32fza/fnCepSTDa41P+t+3PGGGOMMcYYY4xdec916fr0423btuzwrzcq/4+ifnejIfynZubGrza8B8j8jgKA3x8e92tDABkN+WfuxeY/ZVtJF186/zi07IwP4H9HKf+IxhU+MDHGGGOMMcb+cJcu+n/5fXWlEmKMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxrKgP+PfiV3pfWSMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcautP8XAAD//zrS9gM=") (async)
syz_mount_image$exfat(&(0x7f0000002bc0), &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x300c84d, &(0x7f0000001b00)=ANY=[@ANYBLOB="757466382c646d61736b3d30303030303030303030303030303030303030303030342c646973636172642c6572726f72733d636f6e74696e75652c6572726f72733d636f6e74696e75652c696f636861727365743d63703836312c666d61736b3d30303030303030303030003030303030303030303030352c696f636861727365743d69736f383835392d31342c696f636861727365743d63703836312c696f63686172736501006d6163637972696c6c69632c00"], 0xfe, 0x152f, &(0x7f00000005c0)="$eJzs3AucTtX6OPDnWWvtMSbpbZLLsNZ6Nm9yWSRJLklyqSRJkuSWkCQ5kpAYcksakpDck8sQksvEpHG/3y8JSXImSUJyS9b/MzHH6ej86/xOJ7/fmef7+ezPrDVrP2s/e555923ed77pNLh6gxpV6hER/FvwwpdEAIgFgP4AcA0ABABQJr5MfMZ4domJ/95G2B/r4eQrnQG7krj+WRvXP2vj+mdtXP+sjeuftXH9szauf9bG9WcsK9s0Ld+1vGTdhZ//Z2V8/v8vkl5i9JdrSlzfGSDm94Zw/f/vw38jluv/Xyv4PStx/bM2rn9WFXulE2D/C/DrPyvI9k9HuP5ZG9efsazs758Fx8KVfx79Zy8Q+U/+DcT3uPBT/qfrdLhYhiu3/4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHG2J/gtL9EAUBm+0rnxRhjjDHGGGOMsT+Oz3alM2CMMcYYY4wxxth/HoIACQoCiIFsEAvZIQ4EQEzm+LUQD9dBLrgeckMeyAv5IAHyQwHQYMACQQgFoRBE4QYoDDdCESgKxaA4OCgBJeEmKAU3Q2m4BcrArVAWboNyUB4qQEW4HSrBHVAZ7oQqcBdUhWpQHWrA3XAP3As14T6oBfdDbXgA6sCDUBcegnrwMNSHR6ABPAoN4TFoBI2hCTSFZv+j+BehG7wE3aEHJEJP6AUvQ2/oA32hH/SHV2AAvAoD4TVIgkEwGF6HIfAGDIU3YRgMhxHwFoyEt2EUjIYxMBbGwXiYAO/ARHgXJsFkmAJTIRmmwXR4D2bATJgF78Ns+ADmwFyYB/MhBT6EBbAQUuEjWAQfQxoshiWwFJbBclgBK2EVrIY1sBbWwXrYABthE2yGLbAVtsF22AGfwE74FHbBbtgDn8Fe+PxfjD/1D/GdERBQoECFCmMwBmMxFuMwDnNgDsyJOTGCEYzHeMyFuTA35sa8mBcTMAELYAE0aJCQsCAWxChGsTAWxiJYBIthMXTosCSWxFJ4M5bG0lgGy2BZLIvlsDyWx4pYESthJayMlbEKVsGqWBWrY3W8G+/GnlgTa2ItrIW1sXbm4ymsh/WwPtbHBtgAG2JDbISNsAk2wWbYDJtjc2yBLbAVtsLW2BrbYBtsi22xHbbD9tgeO2AH7IgdsRN2ws7YBbukv5gN8CV8CXtgVdETe2Ev7I1J2fpiP+yHr+AAfBVfxdcwCQfhYHwdX8c3cCiexGHnh+MIHIGVxNs4CkcjibE4DsfhBJyAE3EiTsLJOBmnYjJOw+k4HWfgTJyJ7+Ns/AA/wLk4F+djCqbgAlyIqZiKi/AUpuFiXIJLcRkux2W4ElfhSlyDa3ENrsf1uBE34mbcjFtxK27H7fgJKgD8FHfjbkzCvbgX9+E+3I/78QAewHRMx4N4EA/hITyMh/EIHsGjeAyP4zE8gSfwJJ7C03gaz+JZPIfPJ3xV/5Oiq5NAZFBCiRgRI2JFrIgTcSKHyCFyipwiIiIiXsSLXCKXyC1yi7wir0gQCaKAKCCMMIJEmHGkEFERFYVFYVFEFBHFRDHhhBMlRUlRSpQSpUVpUUbcKsqK20Q5UV60dBVFRVFJtHKVxZ2iiqgiqopqorqoIWqIe8Q9oqaoKWqJWqK2qC3qiAdFXdET++LDIqMyDcQgbCgGYyPRWMiLR6jmYii2EC1FK/GkGI7DsI1o7tqKZ0Q7MQrbi7+I0fic6CjGYifxgugsuoiu4kXRTbRw3UUPMQl7il5iKvYWfURf0U/MwGrifZydvbp4TSSJQWKweF3MxzfEUPGmGCaGixHiLTFSvC1GidFijBgrxonxYoJ4R0wU74pJYrKYIqaKZDFNTBfviRlippgl3hezxQdijpgr5on5IkV8KBaIhSJVfCQWiY9FmlgsloilYplYLlaIlWKVWC3WiLVinVgvNoiNYpPYLLaIrWKb2C52iE/ETvGp2CV2iz3iM7FXfC72iS/EfvGlOCD+KtLFV+Kg+FocEt+Iw+JbcUR8J46KY+K4+F6cED+Ik+KUOC3OiLPiR3FO/CTOCy9AohRSSiUDGSOzyViZXcbJq2QOGWQe/2W8vE7mktfL3DKPzCvzyQSZXxaQWhppJclQFpSFZFTeIAvLG2URWVQWk8WlkyVkSXmTLCVvlqXlLbKMvFWWlbfJcrK8rCAryttlJXmHhMiFbVSV1WR1WUPeLRPhXllT3idryftlbfmArCMflHXlQ7KefFjWl4/IBvJR2VA+JhvJxrKJbCqbycdlc/mEbCFbylbySdlaPiXbyKdlW/mMbCf9xV+R52RH+bzsJF+QnWUX2VX+JM9LL7vLHhJ6guwlX5a9ZR/ZV/aT/eUrcoB8VQ6Ur8kkOUgOlq/LIfINOVS+KYfJ4XKEfEuOlG/LUXK0HCPHynFyvJwg35ET5btykpwsp8ipMllOk30vzjRLyt+Mf+dX4gf+vPWNcpPcLLfIrXKb3C53yE/kTrlT7pK75B65R+6Ve+U+uU/ul/vlAXlApst0eVAelIfkIXlYHpZH5BF5VB6TZ+T38oT8QZ6Up+QpeUaelWfluYs/A1CohJJKqUDFqGwqVmVXceoqlUNdrXKqa1REXavi1XUql7pe5VZ5VF6VTyWo/KqA0sooq0iFqqAqpKLqBrz4C6OKqeLKqRKqpLrpX4lXhdWNqogq+ov4zPwS/0l+zVQz1Vw1Vy1UC9VKtVKtVWvVRrVRbVVb1U61U+1Ve9VBdVAdVUfVSXVSnVVn1VV1Vd1UN9VddVeJKlH1Ui+r3qqP6qv6qf7qFZGxDwPVQJWkktRgNVgNUUPUUDVUDVPD1Ag1Qo1UI9UoNUqNUWPUODVOTVATlFQT1SQ1SU1RU1SySlbT1XQ1Q81Qs9QsNVvNVnPUHDVPzVMpKkUtUAtUqkpVi9QilaYWq8VqqVqqlqvlaqVaqVar1WqtWqvWq/UqTW1Sm9QWtUVtU9vUDrVD7VQ71S61S+1Re9RetVftU/vUfrVfHVAHVLpKVwfVQXVIHVKH1WF1RB1RR9VRdVwdVyfUCXVSnVSn1Wl1Vp1V59Q5dV6dz7jsC0QgAhWoICaICWKD2CAuiAtyBDmCnEHOIBJEgvggPsgVXB/kDvIEeYN8QUKQPygQ6MAENhAXix4NbggKBzcGRYKiQbGgeOCCEkHJ4KagVHBzUDq4JSgT3BqUDW4LygXlgwpBxeD2oFJwR1A5uDOoEtwVVA2qBdWDGsHdwT3BvUHN4L6gVnB/UDt4IKgTPBjUDR4K6gUPB/WDR4IGwaNBw+CxoFHQOGgSNA2a/aHze38yzxOuu+6hE3VP3Uu/rHvrPrqv7qf761f0AP2qHqhf00l6kB6sX9dD9Bt6qH5TD9PD9Qj9lh6p39aj9Gg9Ro/V4/R4PUG/oyfqd/UkPVlP0VN1sp6mp+v39Aw9U8/S7+vZ+gM9R8/V8/R8naI/1Av0Qp2qP9KL9Mc6TS/WS/RSvUwv1yv0Sr1Kr9Zr9Fq9Tq/XG/RGvUlv1lv0Vr1Nb9c79Cd6p/5U79K79R79md6rP9f79Bd6v/5SH9B/1en6K31Qf60P6W/0Yf2tPqK/00f1MV1af69P6B/0SX1Kn9Zn9Fn9oz6nf9Lntc+4uM84vRtllIkxMSbWxJo4E2dymBwmp8lpIiZi4k28yWVymdwmt8lr8poEk2AKmAImAxkyBU1BEzVRU9gUNkVMEVPMFDPOOFPSlDSlTClT2pQ2ZUwZU9aUNeVMOVPBVDC3m9vNHeYOc6e509xl7jLVTDWTeSaqaWqaWqaWqW1qmzqmjqlr6pp6pp6pb+qbBqaBaWgamkamkWlimphmpplpbpqbFqaFaWVamdamtWlj2pi2pq1pZ9qZ9qa96WA6mI6mo+lkOpnOprPparqabqab6W66m0STaHqZXqa36W36mr6mv+lvBpgBZqAZaJJMkhlsBpshZogZaoaaYWa4GZFxoWreNqPMaDPGjDXjzDgzwUwwE81EM8lMMlPMFJNsks10M93MMDPMLDPLzDazzRwzx8wz80yKSTELzAKTalLNIrPIpJk0s8QsMcvMMrPCrDCrzCqzxqwx62Cd2WA2mE1mk9litphtZpvZYXaYnWan2WV2mT1mj9lr9pp9Zp/Zb/abA+aASTfp5qA5aA6ZQ+awOWyOmCPmqDlqjpvj5oQ5YU6ak+a0OW3OmjwXz5fexNrsNs5eZXPYq21Oe439x35em88m2Py2gNU2t83zi76x1haxRW0xW9w6W8KWtDdd1i9ny9sKtqK93Vayd9jKl/XvsffamvY+W8veb2vYu3/Rr20fsHXso7YuIoBtbOvbpraBfdQ2tI/ZRraxbWKb2tb2KdvGPm3b2mdsO/vsZf0FdqFdZVfbNXat3WV329P2jD1kv7Fn7Y+2u+1h+9tX7AD7qh1oX7NJdtBl/RH2LTvSvm1H2dF2jB17WX+KnWqT7TQ73b5nZ9iZl/VT7Id2tk21c+xcO8/O/7mfkVOq/cgush/bNBvAErvULrPL7Qq78m+5LrXr7Qa70e60n9otdqvdZrfbHZkXwna33WM/s3vt5/ag/drut1/aA/awTbdf/dzP2L/D9lt7xH5nj9pj9rj93p6wP6jM6Ix9/97+ZM9bb4GQgCQpCiiGslEsZac4uopy0NWUk66hCF1L8XQd5aLrKTflobyUjxIoPxUgTYYsEYVUkApRlG6gzPSKUXFyVIJK0k1Uim6m0nQLlaFbqSzdRuWoPFWginQ7VaI7qDLdSVXoLqpK1ag61aC76R66l2rSfVSL7qfa9ADVoQepLj1E9ehhqk+PUAN6lBrSY9SIGlMTakrN6HFqTk9QC2pJrehJak1PURt6mtrSM9SOnqX29BfqQM9RR3qeOtEL1Jm6UFd6kbrRS9SdelAi9aRe9DL1pj7Ul/pRf3qFBtCrNJBeoyQaRIPpdRpCb9BQepOG0XAaQW/RSHqbRtFoGkNjaRyNpwn0Dk2kd2kSTaYpNJWSaRpNp/doBs2kWfQ+zaYPaA7NpXk0n1LoQ1pACymVPqJF9DGl0WJaQktpGS2nFbSSVtFqWkNraR2tpw20kTbRZtpCW2kbbacd9AntpE9pF+2mPfQZ7aXPaR99QfvpSzpAf6V0+ooO0td0iL6hw/St70Hf0VE6RsfpezpBP9BJOkWn6QydpR/pHP1E58kThBiKUIYqDMKYMFsYG2YP48Krwhzh1WHO8JowEl4bxofXhbnC68PcYZ4wb5gvTAjzhwVCHZrQhhSGYcGwUBgNbwgLhzeGRcKiYbGweOjCEmHJ8KawVHhzWDq8JSwT3hqWDW8Ly4Xlw0fvrxjeHlYK7wgrh3eGVcK7wqphtbB6WCO8O7wnvDesGd4X1grvD0uHD4R1wgfDuuFDYb3w4bB++EjYIHw0bBg+FjYKG4dNwqZhs/DxsHn4RNgibBm2Cq8KW4dPhW3Cp8O24TNhu/DZn8cfWJg5/uRl44lhz7BX+HL4cuj9fXJedH40JfphdEF0YTQ1+lF0UfTjaFp0cXRJdGl0WXR5dEV0ZXRVdHV0TXRtdF10fXRDdGPU+xrZwKETTjrlAhfjsrlYl93FuatcDne1y+mucRF3rYt317lc7nqX2+VxeV0+l+DyuwJOO+OsIxe6gq6Qi7obXGF3oyviirpirrhzroQr6Zq6Zq6Za+6ecC1cS9fKPemedE+5p9zT7mn3jGvnnnXt3V9cB/ec6+ied8+7F1xn18V1dS+6bm58zguvyUTXy/VyvV1v19f1df1dfzfADXAD3UCX5JLcYDfYDXFD3FA31A1zw9wIN8KNdCPdKDfKjXFj3Dg3zk1wE9xEN9FNcpPcFDfFJbtkN91NdzPcDFdp5oWtzHFz3Dw3z6W4FLfAZVwzprpFbpFLc2luiVvilrllboVb4Va5VW6NW+PWuXVug9vgNrlNbovb4ra5bW6H2+F2up1ul7/mwqRur9vn9rn9br874P7q0t1X7qD72h1y37jD7lt3xH3njrpj7rj73p1wP7iT7pQ77c64s+5Hd8795M4778ZFxkcmRN6JTIy8G5kUmRyZEpkaSY5Mi0yPvBeZEZkZmRV5PzI78kFkTmRuZF5kfiQl8mFkQWRhJDXyUWRR5ONIWmRxZElkaWRZZHnE+/xbQl/QF/JRf4Mv7G/0RXxRX8wX986X8CX9Tb7UhbzTvL/Vl/W3+XK+vK/gH/ONfGPfxDf1zfzjvrl/wrfwLX0r/6Rv7Z/ybfzTvq1/xrfzz/r2/i++g3/Od/TP+07+Bd/Zd/Fd/Yu+m3/Jd/c9fKLv6Xv5l31v38f39f18f/+KH+Bf9QP9az7JD/KD/et+iH/DD/Vv+mF+uB8R85YfmXmLDGP9OD/eT/Dv+In+XT/JT/ZT/FSf7Kf56f49P8PP9LP8+362/8DP8XP9PD/fp/gP/QK/0Kf6j/wi/7FP84szHxr7FX6lX+VX+zV+rV/n1/sNfqPf5Df7LX6r3+a3+x3+E7/Tf+p3+d1+j//M7/Wf+33+C7//fOYn0L7yB/3X/pD/xh/23/oj/jt/1B/zx/33/oT/wZ/0p/xpf8af9T/6c/4nf54/s8YYY4wx9ruMv9QUvxy58Di/56/E4N+t3AsArt6aL/3vxzOuKNflvtDuIxJiM74+06PTw5lL1aqJiYkX102TEBSaC5D5l6AMP7/14GJ/MbSCp6AttIRSv5p/H9HlLP3G/NFbAeL+LiYjocz+pfm/AMDEX5n/8SdHLCgbno7//8w/F6BIoUsx2eFSfzG0+vn5Skso/U/yz9P8N/LP/uU4gBZ/m/mCFpflXxKegGeh7d9GGGOMMcYYY4yxS/qICh0y7z8z32fza/fnCepSTDa41P+t+3PGGGOMMcYYY4xdec916fr0423btuzwrzcq/4+ifnejIfynZubGrza8B8j8jgKA3x8e92tDABkN+WfuxeY/ZVtJF186/zi07IwP4H9HKf+IxhU+MDHGGGOMMcb+cJcu+n/5fXWlEmKMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxrKgP+PfiV3pfWSMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcautP8XAAD//zrS9gM=")
ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) (async)
r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil})
ioctl$NILFS_IOCTL_CHANGE_CPMODE(r0, 0x40106e80, &(0x7f0000000380)={0x4})
setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000480)={{{@in=@multicast2, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x4e20, 0x6, 0x4e24, 0x1, 0xa, 0x0, 0x80, 0xb9}, {0x0, 0x4, 0x0, 0x100000001, 0x4, 0x1ff, 0xd, 0x7fff}, {0x1, 0x1a, 0x2, 0xff}, 0x3, 0x0, 0x0, 0x1, 0x5}, {{@in=@local, 0x4d5, 0xff}, 0xa, @in=@remote, 0x3507, 0x0, 0x0, 0x3, 0x4, 0x7, 0x5}}, 0xe8) (async)
setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000480)={{{@in=@multicast2, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x4e20, 0x6, 0x4e24, 0x1, 0xa, 0x0, 0x80, 0xb9}, {0x0, 0x4, 0x0, 0x100000001, 0x4, 0x1ff, 0xd, 0x7fff}, {0x1, 0x1a, 0x2, 0xff}, 0x3, 0x0, 0x0, 0x1, 0x5}, {{@in=@local, 0x4d5, 0xff}, 0xa, @in=@remote, 0x3507, 0x0, 0x0, 0x3, 0x4, 0x7, 0x5}}, 0xe8)
fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000240))
bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="7b87f20f", @ANYRES64=r7], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x4b, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0)
ioctl$KVM_RUN(r7, 0xae80, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-close-bpf$MAP_CREATE_CONST_STR-bpf$PROG_LOAD_XDP-openat$procfs-openat$cgroup_ro-bpf$MAP_LOOKUP_ELEM-openat$kvm-close-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
close(0x3)
r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="f2ff0000000000000100000000f1000000000000007c9beccd6f2f001f000000000000"], 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000730121000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sysvipc/shm\x00', 0x0, 0x0)
openat$cgroup_ro(r3, &(0x7f0000000180)='blkio.bfq.idle_time\x00', 0x0, 0x0)
bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r2, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70)
r4 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
close(r1)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-socket$inet_udp-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$ieee802154-sendmsg$IEEE802154_LLSEC_ADD_DEV-syz_genetlink_get_family_id$ieee802154-sendmsg$IEEE802154_LLSEC_SETPARAMS-mkdirat-mount-add_key$user-add_key$keyring-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$keyring-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$fscrypt_v1-add_key$user-add_key$keyring-keyctl$KEYCTL_MOVE
detailed listing:
executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000caefb8)={0x8, 0x3, &(0x7f0000000080)=ANY=[@ANYRES64=0x0], &(0x7f0000281ffc)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) (async)
socket$inet_udp(0x2, 0x2, 0x0) (async)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000ac0), r0) (async)
sendmsg$IEEE802154_LLSEC_ADD_DEV(0xffffffffffffffff, 0x0, 0x0) (async)
syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff)
sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="050000000007feffffff22007b492a022f491942e8808fe69b451e881cdeb619b0a8952447e5f7baf87e16cb5f7f397d0f324cb6460ee881c1872d432701"], 0x14}, 0x1, 0x0, 0x0, 0x5}, 0x4000000) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r2 = add_key$user(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x2}, &(0x7f0000000200)='*', 0x1, 0xfffffffffffffffb) (async)
r3 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000180)={'fscrypt:', @auto=[0x30, 0x30, 0x39, 0x30, 0x30, 0x36, 0x31, 0x30, 0x30, 0x30, 0x30, 0x3, 0x30, 0x30, 0x30, 0x32]}, &(0x7f0000000100)={0x0, "f710223344556677fffffe7f0000000000112233445566778899aabbccddeeff00112233445566778899aabbccddeeff0011a233f95566778899aafbccddeeff", 0x40}, 0x48, r3)
add_key$fscrypt_v1(&(0x7f0000000600), &(0x7f0000000200)={'fscrypt:', @desc2}, &(0x7f0000000100)={0x0, "0011223344556677c89900010000eeff00112233445566778899aabb2233445567778899aabbccddeeff00199033445566778876b3dac8ddeeff00", 0x40}, 0x48, r3) (async)
add_key$keyring(&(0x7f0000000340), &(0x7f00000004c0)={'syz', 0x0}, 0x0, 0x0, r3)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000240)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x37, 0x30, 0x30, 0x30, 0x35]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r3) (async)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000280)={'fscrypt:', @auto=[0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r3) (async)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000002c0)={'fscrypt:', @desc3}, &(0x7f0000000580)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccdd2233445566778899aabbccddeeff00", 0x40}, 0x48, r3) (async)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000300)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x38, 0x37, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x35, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x41}, 0x48, r3) (async)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000007c0)={'fscrypt:', @auto=[0x30, 0x30, 0x31, 0x30, 0x30, 0x54, 0x30, 0x30, 0x35, 0x30, 0x30, 0x61, 0x30, 0x30, 0x30, 0x39]}, &(0x7f0000000100)={0x0, "00012233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r3) (async)
add_key$fscrypt_v1(&(0x7f0000000640), &(0x7f0000000380)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x61]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r3) (async)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000003c0)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x62]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r3) (async)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000400)={'fscrypt:', @auto=[0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x34, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r3)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000480)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x38, 0x30, 0x30, 0x6e, 0x30, 0x30, 0xc14e917fff6efda4, 0x30, 0x30, 0x35, 0x30, 0x30, 0x65]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r3)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000440)={'fscrypt:', @auto=[0x35, 0x62, 0x30, 0x30, 0x30, 0x30, 0x30, 0x63, 0x30, 0x30, 0x38, 0x30, 0x30, 0x30, 0x30, 0x66]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x2e}, 0x48, r3) (async)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000500)={'fscrypt:', @auto=[0x30, 0x30, 0x30, 0x30, 0x64, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x31, 0x30]}, &(0x7f00000006c0)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40}, 0x48, r3) (async)
add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f0000000540)={'fscrypt:', @auto=[0x32, 0x64, 0x63, 0x33, 0x30, 0x30, 0x30, 0x36, 0x30, 0x30, 0x30, 0x30, 0x30, 0x36, 0x31, 0x31]}, &(0x7f0000000100)={0x0, "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aa00000000ff00112233445566778899aabbccddeeff", 0x40}, 0x48, r3)
add_key$user(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)='c', 0x1, r3)
r4 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_MOVE(0x1e, r2, r3, r4, 0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-setsockopt$IPT_SO_SET_REPLACE-openat$kvm-close_range-ioctl$KVM_CREATE_VM-ioctl$KVM_IOEVENTFD-bpf$ENABLE_STATS-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x390, 0xffffffff, 0x0, 0x1d8, 0x1d8, 0xffffffff, 0xffffffff, 0x2f8, 0x2f8, 0x2f8, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11, 0x0, 0x44}, 0x0, 0xf0, 0x118, 0x0, {0x100000000000000}, [@common=@inet=@multiport={{0x50}, {0x0, 0xa, [0x4e23, 0x4e24, 0x4e21, 0x4e24, 0x4e22, 0x4e22, 0x4e20, 0x4e21, 0x4e21, 0x4e22, 0x4e22, 0x4e21, 0x4e20, 0x4e24, 0x4e21], [0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1]}}, @common=@unspec=@connmark={{0x30}}]}, @REJECT={0x28}}, {{@ip={@remote, @rand_addr=0x64010101, 0xff, 0xffffffff, 'veth0_to_bridge\x00', 'vlan1\x00', {0xff}, {0xff}, 0x1, 0x2, 0x10}, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {0xff}, 0x0, 0x1}, 0x0, 0xe0, 0x120, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x9, 0xfffffffd}}, @common=@socket0={{0x20}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000040)={0x9, 0x0, 0x4, 0xffffffffffffffff, 0x20})
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="bf16000000000000b7020000000000007b2af8ff000000007b2af0ff000000007b2ae8ff000000007b2ae0ff000000007b2ad8ff000000007b2ad0ff000000007b2ac8ff000000007b2ac0ff00000000b702000002000000732ac0ff00000000b702000001000000632ac4ff00000000180200000a0000010000000000000000632accff00000000180200000a0000020000000000000000632ac0ff00000000bf61000000000000bfa200000000000007020000c0ffffffb703000040000000b7040000000000008500000045000000b70000000200000095"], &(0x7f00000011c0)='GPL\x00', 0x1, 0x1000, &(0x7f0000001200)=""/4096, 0x40f00, 0x0, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002200)={r3, 0x0, 0xe, 0x0, &(0x7f0000002280)="00f1aef59e1ec05ab201a5859511", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-mkdirat-mount-openat-bpf$PROG_LOAD-syz_usb_connect$cdc_ncm-syz_usb_control_io$cdc_ncm-bpf$PROG_LOAD-syz_usb_control_io$cdc_ncm-syz_usb_control_io-syz_usb_control_io$cdc_ncm-bpf$MAP_CREATE-mprotect-sendmsg$BATADV_CMD_GET_MESH-syslog-bpf$MAP_UPDATE_ELEM_TAIL_CALL-ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS-bpf$ENABLE_STATS-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$KVM_CAP_X86_BUS_LOCK_EXIT-write
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/tracing/events/kvm/enable\x00', 0x1, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000070904000001020d0000052406000105240000000d240f0100000000000000000006241a00000809058103000200fe000904010001020d00000904010102020d00000905820200020942f9090503"], 0x0)
syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0xe, &(0x7f0000001300)=ANY=[@ANYBLOB="b7020000f53f6314bfa300000000000024020000fffeff7f7a0300fef0ffffff79a4f0ff00000000b7060000ffffffff2e640500000000007502faff07cd02020404000000247d60b7030000030a00006a0a00fe0000000c8500000032000000b70000000000002995000000000000001da5ad3548ebb63d18db6a1c7e821c9b767ac8308fbcd5c5e4a5ad1065b572c2c9ff215ac60c2ceaea4c0ec908abb6e7325ec1956bd8660bf3664148a2c96752fe2bb328dff1a15750ab9a780001000000000000d4bf20c2bd152d814f01f2cd519e078d4ffab418e4682b2aec5e4a35629e8ef040c50287c37a7f4182f32333b08c6e497687e10a4daea5cac0ceafdbb126eb02a1f5104d16ddb64963d84d91814cd5817e0b8f6f5e6ee7a39e180b5a18ed786b782ab1321ea5e82ae5ba2c42a5e23ea6253d5df768d0cb9f35e4f41a6211e52bb3598e9b5d4f22d8c19f958e8b34de35949a7a48ce18799ee53da177a81ea65e652c1d71b7ee86a75b0100000042127a8f84538a9a311c757f7169f006f3f5c95177fbd0b14b36259e2905ef911785c88a16aae46084d676d8ef8aa6ecc2d32e3f4ee367c5a769c0a606636c9f4a4413c098f4fcc96623b7c373b0ef04d55b846b094bf97e2ef5987b6e09a6a7cab79bffda141f65e7d9ebe3be70c436432b70a80cce69df30d3d67d84ccf3f9db9b690111de2ddc4b153c989ef100bbf76063d3f6ffffb73d70e9c3d7b90aecf48e7565efff2dbbb512218c98442406333c890923a797e00b75481739952fe87fde27ce81893f54ec0ea8e792414f639bc9ce1fea3f6ac0d7025759d4b45576c205c70631e8ad585951950e521f4e210b6494e3c52d927195737945cc03d5668483151710de246420a1b6c55b73876a6ed7fd0d9338923789a1edcd8043fe83919088383268324a25df14010c8ed6b8d43400eaa00ff9bc46e1cfecbdc0e451ac53b409d04544d3a7edd4d447d2fb431e226ae182b8dcc86fe09b404e0b7c723d3b19c3dc382fa91fb0fb8f9f3f13296bb1758b24aad0922091d49e2bc408a5a37deee7a60b903d2d9fe9d451cafcc8dc389671c2d08b6e264150a6b9445b00cee4585af04fa69e0380be0d66649dcf3bf8a906b029faca75ce34c41aec7aa86e596119109ea8b3f7c65c902499227c087301643baab1c95bb22cedd913b22dcaa197ccc34586dc50bd9f4628e3e77a0de32e356521df06f995cb57f97052fc4158250ccecfb67ea8faf509593fadc7eafb613327b052397af1ede94d87590ce90a0a7579766f7ec4fcd3cb0b1a8c531724d5ef6b334803cedaa9cedf16dc3af6e0b67f62a83a256474c97c925d9d447175b535c87dbdeb0dcca5303eed6689ea91e1665c691df736368dde47e6672e93a314c5f60e7b68c2242bd0f0d8c66449d8687dcf2d0f76668b2b9bf8b32b99b7daf34b2d825d192ade90a1162acfe9749d516d014cef5f99126324ea02baea5808c430985749901b09e4902a6f5addc0103756b894418e4591c624a9b206abbfb888d413d923b0d7c9d997d6d8e64787c4d397f57a15b6d5b4212b6cb55b9c207bbe08f483b1bea05f41b9a1d3af087047c568ae6ebfc0bb5ec10b6290dc757a4903a88fb2c035b2349b6d2f0c051b8b7718384eebd5fc19928cea713ff09e179c308fbe9bd64374d96ef2447a2a4af5ca0c39e7ca2e801e57560a55e9cfa095cf3f74398219ad1030a79517a88de7596429a20793e12616aa32b3e720c6521fbe93963e9536d16f3db211fca7dd99c0a0125ff8c18119a6926083f4a2c008a9f2a29e30823bf0ec3639cadaf9be9608358e1e5ab17eea477b1754f78f45468c9568471667f82f5e250b979b9f2bd0d1b6bc03d11811ac6eec9a3ecd9e3c3299ee5eb3c6cac8fbd06514b7ee743ece79c04566d02a08fd5fcabbab3d129c0cced3ce11dafa387a8077927a1ad367c114d0b423e64c6157fac5e4e2168f33541daeff9983d0e488a78bef538f870b84798272b2101e0abf1cd64500b79e01e11d727389653bd80a39d5bbe2e23d2f5ff10047423429981bd9b4ce680e174c266391e3e7689452654e5cd5ada6e025327a1942b5a068f15fa58eaa267d4e0881783dddbdd777f8be0824ffdf6d06c621880dbbe9534f15e8c2e364d3ec67deb6ab9f2a0f03212972dbd38500000008173553a67be48633103809eee0be51d67d7ce230b389607b4c3b18da1c48f3180f2e0d79e54565fdd9a099b5b5ba2761905b88b7cbfc39c35dd153609da3da263438f12769602c2195245ff83e249119d4f6cabfbdef84ada19ef4a67ed66d7043036515d0be5a231f99e71aba5d5ae04676eff3e85f0844c41bbcfde7a931d1ec55c01f703bfd1b97756bfe55a91f6b379f34a018906339771157c66dbd7471d1beec7f029ef552cf5e92a1a0db21b59355763967ce26a577bc514b6d22a09c385c5ba6caf524e1688fc0f20002b35ae7bc8eb5ba51aebdf7d972c3267cedbe77ed70d9c539bc455a6f88b39196c8a224b0acf4d796fea59a07baa34cc270fb096ef330fbebdf872d7d0bc4f9a963355c554abc5cdb91464faabcd09cd9a53f5d1b2ea7e96f428f7cd6735c19c61dc9942d30bf29ef85ed01c2fcd6060aa40eeff971477b4fde48507b7bad95a496540adff7e4a72fd1f94d7c703ab1525c946c54e0da3d7ebfcc8c367d1bfd1aea2e84c3b310aaea5a1627df898c00a9aaf2d88a36afa4c5b1816384310600001c33125ad7f7970beeb256aec06e39fc6c66544e1d1dc5fea4b68a82dc568ca30aea9a1d097f06f11dc362f4bae5ef57c67686a15855cd351bf26f40fb1348cfce79897682228e6d9643530c81bab27bf7b1c4a76a5be180bb830cf06827c3f38a9c9c580c732c30aaceda78b0297de35a922b1375b129655beb31899e26052cc216f832fdb0a0015f93c9cff77f59cda1ec5f3e358848756cebb074266a47e39ae26e80e8c65aaf73c24925458520a9ca98760d1005c9f81846459ae6d5baa4f02807939ddc29c3520f7c58ed9bc5a569c7a1bc33cf4f330a18276ffb4550b9166c3939e8041094bec034aa0ec6638b74fe34f0f1ec6903a1135808d5d8d26c9203c3f87e66c407b7c5c0888d4558dd657cc0213efad68e76fdd7b23e68064fd4b271ed79c50abacdd2871b0c1f8c971df59a5a1901ddf804bed43e391f882d2a45c51cdbba86b2a1b7c0c4923642a731ea4dcbad2b6ebbebe787a8e28e781d75beee924b3b1e390750f316648133922c021f98fd2d5d71a7a3679397ef6cf432837b7e264831ec01c4c3146ba0caac3b13d55945ec00e978a1c1712cd51187936200606c9cd6877b2f72125295c54721f8e15df2ae282a8becb99a726fd92acc92141e1f574b4b0b3c992a61af3372d0d9217776b1a42cd2cee816a70bf1ddd69b590d53e28ba356e74b38e23e50d898e95cdc7cc809e462c884b53f672aab1411ecfd4c91e7a9782fc6763f0efd4bcbaf1fc3a00000000000000000000000000000000000000000000000000000000048e510340087caf22439d5304bd704a6a78a512269a9b1cbd13bea78c807bbc73853ae187cbb768673e9d1bf74a3b0a6c234accd8506adf314f4c5e08174540b69d3c0da660052b43b86baf49e7ac6f09c21598b1e01dc1e1b5a53626b090496dbf7af441e397016c3c094d5c91ffe0a7ceacfd225ed9a6c905f79ad7052747dd6cceef4c310e0e935311118bc6bf0e5ca6c7cca7d5c03be570308da8a40578b4db14961fbccf6e2f2d56e9509c434126515b56d032e20c12e830d1bc64826fc9b318da5911e466878dbb81edeff69363fb75af5cd80536f14d2eaa7764db23acdbd394bbbbccf5e882602897a85bf8523d891080593d831d758deb4f2c7e49c6d6b35d8fd92601c8500febb0c5fe0be294bf6bbbecad444695277a9e3992a354492513b43091d161c7c7cdbbe44e8e83b4cf333238a52f214b278c6485236ea880db2f113f6381187679a4620d6149808b0af024b3b3e6ba99b4b15ca"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x3}, 0x0, 0x10, &(0x7f0000000080)={0x0, 0x0, 0x4, 0xfffffffc}, 0x143}, 0x31)
syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000a40)={0x84, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a000000070000000080000001"], 0x50)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9)
sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, 0x0, 0x0)
syslog(0x4, &(0x7f0000000000)=""/19, 0xb12288e90d7c8384)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r2, <r3=>0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20)
ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r0, 0xc080661a, &(0x7f0000000380)={@desc={0x1, 0x0, @desc1}})
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000d0039000000000000b4a518110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(0xffffffffffffffff, 0x4068aea3, &(0x7f00000004c0)={0xc1, 0x0, 0x5})
write(r0, &(0x7f0000000140)='1', 0x1)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-socket$inet6_tcp-dup-ioctl$SIOCSIFHWADDR-write$tun-syz_mount_image$ext4
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = dup(r1)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000100)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}})
write$tun(r0, &(0x7f0000000300)={@val={0x0, 0x9}, @void, @eth={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x14}, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x16, 0x14, 0x67, 0x0, 0x7, 0x11, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3d}}}}}}}, 0x26)
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10008, &(0x7f0000000440)={[{@sb={'sb', 0x3d, 0x4}}, {@commit={'commit', 0x3d, 0x3}}]}, 0xff, 0x49e, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvbH/Qyo9WRBQEraCR+KOlBZWDBzSaeNDERA94rG1BZKGG1gRIo8UYPBoS78ajiX+BNy9GPRgTr5p4NCREe6F4qpmdGbpsd0u3tF3pfj7Jdt/bmd33vjPv7b6Z15kA2tZA+ieJ2BYRv0dEX5a9fYWB7Gl+bmbs5tzMWBILC2//nVTWuzE3M1asWrxva545VIoofZbE8WRpuVMXL50ZLZcnzuf5oemzHw5NXbz03Omzo6cmTk2cGzl27OiR4RdfGHl+TeJM47qx9+PJfXtef/fqm2Mnrr7307dptXbvz5ZXx3FHN+sEVMdAutX+WaioXfZkE3W/F2yvSiedLawITemIiHR3dVX6f190xOLO64vXPm1p5YB1lf42bWm8eHYB2MSSaHUNgNYofujT49/isUFDj/+F6y9HdOfp+bmZsflb8XdGKX+9ax3LH4iIE7P/fpU+otnzEAAAq1AZ2zxbb/xXit2V52yuY0c+h9IfEfdHxM6IeCAidkXEgxGVdR+KiIezNy/0rbD8gZr80vFP6VrdOq+RdPz3UtXYb74q/vypvyPPba/E35WcPF2eOJxvk0PRtSXNDy9Txvev/vZFo2XV47/0kZZfjAXzClzrrDlBNz46PbpWG+H65Yi9nfXiT27NBKQtYE9E7G3uo3cUidNPf7Ov0Up3jn8ZazDPtPB1xFPZ/p+NmvgLyfLzk0M9UZ44PFS0iqV+/vXKW43Kv6v418D1A49kicX9X7NGVUMrlyfOTzVfxpU/Pm94TLPa9t+dvFOZs/7l/ey1C6PT0+eHI7qTNyr54piu8vrI4nsvjE73pvli/bT9HzpYv//vzN+T7v90K6WNeH9EPBoRj+V1fzwiDkTEwWXi//GVJz5YJv4kkmjd/r8cMV73++9W++9PqufrV5HoOPPDd41mzFe2/4/GbOW7NlP5/ruDlVbwLjcfAAAA3BNKEbEtktJglh7YFqXS4GD2P/y74r5SeXJq+pmTkx+dG8+uEeiPrlJxpquv6nzocDKbf2KWH8nPFRfLj+Tnjb/s6K3kB8cmy+Mtjh3a3dbb+38U/T/1V0erawesO9drQfuq7f+lFtUD2Hgr+f13LACb0+39vyf909uqugAby/E/tK96/f+TmrzxP2xOS/v/n3VuWQdsRsb/0L70f2hf+j+0pWYu54/jjRb1REQztwUoLhZY/V0FelZ8hX+7JIo7XqxnWb1x6Ux3/kqUWhRpR5ONbVMk0h6zsYUu3kMFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgXvZfAAAA//8hId5P")

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_add_vcpu$x86-syz_usb_connect$uac3-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_IRQCHIP-socket$can_bcm-connect$can_bcm-sendmsg$can_bcm-sendmsg$can_bcm-close-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_VCPU_EVENTS-ioctl$KVM_RUN-ioctl$KVM_SET_MSRS
detailed listing:
executing program 0:
syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000640)={0x0, &(0x7f00000000c0)=[@wr_drn={0x68, 0x20, {0x1, 0x9}}, @rdmsr={0x66, 0x18, {0x8f4}}, @nested_amd_stgi={0x17e, 0x10}, @code={0xa, 0x56, {"66baa00066ed490fc76d093e410fc77b0ef466ba430066edc481797eb7060000000f01cbf2400fc2030a440f20c0350b000000440f22c0b9800000c00f3235000400000f30"}}, @nested_amd_inject_event={0x180, 0x38, {0x0, 0x12, 0x8, 0x1}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x3, @control_area=0xc, 0xa, 0x10, 0xb6}}, @code={0xa, 0x65, {"440f20c03508000000440f22c02ef23636420f0173672e400f01c3c4a3796030448468002667450f01c33d2d960000c744240000000000c744240200000000c7442406000000000f011c24c4c28908d136f20f07"}}, @enable_nested={0x12c, 0x18}, @in_dx={0x69, 0x20, {0x5f42, 0x2}}, @code={0xa, 0x5a, {"b9800000c00f3235008000000f30490f38f63c6ef2650f01f1b9bd020000b879750000ba000000000f30f20f21e82e0fc7a7cc00000066ba2100b0c4ee460fc71ff30fc733f343e008"}}, @nested_load_syzos={0x136, 0x82, {0x3, 0x2, [@nested_load_code={0x12e, 0x62, {0x2, "b805000000b9000000000f01d966baa100ec66baf80cb884af6284ef66bafc0cedc4c10d14f964f390c4414e5f1a0f20e035000100000f22e0410f2147450f0766420f38823500000000"}}]}}], 0x287})
syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000280)=ANY=[@ANYBLOB="12015002000000088205820540000102030109026e00030108a003080b0002010130040904003f0000010130000a24010e0a00010000000904010000010230000904010101010230000905010900000700050a25256ce500007d08000904020000010230000904020101010230000905820910000807400a2525000020010c1e"], 0x0) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x121002, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async)
r2 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r2, &(0x7f0000000180), 0x10) (async)
sendmsg$can_bcm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="05000000d8000001118006b05c6a8ce2", @ANYRES64, @ANYRES64=0x2710, @ANYRES64=r2, @ANYRES64=0x0, @ANYBLOB="00000080"], 0x48}, 0x1, 0x0, 0x0, 0x50}, 0x0)
sendmsg$can_bcm(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x5, 0x9c2, 0x0, {}, {0x77359400}, {0x0, 0x0, 0x0, 0x1}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "cb7d302847bb1a28e8a4004b789607ed47df355645f2178a039ed508ff76df3536741848cc6cb65c6e77aad714472cb8856fcdd536f9d9655dcf800549436e96"}}, 0x80}}, 0x800) (async)
close(0x3)
r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@arm64={0xf2, 0x5, 0x0, '\x00', 0x8001}) (async)
ioctl$KVM_RUN(r3, 0xae80, 0x0) (async)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0x40000070, 0x0, 0x6}]})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mkdir-mount$incfs-chdir-chmod-sendmsg$nl_route_sched-openat$tun-close-socket$nl_route-ioctl$SIOCSIFHWADDR-socket$packet-ioctl$sock_SIOCGIFINDEX-sendto$packet-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r4 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)
chdir(&(0x7f00000003c0)='./bus\x00')
chmod(&(0x7f0000000140)='./file1\x00', 0x2a)
sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@deltclass={0x54, 0x29, 0x20, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff3}, {0xfff1, 0xc}, {0xfff1, 0xb}}, [@tclass_kind_options=@c_red={0x8}, @tclass_kind_options=@c_drr={{0x8}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x10000}}}, @TCA_RATE={0x6, 0x5, {0xb3, 0x9}}, @tclass_kind_options=@c_taprio={0xb}]}, 0x54}, 0x1, 0x0, 0x0, 0x240040e0}, 0x20004884)
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r6)
socket$nl_route(0x10, 0x3, 0x0)
ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r7 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', <r8=>0x0})
sendto$packet(r7, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r8, 0x1, 0x0, 0x6, @multicast}, 0x14)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
single: successfully extracted reproducer
found reproducer with 30 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mkdir-mount$incfs-chdir-chmod-sendmsg$nl_route_sched-openat$tun-close-socket$nl_route-ioctl$SIOCSIFHWADDR-socket$packet-ioctl$sock_SIOCGIFINDEX-sendto$packet
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)
chdir(&(0x7f00000003c0)='./bus\x00')
chmod(&(0x7f0000000140)='./file1\x00', 0x2a)
sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@deltclass={0x54, 0x29, 0x20, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff3}, {0xfff1, 0xc}, {0xfff1, 0xb}}, [@tclass_kind_options=@c_red={0x8}, @tclass_kind_options=@c_drr={{0x8}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x10000}}}, @TCA_RATE={0x6, 0x5, {0xb3, 0x9}}, @tclass_kind_options=@c_taprio={0xb}]}, 0x54}, 0x1, 0x0, 0x0, 0x240040e0}, 0x20004884)
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r5)
socket$nl_route(0x10, 0x3, 0x0)
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r6 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', <r7=>0x0})
sendto$packet(r6, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r7, 0x1, 0x0, 0x6, @multicast}, 0x14)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mkdir-mount$incfs-chdir-chmod-sendmsg$nl_route_sched-openat$tun-close-socket$nl_route-ioctl$SIOCSIFHWADDR-socket$packet-ioctl$sock_SIOCGIFINDEX
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)
chdir(&(0x7f00000003c0)='./bus\x00')
chmod(&(0x7f0000000140)='./file1\x00', 0x2a)
sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@deltclass={0x54, 0x29, 0x20, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff3}, {0xfff1, 0xc}, {0xfff1, 0xb}}, [@tclass_kind_options=@c_red={0x8}, @tclass_kind_options=@c_drr={{0x8}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x10000}}}, @TCA_RATE={0x6, 0x5, {0xb3, 0x9}}, @tclass_kind_options=@c_taprio={0xb}]}, 0x54}, 0x1, 0x0, 0x0, 0x240040e0}, 0x20004884)
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r5)
socket$nl_route(0x10, 0x3, 0x0)
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r6 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'syzkaller0\x00'})

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mkdir-mount$incfs-chdir-chmod-sendmsg$nl_route_sched-openat$tun-close-socket$nl_route-ioctl$SIOCSIFHWADDR-socket$packet
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)
chdir(&(0x7f00000003c0)='./bus\x00')
chmod(&(0x7f0000000140)='./file1\x00', 0x2a)
sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@deltclass={0x54, 0x29, 0x20, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff3}, {0xfff1, 0xc}, {0xfff1, 0xb}}, [@tclass_kind_options=@c_red={0x8}, @tclass_kind_options=@c_drr={{0x8}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x10000}}}, @TCA_RATE={0x6, 0x5, {0xb3, 0x9}}, @tclass_kind_options=@c_taprio={0xb}]}, 0x54}, 0x1, 0x0, 0x0, 0x240040e0}, 0x20004884)
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r5)
socket$nl_route(0x10, 0x3, 0x0)
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
socket$packet(0x11, 0x3, 0x300)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mkdir-mount$incfs-chdir-chmod-sendmsg$nl_route_sched-openat$tun-close-socket$nl_route-ioctl$SIOCSIFHWADDR
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)
chdir(&(0x7f00000003c0)='./bus\x00')
chmod(&(0x7f0000000140)='./file1\x00', 0x2a)
sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@deltclass={0x54, 0x29, 0x20, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff3}, {0xfff1, 0xc}, {0xfff1, 0xb}}, [@tclass_kind_options=@c_red={0x8}, @tclass_kind_options=@c_drr={{0x8}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x10000}}}, @TCA_RATE={0x6, 0x5, {0xb3, 0x9}}, @tclass_kind_options=@c_taprio={0xb}]}, 0x54}, 0x1, 0x0, 0x0, 0x240040e0}, 0x20004884)
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r5)
socket$nl_route(0x10, 0x3, 0x0)
ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mkdir-mount$incfs-chdir-chmod-sendmsg$nl_route_sched-openat$tun-close-socket$nl_route
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)
chdir(&(0x7f00000003c0)='./bus\x00')
chmod(&(0x7f0000000140)='./file1\x00', 0x2a)
sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@deltclass={0x54, 0x29, 0x20, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff3}, {0xfff1, 0xc}, {0xfff1, 0xb}}, [@tclass_kind_options=@c_red={0x8}, @tclass_kind_options=@c_drr={{0x8}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x10000}}}, @TCA_RATE={0x6, 0x5, {0xb3, 0x9}}, @tclass_kind_options=@c_taprio={0xb}]}, 0x54}, 0x1, 0x0, 0x0, 0x240040e0}, 0x20004884)
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r5)
socket$nl_route(0x10, 0x3, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mkdir-mount$incfs-chdir-chmod-sendmsg$nl_route_sched-openat$tun-close
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)
chdir(&(0x7f00000003c0)='./bus\x00')
chmod(&(0x7f0000000140)='./file1\x00', 0x2a)
sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@deltclass={0x54, 0x29, 0x20, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff3}, {0xfff1, 0xc}, {0xfff1, 0xb}}, [@tclass_kind_options=@c_red={0x8}, @tclass_kind_options=@c_drr={{0x8}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x10000}}}, @TCA_RATE={0x6, 0x5, {0xb3, 0x9}}, @tclass_kind_options=@c_taprio={0xb}]}, 0x54}, 0x1, 0x0, 0x0, 0x240040e0}, 0x20004884)
r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r5)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mkdir-mount$incfs-chdir-chmod-sendmsg$nl_route_sched-openat$tun
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)
chdir(&(0x7f00000003c0)='./bus\x00')
chmod(&(0x7f0000000140)='./file1\x00', 0x2a)
sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@deltclass={0x54, 0x29, 0x20, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff3}, {0xfff1, 0xc}, {0xfff1, 0xb}}, [@tclass_kind_options=@c_red={0x8}, @tclass_kind_options=@c_drr={{0x8}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x10000}}}, @TCA_RATE={0x6, 0x5, {0xb3, 0x9}}, @tclass_kind_options=@c_taprio={0xb}]}, 0x54}, 0x1, 0x0, 0x0, 0x240040e0}, 0x20004884)
openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mkdir-mount$incfs-chdir-chmod-sendmsg$nl_route_sched
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)
chdir(&(0x7f00000003c0)='./bus\x00')
chmod(&(0x7f0000000140)='./file1\x00', 0x2a)
sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@deltclass={0x54, 0x29, 0x20, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff3}, {0xfff1, 0xc}, {0xfff1, 0xb}}, [@tclass_kind_options=@c_red={0x8}, @tclass_kind_options=@c_drr={{0x8}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x10000}}}, @TCA_RATE={0x6, 0x5, {0xb3, 0x9}}, @tclass_kind_options=@c_taprio={0xb}]}, 0x54}, 0x1, 0x0, 0x0, 0x240040e0}, 0x20004884)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mkdir-mount$incfs-chdir-chmod
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)
chdir(&(0x7f00000003c0)='./bus\x00')
chmod(&(0x7f0000000140)='./file1\x00', 0x2a)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mkdir-mount$incfs-chdir
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)
chdir(&(0x7f00000003c0)='./bus\x00')

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mkdir
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-open-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
open(&(0x7f0000000100)='./file1\x00', 0x14b042, 0x8c)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x10, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6363, 0x6, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-ioctl$sock_SIOCGIFINDEX-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-socket$nl_route-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
socket$nl_route(0x10, 0x3, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-ioctl$TUNSETIFF-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$tun-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, &(0x7f0000000040)='GPL\x00', 0x10000003, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x9}, 0x94)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-openat$kvm-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-madvise-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-preadv2-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
r1 = open(0x0, 0x0, 0xe898d2275f586838)
preadv2(r1, 0x0, 0x0, 0x8000, 0x9, 0x1b)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-open-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
open(0x0, 0x0, 0xe898d2275f586838)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mount$9p_fd-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mount$9p_fd(0x0, 0x0, 0x0, 0x8, 0x0)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-close-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
close(0x3)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-setsockopt$SO_TIMESTAMP-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000040)=0x6, 0x4)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-setsockopt$packet_tx_ring-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000480)=@req3={0x10001, 0x446, 0x9, 0x6, 0x5, 0x1, 0x4}, 0x1c)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-socket$packet-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
socket$packet(0x11, 0x2, 0x300)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_SET_MSRS-mkdir-mount$incfs
detailed listing:
executing program 0:
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]})
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(0x0, 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(0x0, &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', 0x0, &(0x7f0000000840), 0x1804002, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', 0x0, 0x1804002, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program did not crash
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program did not crash
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program did not crash
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs
detailed listing:
executing program 0:
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1804002, 0x0)

program crashed: KASAN: null-ptr-deref Write in vfs_rmdir
validation run: crashed=true
reproducing took 1h2m48.908037823s
repro crashed as (corrupted=false):
RBP: 00007fff1755af50 R08: 00007fff1755bf50 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff1755bfe0
R13: 00007f132a77848b R14: 0000000000008fc3 R15: 00007fff1755c020
 </TASK>
---[ end trace 57e97a7b87e3572a ]---
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:188 [inline]
BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:454
Write of size 4 at addr 0000000000000170 by task syz-executor/367

CPU: 1 PID: 367 Comm: syz-executor Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 __kasan_report mm/kasan/report.c:431 [inline]
 kasan_report+0xcc/0x150 mm/kasan/report.c:444
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_inc_return include/linux/atomic/atomic-instrumented.h:188 [inline]
 ihold+0x20/0x60 fs/inode.c:454
 d_delete_notify include/linux/fsnotify.h:275 [inline]
 vfs_rmdir+0x23d/0x450 fs/namei.c:4170
 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1989
 deactivate_locked_super+0xa0/0x100 fs/super.c:335
 deactivate_super+0xaf/0xe0 fs/super.c:366
 cleanup_mnt+0x44f/0x500 fs/namespace.c:1149
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1156
 task_work_run+0x127/0x190 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f132a6e3397
Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff1755ae98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f132a6e3397
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff1755af50
RBP: 00007fff1755af50 R08: 00007fff1755bf50 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff1755bfe0
R13: 00007f132a77848b R14: 0000000000008fc3 R15: 00007fff1755c020
 </TASK>
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000170
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 12cf49067 P4D 12cf49067 PUD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 367 Comm: syz-executor Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:370 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:189 [inline]
RIP: 0010:ihold+0x26/0x60 fs/inode.c:454
Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 91 8a b2 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 80 02 f2 ff 41 be 01 00 00 00 <f0> 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 11
RSP: 0018:ffffc90001f67d10 EFLAGS: 00010246
RAX: ffff888110c94f00 RBX: 0000000000000000 RCX: ffff888110c94f00
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc90001f67d20 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e18e4c R12: 1ffff11021a3226c
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  000055555e372500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 000000010f7c3000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 d_delete_notify include/linux/fsnotify.h:275 [inline]
 vfs_rmdir+0x23d/0x450 fs/namei.c:4170
 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1989
 deactivate_locked_super+0xa0/0x100 fs/super.c:335
 deactivate_super+0xaf/0xe0 fs/super.c:366
 cleanup_mnt+0x44f/0x500 fs/namespace.c:1149
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1156
 task_work_run+0x127/0x190 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f132a6e3397
Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff1755ae98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f132a6e3397
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff1755af50
RBP: 00007fff1755af50 R08: 00007fff1755bf50 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff1755bfe0
R13: 00007f132a77848b R14: 0000000000008fc3 R15: 00007fff1755c020
 </TASK>
Modules linked in:
CR2: 0000000000000170
---[ end trace 57e97a7b87e3572b ]---
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:370 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:189 [inline]
RIP: 0010:ihold+0x26/0x60 fs/inode.c:454
Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 91 8a b2 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 80 02 f2 ff 41 be 01 00 00 00 <f0> 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 11
RSP: 0018:ffffc90001f67d10 EFLAGS: 00010246
RAX: ffff888110c94f00 RBX: 0000000000000000 RCX: ffff888110c94f00
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc90001f67d20 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e18e4c R12: 1ffff11021a3226c
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  000055555e372500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 000000010f7c3000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 00                	add    %al,(%rax)
   4:	55                   	push   %rbp
   5:	48 89 e5             	mov    %rsp,%rbp
   8:	41 56                	push   %r14
   a:	53                   	push   %rbx
   b:	48 89 fb             	mov    %rdi,%rbx
   e:	e8 91 8a b2 ff       	call   0xffb28aa4
  13:	48 8d bb 70 01 00 00 	lea    0x170(%rbx),%rdi
  1a:	be 04 00 00 00       	mov    $0x4,%esi
  1f:	e8 80 02 f2 ff       	call   0xfff202a4
  24:	41 be 01 00 00 00    	mov    $0x1,%r14d
* 2a:	f0 44 0f c1 b3 70 01 	lock xadd %r14d,0x170(%rbx) <-- trapping instruction
  31:	00 00
  33:	41 ff c6             	inc    %r14d
  36:	bf 02 00 00 00       	mov    $0x2,%edi
  3b:	44 89 f6             	mov    %r14d,%esi
  3e:	e8                   	.byte 0xe8
  3f:	11                   	.byte 0x11

final repro crashed as (corrupted=false):
RBP: 00007fff1755af50 R08: 00007fff1755bf50 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff1755bfe0
R13: 00007f132a77848b R14: 0000000000008fc3 R15: 00007fff1755c020
 </TASK>
---[ end trace 57e97a7b87e3572a ]---
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:188 [inline]
BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:454
Write of size 4 at addr 0000000000000170 by task syz-executor/367

CPU: 1 PID: 367 Comm: syz-executor Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 __kasan_report mm/kasan/report.c:431 [inline]
 kasan_report+0xcc/0x150 mm/kasan/report.c:444
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic_inc_return include/linux/atomic/atomic-instrumented.h:188 [inline]
 ihold+0x20/0x60 fs/inode.c:454
 d_delete_notify include/linux/fsnotify.h:275 [inline]
 vfs_rmdir+0x23d/0x450 fs/namei.c:4170
 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1989
 deactivate_locked_super+0xa0/0x100 fs/super.c:335
 deactivate_super+0xaf/0xe0 fs/super.c:366
 cleanup_mnt+0x44f/0x500 fs/namespace.c:1149
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1156
 task_work_run+0x127/0x190 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f132a6e3397
Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff1755ae98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f132a6e3397
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff1755af50
RBP: 00007fff1755af50 R08: 00007fff1755bf50 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff1755bfe0
R13: 00007f132a77848b R14: 0000000000008fc3 R15: 00007fff1755c020
 </TASK>
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000170
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 12cf49067 P4D 12cf49067 PUD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 367 Comm: syz-executor Tainted: G    B   W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:370 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:189 [inline]
RIP: 0010:ihold+0x26/0x60 fs/inode.c:454
Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 91 8a b2 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 80 02 f2 ff 41 be 01 00 00 00 <f0> 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 11
RSP: 0018:ffffc90001f67d10 EFLAGS: 00010246
RAX: ffff888110c94f00 RBX: 0000000000000000 RCX: ffff888110c94f00
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc90001f67d20 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e18e4c R12: 1ffff11021a3226c
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  000055555e372500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 000000010f7c3000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 d_delete_notify include/linux/fsnotify.h:275 [inline]
 vfs_rmdir+0x23d/0x450 fs/namei.c:4170
 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1989
 deactivate_locked_super+0xa0/0x100 fs/super.c:335
 deactivate_super+0xaf/0xe0 fs/super.c:366
 cleanup_mnt+0x44f/0x500 fs/namespace.c:1149
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1156
 task_work_run+0x127/0x190 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f132a6e3397
Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fff1755ae98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f132a6e3397
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff1755af50
RBP: 00007fff1755af50 R08: 00007fff1755bf50 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff1755bfe0
R13: 00007f132a77848b R14: 0000000000008fc3 R15: 00007fff1755c020
 </TASK>
Modules linked in:
CR2: 0000000000000170
---[ end trace 57e97a7b87e3572b ]---
RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:370 [inline]
RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:189 [inline]
RIP: 0010:ihold+0x26/0x60 fs/inode.c:454
Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 91 8a b2 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 80 02 f2 ff 41 be 01 00 00 00 <f0> 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 11
RSP: 0018:ffffc90001f67d10 EFLAGS: 00010246
RAX: ffff888110c94f00 RBX: 0000000000000000 RCX: ffff888110c94f00
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc90001f67d20 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0e18e4c R12: 1ffff11021a3226c
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
FS:  000055555e372500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 000000010f7c3000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 00                	add    %al,(%rax)
   4:	55                   	push   %rbp
   5:	48 89 e5             	mov    %rsp,%rbp
   8:	41 56                	push   %r14
   a:	53                   	push   %rbx
   b:	48 89 fb             	mov    %rdi,%rbx
   e:	e8 91 8a b2 ff       	call   0xffb28aa4
  13:	48 8d bb 70 01 00 00 	lea    0x170(%rbx),%rdi
  1a:	be 04 00 00 00       	mov    $0x4,%esi
  1f:	e8 80 02 f2 ff       	call   0xfff202a4
  24:	41 be 01 00 00 00    	mov    $0x1,%r14d
* 2a:	f0 44 0f c1 b3 70 01 	lock xadd %r14d,0x170(%rbx) <-- trapping instruction
  31:	00 00
  33:	41 ff c6             	inc    %r14d
  36:	bf 02 00 00 00       	mov    $0x2,%edi
  3b:	44 89 f6             	mov    %r14d,%esi
  3e:	e8                   	.byte 0xe8
  3f:	11                   	.byte 0x11