Extracting prog: 4m7.074110942s Minimizing prog: 30m53.105915802s Simplifying prog options: 0s Extracting C: 25.283316153s Simplifying C: 11m34.299106682s extracting reproducer from 58 programs testing a last program of every proc single: executing 13 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-ioctl$VHOST_SET_VRING_BASE-ioctl$VHOST_SET_VRING_ADDR-ioctl$VHOST_SET_VRING_ADDR-ioctl$VHOST_SET_MEM_TABLE-ioctl$VHOST_VSOCK_SET_RUNNING-ioctl$BTRFS_IOC_SUBVOL_GETFLAGS-write-write-futimesat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/smt/control\x00', 0x1, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f00000001c0)={0x1, 0x0, 0x0, &(0x7f0000000400)=""/71, 0x0, 0xeeee8000}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000280)={0x0, 0x1, 0x0, &(0x7f0000000480)=""/95, 0x0, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000500)) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(0xffffffffffffffff, 0x4008af04, &(0x7f0000000040)) write(r0, &(0x7f0000000140)='off', 0x3) write(r0, &(0x7f0000000180)='on', 0x2) futimesat(r0, &(0x7f0000000080)='./sys/devices/system/cpu/smt/control\x00', &(0x7f00000001c0)={{0x0, 0x2710}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-sendmsg$nl_generic-socket$nl_netfilter-bpf$MAP_CREATE-socket$inet_tcp-listen-bpf$MAP_UPDATE_ELEM-bpf$MAP_GET_NEXT_KEY-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-sendmsg$inet-socketpair$unix-setsockopt$SO_ATTACH_FILTER-sendmsg$IPCTNL_MSG_EXP_DELETE detailed listing: executing program 0: syz_usb_connect(0x1, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010d0000000708b5192100c7980000000109021b00022000ac0009040000010700000909"], 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a00000006000100"], 0x1c}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="12000000580000000400000003"], 0x50) r2 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000580)={r1, &(0x7f0000000480), &(0x7f0000000540)=@tcp=r2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000240)={r1, &(0x7f0000000040)="bb987e", &(0x7f0000000080)=""/169}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0xfffffffd}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003b00)={&(0x7f0000000280)={0x2, 0x4e22, @local}, 0x10, &(0x7f0000003a40)=[{&(0x7f00000002c0)="ce013920202e524442ad031465b03adb224b2864057e9193edb8f9aa1caaf1a5886db54a80d38febdba2344d90142334de2694094350babc1d754d1a05ecb137a77cbf65f4ef3c8cca3b23b2a6dbb05b22ddae35fc7050403ad808a3e30394c1e85aaaab996d334c27d52a2730f1fa60867d2e90a50d378aad0ea13d61bfe9614661983075981c716bd26489403fb8cbf9b9f2ea72a8c80e9f4af8040a2849111ca1d47999c5c2c6bc7c1b7645c093122a6af7af018ce287634d38975a405cca77e105b48dda9331d7d4c842092d3395f97f5f03", 0xd4}, {&(0x7f0000000680)="bc32b962e73d8c551fc81e3de32784a68c5a781b36c014b51c9b019c88e1eba292cec9ac631e65b52cceb0912c743c111ed03c667872ea8ce21fac86c190e5e2061fdae9a56518989d51fa396e7abf04f52b3b9024acc419f99833ae99b3ba09deec8947087ba964de7425140676ab2f3f81e94140045b1607bdddcdbb6dbc05e728987e3fcf9126ebec4074cb0ae8569f053e6b5bec5bd3e1b6ac581f18a4bedc3f65fcc3f365b773f6b52e9ada776a14057d3a08776c28819406e670500d97a9a2f01dc21e5901923cc0fa84b86ca3", 0xd0}, {&(0x7f0000000780)="83d9fbfef0735876203823488c4c3432b05703e5a1de54a8a5fb5b7de7fb4fed64ca403af7b5130c72ee8253ff74cd5e64617d20f1e39e9ca084dfdea0bd8f72c4f8b10138727075e19b8b57857b7260ea2b9c66d67b7daa8b964b567721efc940ce7a8327bac74d5c4d0cd55b664236375cb6cab80799e5", 0x78}, {&(0x7f0000000800)="f5aa71e674223411cb5534e24777d15f919f0f6c9eb257ed38ef67aed674fd98967eca467df6f152d62ce49972bd3a49a7bd45d1f9407be1552fe409f6fe", 0x3e}, {&(0x7f0000000840)="0048942cace3f0096c483614a5794a9b7c4458fee98805dd005b4e6cf6d8f3a7909a7f74b38cd8179a959a8abf72eb9534888a529840f528a4d0fd536cdb5f8d9962e4c5a3c49ecfb5246febf6f6f409acddddf61b67dc8fbfd9ce0222baa65694b4215f59e149fd45285b83384a089307950af02ac589299b3d16ac3ce7869ec46b4732e8a4a036ecea9c9187132da8ec40078876cf21fb12551344ee7b614d1e41f78ed630ec2f7901e675598c232dddda6f28609a0ed74d9e9ccd02ea27a0", 0xc0}, {&(0x7f0000000b00)="0b79418aea60b287f8e91cca0eb2dd2a485c60c067eb1d521f2b9f56051efa8788d5726ba3548b694a5e55e83b284c94f3e015570803fa942a9e31765ac58e823772b2666e384f9190b88ed3ccc620227dd212fc89a7bd4270831f394e91a77fe922954d1fd6998efd05aa92fc857c23c77d2f363df50fbbae91351e1bd5b571cc939c9b0b3061aecb0fd9976574c2fa63057355c4bba165e3b601df4aa9b21c495207c2af70768526223a5f6433d41a1e234d4700713bde8a1e13c272a70d1345f9a232b2aa3044fd1c8df51e47675b64f506fea2c828ab9715407fd0acdab88b6172cd116f6bcb347d11c3ed995274a8e5da158e0dcdaa8b70b50a0b292cc7d3f2a1d4068d61ab0ebc843d2714d5919f6cf6617bcdfe4f287cc8fb6bcb4250ef410e61f9d95b9233bab7f6db81915a72b371d8421ed235f5e1aaab5f5c1815d4c15b987ec3ca48f178ab07d1c008c4ba94297d1f75d135f390f6847e3dad9544b2e3dd51bd8905ba41e2b1d85efd46314010ce3c87846f03fa9d4010c6ccfa19b8cf0562218f8278e9dadcdb61a6afb24875f2cbf03a58acb9fa9a98ad08eea746f67dc10df1b60a5d019d5c8e02b105d157e5c30abfe27cfe16e1effeb348cdabfb64e1960cc69dfc09a8f6fa325fab85eecbd683a884b0d87c1b8e802c2dff2993d6b3c63813a28e09492cae89d1d4f33d028dea3d6eeeee236857a2bbb2cd892ed85bb66951e3d6784812a0341df2997cca7043a40de8f6432302925b0779430d2d4e666a8fd63ba970e7abd3cac7be620a744feda080ae1b05141d791f31a2a0a0514404478f8204d8893acb40766fd033e61d5f974adc9f4b0e04fb133dfb1e13ddd1fdca1e105b05365c68f6f1a4734ac96e0fa9305a97e8cfd3e5861ca3abb423c7f1cfce58e3d8695d5bc0db2f10d7085cb6b920a95f34a26ae3de2164aee32a1b81ca113a8cc661b9d086c0b94280247e50623a29964f2e030debd39b1e77bb5d99bce7269112676c227bc5fde1395af151bb58d31a257eac6cfef34821fafb383174948a70e28f517a8f33727e5891542b1bcaa36d53f3decad224dcb6ed73036f6390284d889c2cbcd9d51bd02e4a9795f36ff698eaf01fb4791695cb2e75a088a12a75ec616b69eec0fd8041aff5761102a516ba7a1dc2635f2c3a8b7379df1b211e9271099e679122040cb72eae1fee90b8448c0f01b5019f321743d6c047c86e54cf1ac660e4959a80345d9ae1dc202547e60bc6d078ac583700066c2425004363e8517369602e573a8d7ceed2f5fde6b07904423581732f8136c88e9ad3a5a831ccb030f5aa2e9e724ae2cd59fc50745b08be0a040e4e1438a497943dae840ba31cda6fad2c4a3f2be4695bfe40cd9cb78566a2d934673c339502435ae973c9a433b0f686245b1e47683aecea3691dd2d8e24098f983f21d62aef3f65830b3579cb40c9e2f58fcfa47bc179f833e5eb62a70a3d874f748a85d17fb2c4565e32ef799f8fe5237f60fe0560a2b21e25387aa6907ae19797ede99056f4762d8ab390ae60e628a79437526a3c185db64d090f41fac9ab5a195eab32e413e41770d166308d9eaf36d3f438aee2b41a6554b06597f21c59bcec0fde8d61ab004b6bf760f157f371a44374169a0a7abc11c581f17eed6590e37f5ffada2ece32d73d8c68b4518d7d00c1e99e516aaeabfa6bef84d118bf35f0be6c99915dbf9f56c66e85b60df4676c0540b9abef60034d57b5653b04a94293b266e2d7988c23ef0f9cf59a5ecfff34f4426b436d0ba011a39473036853606a037c83f64c65076c01a217b95486c2601f00db19aa14beb5e5455e101b6fcdf0e1636ac2f37cd791efcd12f3b971aaa9ca3a87660adaa41611b606099e1d3b522272a820005cdae392b9c3eb8820cc5c26ca6068e8e749a1495557fe0254c5f27ab8140857af1ccd19de325dca97f56834ef7a7c612eaa790ae0c7ff1b7dbd64afea8903dd5754a2067e2651f85d86487de98f203d5622124d100e1b6b74b6d40370aea20d8359d733e31363888ccd2105846cb208ddee2068f6d1f5c453437ea0f400e2282bf67468bfbf9e9879a4cb8b3ea0f62c3f9bc07c0e55907cdd6d14c43c40bf1813850490bb9db6af6e0a70ebecf45ec66b8220d6c015fadd94517264757934d208df45b9d56124345dfe8e0876c765c4a56157e15caad6c45895117458a472ade8c343c08962397fc99b182f0d47d41ef1bda42da753789693a611e6fecf8aaa65c418e0b5e9b7ff2442977069dbe30cea926cc0bf47e8f418b90b7efcf44fa84e6a55d7c22197c8e44954c21e34d5824fe201b97c853c9a52e66af3b9c0f92f268509acf959678e01a13dc4aeefe9a68f7679db8125b6ccdaf51d366779e614b384acc6ddbf6f02941b4a0c55daebbb6b39a7e142250e2c33e6e680b1b751c5ecf45ff2cf265f9474891673d8a3e29643904b25cd56b1bbf13590da69cb01a22d8a07b7dcffac83ee81b188dbd64a39d5254b85823a8a1c3f518ad0e5c6222df843c0ad3f7566885a95135c03c7e3e37e024a353ea779e4694ebcfba108252463fc28c66613b8cb2bc59a512e0493d2b0361bf826c567e3c25d4d7f11e4e06041e1cd402341b24896c89a5352423d964a7667ad53b9520a608f4514f35f27481457940ed8799b6eb778d80c59169f646703509b35d23c0796d52ab82de1285259e0d2cfcb6f3fae44fcb1a47a1fcad4d33c96bfb303f784ca53c3af6dceef46807209339e6caed698361ce796cf62ce5e55cd021ddcc1c3c7879603205e319bd739538513a0f0a5229c1ad6fa2d18807066ff3fbace42dd52d83900fcdc803aebe597ca4b1e4f0f4139b3796a8a0958c43fd818c5f86b2139c38521377de4cd93ad582f99e5c216e961570f3d97ce001b19acb67f3439bacbd935075de5f00ed9f26a0af4dd3ff28835dafa9b983464c02378361bf6909639408ad791ed1da757b4c6d695dc74d5ed33483a7370ab4ce362b78d561d1e469a082c10cd8614457590303d0e77edaf09ef97bbdb5923cdaa6c39f1b9af3df403c8ed31b0cbc38727aac4d9fe6f5206a2ae0438ff01ff190ffe0e7a234405d25456e2af7405c92f98eb1c4ca96a031cc661c32c8b50dbdad8ed33c87a8761c78fa4b419dce677b039b42c9023b5a4a60d1c49b438f6e0817ed9f2cf0b4f3b428c8c8fd396f45d3f057913f998215d437e8f9de8f0e68210b165c118f002ea29055e6f1af3509ebcdc7106b6d734faff3d84cfdafb22384f073a8e9b54a812f5fdd0e108c68e5dbbf47a0b7bdddec8ad43e24c0dab407c339f24183860a6993028191044c69d3a61efc8db5535c87a7e18eac865addc27f2cda33a491020f9b42778042e00969da390a410f603bca579dbad652fd8b1699347c0c56fe4885c57fec5ea39c3017e87cad232a004717a69ba9d191b35449e73bd43a2eb9e65521564ef2e151ce06240fadc3f31bbd58d9c9aeeaa34f2b19b14a600987005fb7563ac0c76b78cb399f0326cfb0c4216f5184068b00d2f7b4adeb4894f626260bc3a7b38d4769560483a6251a8bd3f4bfd803e3d310af260c8307b9c39c6fc90a52797413f0ab6e02c0383ba9860859ed8835f214606e9561efd12aa73239299f8c186d387f0382dbd10895bc0a23c454e359217a6dc36df0ecd21f3b9c54a1fbb1a867de349ea2c7a671936ef6357b0b5da6adb937aced0f5ffa1c7e0a04da0e9b3419d0c00e392aabb9f25d2d32fd337e2157e8741c5cf96b8bc3c5a8f2a3c77715211b5c215c8c04385b2cab94d237ae48cd8c085d2f8653eab43084e979508b3a94475ab0952ecf628841937c8133b4048ac29a286c72d45a3b26a954eda1c27a4c7ff77ba07f611a4d63ea7e8f3ab7e5244c85210af80435c6c5eb5bb800bf9e02d9960d9f202728878624dd1b5665ee98070d478957a573870cbcc02451d52d620eda50fbc90611c98e8e23100ad6c895a6dca5b92bb05f0b78312e7e6656827143a22ec610657b13e3a96d8364005ded088c0e619af3be97b2bccf27787dac221ea3cd0931e144735ec52e6a86339aa2365d42f6d3c2bcdda4edf6541d9ba39daf686cb6d8cd270a77db8d548a02638117808221ce2b2f52ec1267b42c934b3f7874ed0238a8b33c8b8386df3eaba539f1e600292fb5f679dea2b5fe654a3fe9d1c86220d5a550686983e161113209e72aa22883145b99962cd2a58c1c763b84ddb2a38246bbde9b3a86d52f454f8d40af7d728249a3ed16945222f444ba9443d7e8c538e374b158f0c622736eac597fa49cea57766c0b62b6401b323caca4e17958db4dad6743477a287a18fe1b8408155df57abd13662b508eedea7645a78ff12f97ef582ed71ecc4c529ddffa6d1d721699d373fbae101a09cf69571bc3db2461d202f53118c92396b17f0f7c518f32bdd9d99c39ab080fbe9e38cd0fa7ae92e1cb45b71c0e6653bd47d3ec539dc7fe0dfdcea6a9e7ce3cb1052cd0a27fabf02b136e02c6b0db6d0fd6bc9775b4b59d4bd2ddef0ac7fec8e0358290e713837e8098c7df91495570142db15c1bf7f9117eb57180cfb1ce727e6dfffc555bdaa738db432ece4df6b35fdfd8fa4dde23f8ea0f9cfdc28f94442d3aac965a6098acc0d9fe8671ff09c239346aa29d88204c25184b9cde28e1ddea3f72fe9940a0ca55321916e8e44d0622c14ee63137778b91c55e12079279e0df161beb6868040f810e64dbc750da05cf1e18926b79e415223a9ff38df59d0a2804534d6dfd46b37fb5ca0aac833444e71525df35a3cae86bfb39a878c82585e3bb03542cee605993b9a2efbe03398622cea91f85955e8b489af70606177697822bae3a7ec4d16a2cd41e3411cddb67aa44793d3e8f78280e8cae51c15e63882c274f3a4397c3696a5504cf337e16c3f74abbb62b8959d0b1776c9a9c7efe4366783b5d0fa997517e358e3ea7da39aa0fc2e7f26fd6635b395aa97e4e213a092b13fc6c357d5698d5ec3845a10f0b27cb0c79584b94528eacf9f9b48cfbddbc883799b4d27759f8be55ede0ed468275cf4b40b4f8806b42f2d85664a07f112fabaeddc511c6052a3f240c09f092dcf0c5fe5b5b68b9178172134808c8edf52c38c352c336af41dcda5b2e04a4e6f6632c9b62ffa6dda1d3add73c26060f3974502951c284272d23b3b99890fbb0425dfffca92ee834f3be5f0e66b645d953c8641d34eeb715968e1327e315ed24e3c2ea100b98978c36f803f05819e231d7d537139b84f119a3ea0a0181ef6a9a720a49ab36cb9bc2ca814343f14e7a3b8dd5522017cb6dda1c3b9c073e7898f2c2ab8b4a549eeac797a55f4cdc38266616eaaf2ca38a621bd68e6e976d602f299e39efe7ab6220fb1a926bb3db431dafc7fb5d5d9d506bcf12e31774c99b0dd26bf1da3983a5acdb88c8ae2fd6bda2bbc8f0d3bf47a600d327a42e360714b2973270ff84a91ba335ceff39dc11de9984e6fa3b6284b5cbf155d85b70a9ba07c2b03e609365f04b56fb76e525f7fc2d86c4d092af9a0c304797f715b6ee151a43056c35af0f92fa0ba2bee901db903365a111641be81196ec3484bcc3da3e171fdf22d68caf9058ab3ac8b8a31b711b8a2f0bc74d6d6995de3fb6adce0af49d2676cefa5ce2d138bbf21fd533b9faa7901055b54cff53b9fc2c5e3ae623af41a3b1b0940b3fad50cc5564d6830d34901f8a54d73984d353cc21b4896d80fdf601cdb12f2859e219da33d51b1ce92ece92b1ca613f11fef9e45474e7707", 0x1000}, {&(0x7f0000001b00)}, {&(0x7f0000002a00)="61913c8d9b59fc45a841f5609fc25d26a1596835f442d070e3c6e7e87dc55c8c3cba1b77c742e50fec7b44545eca05d84ebf0de88f9dea4db7211c2dda4bcb206a4cac05a2e7002d2452526b5e58f3865fa584867954fa9ccc316d542affc842be364828cab9a8adf6c2b8e943b62b11b137421590f35e1d2f51bcc330066670fcf6740daae6da69804dc931c0c4c17e6394fe64f9a780513e6b7b05811ed5ba72a3d044737b1ed8de9f40103d69ac6e84c2f76f855efb5c96dd4b5baf9ee00526e7bd788adba7b5ca19c7988a56c25cdd8e9f6c2f74a688cb9a8ea6983d27474d2d21c6f8ab425b4d177632fddd704c4caad5afbbdc44de69cfc53c9309cfb65980aadb1c47597c8d8beed3a4f09b5ef5dd47192f5f13bdb890cb858cca7b11ccea4814ae6f98c53da6494e4aec704e5775613c352f29ce86c37d37ed4269035304e11c9938c4a58b6c53f72a5900a0fa405268f6d019787abd022f911d76971e9a00513f06dfdd9a380b9810ba0d03363896565b44fc8c0e680de25c6ac6245b42f176727fe6fbdf4c3a5511a0aa1d9948533323086c91731bed465dc4aacbb4c299b3d3b015d3b0bd2d5471ce2700b31367d5bdf3ed7946bff0e540942d075f7df1972ab14d8c7a50e082b5c0b521c3a8002c3bd22673f36dfa39957c842b27d794291fdc0031ba83ac464988f99b1d24c77faaf4161f3cfc61489969cc151b79be616fddd9981a097a3e3d996424864ebb499de22a07dfc87f090fbffadb12efb353de85ac7ced8cd9cc7d3217efa9192084d7cab72e9e4c85a96a25ff62d4f596ffe07281da9d19af666209e97cf472f48061e1873badbc58663d664d613136cdeec2f316c1b9701da2f2ee4418f087cff5941076c2a48120885d6c464abd52b05d984154e80752bc6cad614214e3692b80135ccc9e1cfc7a14a0ddc01469454df51b243590e4c5864c9f504a0a7039491308ce4de1041e1258543a10e636fc3b328e66a1e43cffa9339c6ca5de3ea193818a89cf7cdd371311891c31b11838b6aa13153ba7c0bd9fbbfe57fbe7bf253b8ed0a02d3e9c35892d641e426c3fee683bfbc8cdf4be7d0c9fb246d851d812e943bf6b3a7075666429dd1e9f8b0b44c745254498f521a6600960d21bd76ab15ce3c8850e78177c33710aa479651ccbdf192f1a260546147e8287db724b0da9a552db2551eaa96255436f31c042fc9f4e11c7bb5d15c69c90fd56d9c4423e7950fd4ed6b0ce5284f5aa6c6d001003389c7e642cd6b468edcf6a75cebb9ebf1f8ee58dc110daab858aaaaf16659619c485c5b9d702580a6ff3a46da17ebb54bcae44c5359caf4ee7f5186a16e869a4708a881ae8ace7190fb62213623d471ecd5297768af3af4c4ae2059e629001212f1806017184afc9188c25b1333acbfa6b6cd9b27fa7afc2ae04fc80a922b0a959d80f3fe573defcca8afbfc8c1ff67fa6c3252ee94114b4af634d33e04d37cfcaa914f40df7b4c056e81aea924063330b7002174cb88b621ce0f686e5fd43affeda7bbfc8b6c8fbc4c27cfa04409789e44b890d46396301a85d18ec53f18dc5cb0b152fb4bd6cf424a193dcd4554691b7e8ebf3f2c33ddd45a69fbc50b5d732f2cd2e83fa539d5b2b5073dd845ca92923bc73491c5a7400ee973a9074309093561e6f580e9cadf45bececb4989359090d45e7a64012b01463d6310aba03aff122ab7137dcf755206c89e807ae2fd8f173661f9991aa50693a98148f5aacfb99cf2bebd8cb73fb0209b69067e077736a4cb02b63ce10a1ab432c2d027248a411486187fde8108c7549fba44dcab392e9f36de1de8cc778fc0e23df350d7255f2bbd8528cd0cd7d135de2ffb9d9bf8cd9624c349ec489d4ebd36771371c44589be9b5841853f3794902d8de4d81ccbd68eb8cab1cec0653fe84f1279b3d707f86f21f4751da3bf8e00e470f5ec5a5c99faf0eca80692533d2584d7eb17c5f608b58fd0e308be7e4e33e4f0772d8281f888ed595b491736a1a8f9d5b1857ea7975083dec8e6f21a1897f711e1602bf3d3a39a9f995aaf94510499e5c1d74da8ff9571f0ca30456d94da4602c0acffd42284220fa47e7aa49d91517f55507bf33118df2cb4b7045133e39a50de24af86c1a28b5b8ade8a61f808cb365a6cc779038f012690365261b119fe79acf802d9c61bf8c27bd9a975e736b6266ba35345803747b87c98a74e188b33036417254912244524fdc7f801ac7f66380624adbe0bbf1694da6227353ec78f819a471e73ec407c36803c003b6284dfe58876f31761741facb9190cb021e887feeb3ba33f0254a184e3093eeefa7435c7befabfd749349c403d8771ee589ba733811f1df936cfc5b155ae8174a00c434d6ec701bd71e630a945d6b5a6f2edc0c985f58ef745dc0924a33c8d22349e6975e72078f8508454ed9ae5216ed6ab2dc7b3073bb6c47e24212ff6641341ef3441c7dbfa62f34f671a3f49b8506752a88f47ab2b0e857ce013be7a6e44602d674368113da8cc338980dc749969a7a6c7867fd3a26809e7dd8b8aa16163b7ee7d0f255d2301fbf0c31c303b4efb8cbfc536915e90d25cc6993151874dbdd1c21c8c090ee6eee604e302a1a507a82237e86ca61d9bd462d6b1dcc1bb6c31f9619a6fb8cec16f886268fc150134c78ff23f14b223b021a698422d9585808c8114168b5fb261026acfe9ca41efe11024d8a431655ae37d6d7df7e62c8614c09b8f12caa54554a7b7d228073694d62614cd8a38257b82d83c2aa0f268164be58f32004a7d5d0d775667c07e3256ec0b33291f5f52317d02f341710cf43d385e845b7308ef790d346c544f0729ee64a25726efab7f5a6de2fbe098b253568059f961285a14c642b26f194bb8fab09476dc574f58a38415115c56c322db8c08fa6e419c996dcd8c91fd7bd8a7cbd00ef64dfde14dac152145962e00679abaefdc8cde2f2a870d41c1fb3be34de855e881a17c12eab0a895a89171507dd13c16ffb0fd6e42d97d96af6373fd5203241d1d4be7eb4757cb98977b8124e4c5be872bfe36189ac805793058fe50bec64cc3a917c4278a92850b7336bfe4e79249f18d9f9b10ba560308ff3c8402c25843bb43882b10ad11c3c940f82408a84346c038aae4a312bf1892f44c5bd76a0b74c67dde1730eb86209c1fdbf7ecb3876145e67f68f0de5a1208b6379f91be84661b80fa2b8f04280d7243f4320594a5bb5314beaa744e727117dfc93c89de9908fd7347ca2aae5f93bd889e683dfee577d2d91535dd26791c8c65a5a1446e180ceadf958c094fa09974411011ad089e2ff350e5824fb919a6882484fd383fb1431b572f356d76c5b21bd73edb4f91c846aa48bf08bf8b0bee5151ec1af23ce26a95bea68883ee168bd59087410f87f37497c50bb8f710947acd94983e9d651004aa03ebc37cb9f968e7c5f6f22fb24603faa56b244020997963f18819b2969c99f213b57807b6c7f1e77bd5fe50c47db485a4b5228ac96bd32341a361202db9880e503aea0965466f3a399c8e797cff8bf15781e49280ade732f6dfc5c23ea368717abf139a56294d9f76243f75be34a926b7100ce634597ca52a162c394c297be167d248d299c9f559540a7a2ef1e4e4fe8cb54814a80b5d1b03f06ee67045c183160224953f67f61f8fb726ae389b406b6f3b1894f8c8bddde0955f18d6e702d25a77c53dbf13778984051dbf8b96419d14b8578f723d18747af08a944a426cbd76affe51630f210fbda8bf4dddb8eb5504003311f1bba31dd31c6fe8cb58026ad5c2ecf6a335b5c063b298a628200fe136e21afdf3b73b3ad301ea3008082e959c218e0ef0d92f21f562e88783c2a399b31123bae1346e914aefc34063e89ad1c19ca069e295047a9ed2d845e5dc30a40c964384d17abfaf9337ed4d3fb9c335191ba97f3505a96a69b6c4ad547894e60105cfcdf069324ccbfa36f1ce01fffcbed220b9f7f812cdad5e2ec47c82f9b48c5c855b81a25cf995afe1e42a66bb52dc93e6239ad8977ce70bdd126dd19ba7f27ef2f2ff5170bc571f48e5329ea6d1559aca1cccf64af1d212aae3be924a1780f4ec13a0202b5752b09eec489493b4d4dee305df15eaa102e32e7979c22545d2bc7d24da7f9b86a55eed1d55daa3caea901982c28b3ff42de4b96876eb5b53405802a61049bdda4550fad8677b3b57107c4f81c3b5d31279be418c085ea2774494d1091aef3a711e10652579ee6862303ba511d16d09ff289bef4b33d8705fed7a83b0fe6d62a912dd604d55fa86449fd0030d7e3a5285a685579f8343a468903d5bda08ae79aaf283695b39fe7ab8ab891d8695f250ae12ca5afb7f828794a1d16cfa25db1b64710e7e4c8df49149ef7665fa91f0ec968624195ed3b66802e4b13676d1820b9e4cbcce1bb5d65306671619592c4ce0e6e08684f719dbc55de16280fe6649ab7507fe5be71d3a73b1f9d9d775dda5797f61dcdf80d12d93206a2cf38b113c20fe9161c99ebf4b453b47f751bc8cd09f1b3dcc0d15a8a63603060335025b706910898d0d905f89bda5cb1585b1b987d331ef6300867ea908501f67fbc1cedc2a5e02f4429bce651c291742f644183beee819cd6e32ee55436c62735d96cd848add1b8874aaa336435622da7136e6b42dc66bbb83986d65dbcd36aace06c4b975358780b56fa7b1e9409a1e4c5ca327d07f0deb0aed2ded882dc9cf43fecaf483ab9dd60acee40a644921424b5f9f2a55aa3749446418cea8add032fb376541907fce6371590896eb711e9e306b8c8afc6545016a22945abc641c36d419c26e89bce11788530919c87430121c88f6890758c326c2d86a06ef001e7f2559282a9f1f1f43b0f9e78c806fc450508e53b8a9180a7e8437704ae347ba4afa510e0d8cf62a86a13fb45f779badc01ff20896623b332470cc2299914eaab73925e1d4df35f27e5f591b026ded3ef26ddad7b97d2d31316dcc5df3aaeee59467c0c3a3c2844706eab40d82203e0c7bf61021fd78b8c1d4f0fb95fe9993ae25708180949e73275683eb03a8bcec39863c81bc97cbeee3d90ccdbe5a293dd57b27574bdd98ee8f631084db965fc8697ed1256bd4f3ac378d213ea7646a41c3b4f339bcf1d37887a796aa5eaf03387de3307971b7d746f51602f4acbd0f7bae7a68391a0625eee8be6c94210f0357ed29cd7a0c131c9c774c12f7e580ae6a55ad1c426411ed7857417340cd0b40de767469c74a04c1154338a294b05f9f6520fad722005f46f5c4d88a4a0dc3515a5dd3a4269dfef47d8cbf8dcb1b79bd68fe2ece863ba41b7a398f1b8df6965b9b18722d06cb6b544102c1ff2086ae32d81a228d7f1708b80e9f0ac02d07a33ef2e64740f49152bef050442c935a43952631318e51808b0df235cf65407543a454a933e73a1953d67dd627dd02941bf8dc543547fb6dd6e5cee33664db22da733070dbbf3f932ac5b2bbed95feda1f02b24bc7059ea9e6b20f34ac27d474eaba8d1c44ebd9fdeab83f240b4004003a6c49d34be9f522f6ed5ec7ba85aaa685fd9999eac70b50fa7533d9f39b9a81b93cdd273128887e9fbeaa72821b06f249c9cfbc90fcab6cc9cc24c1aba58c0f75a9210171bbdf18ea748f88b491bb3b9bc0bdf3516653acfcc49c072efb1e94ca376d8131fd668527bbd595050286d4d3edfd8b1aa7c50f32fcdea10c578594e5966a0a4dcb55316a7a7384b3cbe6bd071df7286aa0d127c010b27d13324077faeaf93de0985ef22e58e9870", 0x1000}, {&(0x7f0000003a00)="2d1ef32f6512386e7f2c64126b68", 0xe}], 0x9}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0xfffff034}, {0x20, 0x0, 0x0, 0xfffff038}, {0x6}]}, 0x10) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYRES64=0x0], 0x50}, 0x1, 0x0, 0x0, 0x28000c91}, 0x4040814) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-syz_mount_image$fuse-socket$tipc-epoll_create-epoll_ctl$EPOLL_CTL_ADD-connect$tipc-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-openat$binderfs_ctrl-ioctl$BINDER_CTL_ADD-mkdirat-mmap$IORING_OFF_SQ_RING-syz_open_procfs-getdents-mount$overlay-socket$netlink-syz_mount_image$vfat-openat-write$P9_RREADLINK-syz_open_dev$evdev-syz_usb_connect$rtl8150-mkdirat-sendmsg$nl_route-ioctl$BTRFS_IOC_ENCODED_READ-chdir-bpf$MAP_CREATE-openat-accept4 detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000140)='./file0\x00', 0x1000801, &(0x7f0000000800)=ANY=[@ANYRES16=0x0, @ANYRESDEC=0x0, @ANYBLOB="78cd4e86f938b6bc06e6fad108c083e67531db667e030110e889413d713533a483788422c57d5796c063a23edf08b84967c808da7626e8a7fac0374f5148421ab5d8eb33565986215290195d7b55ada270264944ec790f3e7c1cefbb5dc7bed827e24b47d33cbb0c46d7e98a8dfd13708dd5ecacd833ca11f6ab1b06e544ee93719ddf3526"], 0x0, 0x1da, &(0x7f0000000600)="$eJzsmD+r01AYxp9zkpt7bxHBRdBFwYIV2jRJVVwc6icQWv9tFhtLNW2lzdAWHIqLix/Dr+DQycHNzVUHFQQHO4mTw5GTnCbHtkZTEYr3/UFPnvPvPXnfhKcQEARxZPn44dv7Z9euNMsAjqGIfTX+2UjXcG39uwMl3j5/1T/+eP5TMCP/+SaAl3UDoeoLIYQ+X1TXJniib4DjgtK3wGArfRccN5X2wXBH6QeaHhwqEfj2vUHQvt8NfEc2rmw82dRW728xY2gDkKmLlRxHk+nDVhD4w1WxJ5bnrE3lFb+pn7moc1zV6ief1+2nT2ayv6yNo9XPBYerdA0MjWVNsA/bttOSaPmfNtP4xp/kvwviRCVrTTl7+/etTz/1VT36bbZbqrC7UsP/UDBt5FAKBiAZObmYv17f9SnXETBz3djZf5sylGevTb0p/F3kzHc19U9pL+c1fzJhJv5RDXuPqqPJtNLttTp+x+97Xu2yc9FxLnnVyIjiNsP/DiJ/Kmjx936x1mIWxq0wHLpjIBy6Sd+LW81xGy8GX6I9PPI/jtK5OIZ8VazYKjfC1I9HV6lKW/wrEgRBEARBEARBEARBEARBbOIMWPQVVAjB1AfRTXjXo9U/AgAA///YUVl2") r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = epoll_create(0xb) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000005e00)={0x30000014}) connect$tipc(r1, &(0x7f0000000140)=@id, 0x10) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000200)={0x1, 0xffffffffffffffff}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r1, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000280)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000300), &(0x7f0000000340)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x17, 0x34, &(0x7f0000000d40)=ANY=[@ANYBLOB="18670000070000000000000003000000b7080000000000007b8af8ff00000000b7080000000100007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b70500000800000085000000a500000018330000020000000000000000000000b7080000000000007b8af8ff00000000b7080000060000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000800000085000000a5000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000ff0f00008500000006000000186700000e0000000000000005000000851000000300000018250000", @ANYRES32=r4, @ANYBLOB="000000000600000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000090000007b8af8ffecffffffbfa200000000000007583a6abfc94cbbfd03000008000000b70400000000000085000000820000004fabf4cfb06dc30e222579f401dfadaaeef933cb4d686a7b96224d31d399397471196953848d2896f02c6b85ce3398462074d2cf248bdcd1a9"], &(0x7f00000003c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x1e}, 0x94) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder-control\x00', 0x2, 0x0) ioctl$BINDER_CTL_ADD(r6, 0xc1086201, &(0x7f0000000c00)={'custom0\x00'}) mkdirat(r0, &(0x7f0000000080)='./bus\x00', 0x1c0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000140)='map_files\x00') getdents(r7, &(0x7f0000000080)=""/7, 0x49) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r8 = socket$netlink(0x10, 0x3, 0x0) syz_mount_image$vfat(&(0x7f0000001200), &(0x7f0000001240)='./file0\x00', 0x0, &(0x7f0000002480)=ANY=[@ANYBLOB="00e789da34e04a1ffb124b2c2fb684c70b90bbb45efd97899a16f2df4fa2e8f06ac2c5352509e3c51d882eb3ec0dd3b1c96e980163890d2d0d1b8d3d62f6d77b0209e166e2ca4c35483d49316daf522556a16cab12d75a852bc680da7ea837480feb2060a1e20a59b7745235030000004ed0351cb5b416ba1c57217be5a338392f831617ee8c35bb61f0a9eeed3b1226b18c4b455ab222d7ae1b5258d5643d70000000000000000000ae468a387d9e63008000000000000063a454d1ab8760076a893752105f030c49caf2fdfe6bc9743a68593b576e2f2f6ab69e1b974ac90855ac250f8f73e16bc593730b88d7a3346b945e276875915040ce4901262cd8ce8191ee84e3ce5526a0a43b707cc711a3311f840cad641a013c6dd783aa895227b3d50a86e15a57e26666aaa296b7ddc4c8f421cf9d76d344bf6522f5d1138659d3de84ce13b085a2ed9d66c93767378423521cc4ea440e0ac3b953e1ca1675a716a97a5c3106aba648f119eeab4747b9b53000475e0a34514ccf397ea6f170e018122a98f135beac48d2ed195e20fdd226c7f5a20000ad1fcfbee59924e161280a8b78fe34b2fa3efa7c1d4268bf090000ecb4ece3234c232659fee3ff9e6d21e008a570bb490a65b84ea8b6d6507355cb1112fae6e3456bf8da53e1df20458e59456822dbb8dbd7ce0f928d5fbd6414fe8ab5277f3fd5ce6be044993f93e697a69484cc0e65ec742443c84e21a440998c8d69c12c2db7aee2872c6e0671d639e8f6bece219dcd0f69b9867dfc3187c882c035809c81832d7416f90c734be30c2faf0c22bfc8d95dfc7b9bac96b838c98ae5a75b9dc9e967ef5edf311bbebd7ca803cea8f5b9ec5b3edd6c44d633b71bde97a3c10a468432ff3d4e63ce3ecfa640d44b70b68744d26e72389e6c61767725d2c692443bc949c28b1a374e541bd352ca2f3bf64d883862dc24d8e27d86b6e38bc269f110c3d563f8e4ec9a98016b6b58157deeefa8fa022514bdc75f794094700cb8fa2b61310cbf9058bce5f2399055929e0fc732e0d5db926fe1b09a2993ff038d8099c229bda0801f8b81719d73b4abac97f704a0942051bae38b00b69d7fa69d738f99f73b19082ec0c99442d97ddbf68a4822aa2a2673478f81f14f67beee619b9d9882f7eabfb5000000000000000000003ff8795b5ec2de11479e781396117c84449647684239c9b9475b389a6a76d36c31f39539d928d2c58f188b4bf713d0915df4cc7de48a930935dbb01c9422d604467d209fd1421c7fc503cabde4bb193ff3654377c6e4fb72dcfc835f760bae7447068c2e43433e3d77c6805b559a04f3ebb741a9bbf57274b1da7800000000000000000000000000000000000000001c4f225672f3465b2638e921d80d58dca4ee4592d8cc0c06b2e390b7b1c713a46bc8ece9be25f055a59032576bc00a844c32b46040a607eaeb886ec0cb8e90c5a4075caa8a358ab81e78ad794a20f772b73466a43cd696401521793e54b1c4aa58d506b661f393e7233337473f36c2dbb15ae673afe82ebe45cc6f776162e43b74d9b9ca6f68d6bc8261600b27431e0f6f4f1e0947f69d2d812ebc9d2a8869b14a84dbdcdc5055b97a241e2f707740bb966b6c58408aceb9f6a943f614d2a6093c60c0dfb511b02f191ef6fa6e5a1a86687a44ec6098439a2ef55a4ba07e2b0f62ae86e1458f63f6b8b2d2b9990495f17b6d1052b19472a97d41204a8be48e380be2e6885c7de0807f2c154ad4f25b16027bc4aeb85dc798e7eef25631bfd79c8e0aff725dcd4b91c61bf8d72f74e4dbae"], 0x1, 0x11f4, &(0x7f0000001280)="$eJzs3M+LG2UYB/DHbWvr1v2h1moL0he96GXo7sGLgiyyBWlAaRuhFYSpO9GQMQmZsBARV09e/TvEozdBvOllL/4N3vbisQdxxMTapsRDqXTa8Plc8pD3/cLzkjDwDvPO0ZvffNrrVFknH8fKE2/FyjAi3UqRYiVu+zJee+PnX166ev3G5Z1Wa/dKSpd2rm29nlJav/DjB59/9/JP49Pvf7/+w8k43Pzw6Pft3w7PHp47+vPaJ90qdavUH4xTnm4OBuP8ZlmkvW7Vy1J6ryzyqkjdflWM5sY75WA4nKS8v7e2OhwVVZXy/iT1ikkaD9J4NEn5x3m3n7IsS2urwYNof3urruuIuj4RT0Zd1/VTsRqn4+lYi/XYiM14Jp6N5+JMPB9n44V4Mc5NZzXdNwAAAAAAAAAAAAAAAAAAACyXBzr/f6Hh5gEAAAAAAAAAAAAAAAAAAGBJXL1+4/JOq7V7JaVTEeXX++399uxzNr7TiW6UUcTF2Ig/Ynr6f2ZWX3qntXsxTW3GV+XBP/mD/fax+fzW9HUCC/Nbs3yaz5+M1bvz27ERZxbntxfmT8Wrr9yVz2Ijfv0oBlHGXvydvZP/Yiult99t3ZM/P50HAAAAyyBL/1q4f8+y/xqf5e/j/sA9++vjcf54s2snopp81svLshg1XtzuaPbNQUQ8Io0tcXHi0Wjj/y2Ozf2Rmu/nMS2auybx8Nz50ZvuBAAAAAAAAAAAgPvxMB4nbHqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/MUOHAsAAAAACPO3TqNjAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4KgAA//86R81g") r9 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x0) write$P9_RREADLINK(r9, &(0x7f0000000000)={0xffffffffffffff23, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) syz_open_dev$evdev(0x0, 0x0, 0x0) syz_usb_connect$rtl8150(0x0, 0x3f, &(0x7f0000003c40)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x70}}]}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=@newlink={0x48, 0x10, 0xffffff1f, 0x0, 0x3, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x1}}}}}}]}, 0x48}}, 0x0) ioctl$BTRFS_IOC_ENCODED_READ(r8, 0x80809440, &(0x7f0000002400)={&(0x7f0000002380)=[{&(0x7f0000000500)="f541ae4546282934ac518322083c1a2d0c9c756ecc7174f271790144ed33a3f7af1302182eb92b2f659169ccc9e291a44691c51a36c6ae725bbf31c8391b5be1df41bded1cd566f521556f062c6a326996deb58e30837bef2f544841542757adbeeaaac4f3066b5de424037689f011f1470f42c31663b431dc6de658ef374ad3e0a6ac2bf4e3a081186f6b8f9f86b9c4d7697c6f1caecaffe4756c701ac70fbda8b78dcf20983fb185f456ba8b3ab1933eabab27bbfe59209328a8b1d43719821c561f5ff7a77d8ebad3266a94960e37a79d5c224a71ab6eb09497fda5a47df1afa2a7fc57304a3678ddbcce5b6a18a80c59371974", 0xf5}, {&(0x7f0000000a80)="458c380a3232d20a", 0x8}, {&(0x7f0000000ac0)="c58441700620e639727d5d9c0347b02a5be7a432e13244822d1fdfde99bce95db072e43b3f60ef73434a718556", 0x2d}, {&(0x7f0000000b00)="2d2fc8aaf7a19aab7487852176487d633b3c03b7acfa860e8c9a00620e33d071085c74be82fd05e8097b15fa5ab0d5ea380adc56d5791485989b66bca20ff0cd44ef1c7fb62f18e4615e028c0e0d92069148a050c489405f9ad79304958301ccb4b4dbc8b9f206b772084d0e962849b460dfe1cde65c495ea375b2aa57283aeb2e6284ef1a899cc43d52994e6c2f67b26080d7103fcd70928ff953db2561890f46019986e4085e3eaf13b4f6af0f98ab4f6ed711ee388756f6d545014fc9e423fef5c8ce1bb70c48235b26f9219400c81f7cb63f11fa99b6b206a3c4c0a1a0ac41d941bf160e538746a76c81b29a25ca4178e3a98bd0833b3b39", 0xfa}, {&(0x7f0000001380)="5685cd62fdd9edd0c848888af8d8047f08a3e9b74c53a97ecd413db2a80547d036fcb1e6af0bbdbd87ab4bbdcb40f5574fe216b73186a86ad48127f046954206f72543b7a97ecec84e7b5973cc3f5e6cb61109fbfe1a4ce54898e5ae43efa7d29fd3ad3d57f712ac83ba0898b53274e3d740efe8891bd1e90f610ce3dd3bb6a574ded8e5e35ad0fc3aa48bb2cacd5f6842d3fedf34cee1d43f8c134e2d638b957b722bc8c43409edacb3c882c64326bccc0db40429a21b9e5374eddd36cd79ce198c08c7fd38d7f564a5f771bee503a90757b44496357a540f0dc6d35e0cba37cd4028831ed6d6d33aa34a8bea1f26e116c1ffa3e857cf7ae934be1bddb6a3284ff64815b32451591f6880e1e0b6ae893cfd822592471065ad8417e4f4118010d93fbc5de24e5cef0b064c6fe57a10d90164c135281f11dea4c11ec91b68443d08793efe5b6368dbaf56ae46d0242fffef54d5b59ce4be2fb7c1bfa3e452963965b03f39c4a811ed80f30c6c346466f04f030eea400ea40d329247a2991840a8b448494c5d489dceeff76b88f8d796667b5f16e2c13a2f4a11c03d2619876f6f590f18edfcb48410ed24ed7150ba7198288103746814f9922d0c4d9f15cbd9a9bd98c268dff25b0da50ae6f62b4463a117cdece7a9ca1f333fc2486d24683c2be3f38517c8864f03f0d44b196cac79e99f7fa0a85b2e15a343cd3243dec545886a2607013d6f3bd8d828e3d1d0d365b2c1fb45b7edc4138ae1765e5527e106786e60fc77ee6063c772f5a8730bed331511a15f391322605688c2b85213aa3bb27aaea69a77e8351f322b08c5359c1bde62d2bbb6e105ef385eeb92e704aabe8584bdb6d38f89b486773f4cb87ce9d19edc4f688b8c6d27de2fbda5b4727c359dec01e9bdf5fecc2bb87e4f13e38e6f908acbff7ad206b3715016e8b21d3bdd8d8cbe17bf618f027ec56a33096678f32581620b16074899cda9d2d23061f88c116bd5be5a6b7bc17d4d35a402d18aafb0eaad814c84b0db6a6fb1eec331e1ead880efb2d04179c75ad8ca75123a84d07effe2d2bae5aa5b8e8f0322797cf842f45cca4865dd651bc2560b4ff887048111951f2b31a3580d8e4cc6061a9e4aa17e3ec9c343f0c4b9772fd8e81c3a2a8b0dcf23a492ad68b473d538c90680c525015539257d10eaf59bf9d24da2723a8b51737a528ff247621f54f047e57bd8c56bd5abe86eda335f0fa1decd729db334fb8307e3491ba0ef620b8f2441c9fdfaabde99ac4bdae95d33e47b2d8b2f82563601ad3712dd07dd70edd7476a7c27cb7709c9c95bde3ae162c8fe5db8d64c3acde26174b4a31fbeba40850d185bfcb159d6c19cd0bf19361ac0b63f0795c7e8dc147ac0ff691088f30f95d73e1b123263f833f9de94217fcb62db39e79bc848653896d2730b71c4d81a16f18f9aa9f4298e17cfcf6f69bb48b27d757333ee916a765f3eb07ad7f849cea4ab65c360ae3eaa58880b23fe66b29933bc315f02ecb94c2bb06c0d0ff8f93a78450c8476566e00553a6c19fc6ba548205235b3f9afc480f6e280ac268d39682c162c68b7c2f6787a7b8ffe2d1f3b4838c118b9e18b86661b63d532eebd4085ff33f554a42ca35b7f7fd1aa7f676158b3022f2ffd120b4d3dd3c06e3b3fe5f59dce41356a35d0e5a748affa12260f9cf59d7c0797062e4ac57fab60cd733f4e5ae6626395d2bf8a9835043e58a636f98c3d8a012d9b8da83f4c293de6f865d7666ab183cb64d4defe38b5fd353b41725ea8bbcc8aa2bd2ff8adcce44793cfe14b8d57227855d524505533030df089424e2057078ecf758c9a2ed7170937641b85aed66cc0fffd4034baaa2c3b54467e73a77def721198ec2ba40cbcfe69d66487f7ee1349da6ca8fffcf2e6d569d1c3b08b809155f55551d3101f17758bfba96b99ce2ef5ed0b8fc85bc0e6c7e8e444b7249e31e9c95815a3ab1ee80cbc6c014e525f625a60ca50295e5399ec66ed196e1c6e20dfb1fcc6ff122c3a5ff23c9a21ba82f554fe684572bbe3aa64d639b84340407bc0bba84a37363af65d327bffe3db1955cc02dbda32345adec0dc141e1bcd8416979055c76de251a42dbbb1c51ecd0787fcd97927558a27129b19dde104f19934d9026582161015bcdba62918b9c924e29802ac86f8538c07c6aa5cce3f0364a45d4537369904f953c2c7300f50667c54b9e7a536286aedf04d23f71a5a8c449d549c1477003423bab42f63db56b1c28f22d60acce50a392e3bc9ccb19e6e92b65caf13037a730763aaad84e7b43f252a857e846d21a27f89d2bd3e791edfcdbdbf60636bcd79d697de11b688f01ce8fedf2873b09eaece1c4ebe559fbe80b2614f14adf600966c6392e5a0665f7ba1e5764eb251016c2c28a6043a5dec576d7ba5187f5f28f3670a389d3e65cf6fa8f73db73423c5c6346815987ab3c1fc94fae05369f73d0766499c01621451102128423aebd5463f8cd00c8f1365c84dfc049a0826b7fa15f86252800f7aaf45270369a9e70dcac50b28e3eb421fb536d1bce8c74d7206a3b4597a06f9b7b4a266fa771dd0d06c9e4252f9f9c1bc4cda68a9ef4790e58351a8d3e9b3fa5e850b100f01297a12b0b63259f6f6a1c284117e4c32df06027ab1ef80c10bab173ff6900b0c31d36359ae76155334f0d2070c47b3f9fb0a1e9bf9ba88c137d9c427f54b8dbdbca1982678a611eb248f2a2f6d0c5b1078149f55aa6acd862523dc96ad93fb3cbbbcacf3f27c42cd64a951f1df0cf6dacc9f86612183a1b4a1aea6f7bb856369b1a848bbe8d92ff21ce2f68a6da192c196cdd7cfe3ae4025819ac806215eef5baba3925591a153af891ad030c03101da3e01ebe77279ebc2492934204a425103034d9872dec05c388c3952bbefc1e8bf11f41e4305bb695a5fea26facf8b9ebfc4a180a6618274368f24148438b8fe8acde43db3bd436f0dabbfdf8a53626483696ee56faa6443edc695ff501f3fe91167ab9023c6730dff200f5b8ca9f4164fdf66ff5506b9b52b1edaeb1ba49aee5044686d67520139dd834341398360009b9f31338888e907abb85233516c929f29d134a2cc4a335a404f00e6dbf1fd2e321a44faaa8ed8a69752d7c24b2964f0aa50be371ffa5626f0514b5e91170992755e3ac028e1ab565ef21bcd85c47844c3cd1c75c1917fb840a9a5d213726c81ba34466b869d00fdff7a205948b883ae0308a1a428c2f434394fef7a4cd2a5a74f8c900257149b1ff0fda6168b8ec6e76a8262758bd9e8f9fa77f108c264e7ff9ff435b9e4786ed002d413ac228ec96cf128bbde880daa1e7698a37625a661fb3876a22a7d3f8e4fff2011872d8758fc6ca92069fb680db6c4fc4044457723a993f87476552fef57f8423fc4915e65dddd9d526da3095f33bb24d58f8d829e110b2115d40baaa5fa329e408f1ca12d50472b84b584305cd2bba616d83f617b94c8a4e4e458ffa32a51e21285f8593e300e381cbeac990f9ab2436a16b8db3471217eb318e59610a95ae024536ad8ca038d7f7dd5b9e2696c8e38b742c2d0523500656643ee67a26bddcfd3d43f1fce7cf9cfd49b15f16b87222357b706dcb4bf69c0b49496a504c198e2a1e15958c87f74ef13f224dbb54fc19ea49dd111f1309812ca1d5e6508db16dc6d7c7663f6a8956ccc049d93b993529c9d19cd817e251895ba116f2a6059a89069d43656a83b3939628a9df62b5198285531d170d85bffba429347bcc54642fd4efc34065fe3ba8717b87b109849b6e36939941dfc24a27e1df8ce257e96c3e0395ac7468029deef5fc8924e1ab2a6f27ecbe37e06b0b9b610f460e973499950a567f77f4b8dfc743508abcc0ca34a603d9f2eec6f8e0f743771c5654f3ab98d2f85ba53ca85b589eb1b6ae6cfed2d9d225dd7cbd966a2beb2055ea3ea1525e16b08ae556f7b063507338d22c2e3bbddb6afc53c4e00963ec97e2aee9803daf9e5a2e06bcc5f0f28f7d48fedcbf512e44032f863eb3ddeaeb03cd3cf321442dc6b29624a55b5fdb5888bafde1d4885bbae81efe2e4b1dddcd752a29d90b90e72f6e6d2502f812eb939e3d4635e99a9970bb6a7dbfef8c8ca3cb99e38151b4f3e3fe0bf985842dd6230ce6d30b5bfbd340611601b06fed7ef41fc31eae19a1ec9908bc85e89ee4d5e5da6057943f42f67565f012941b8a0811adc07209d19d3b779ab523c7b735ada1f0c5c6d9f3746d995eade1a28de8671ea8a379a2405e68925cefd94ca4d2b62e2da7b25990b5f8e1cbd075965d5a6ca5ef6c50fe1028b6e2d3eff051c219127743735ba76a6bb3cb9aa692aea3820eb195f32314c14c5cd63ae08046d5c38b3fd751839894b4644109e7e14dcedddc340dc6a9f9626d53738ab0ac36678bd5b846a1e3d3cc04cf91f2ef9b47f561a64f876f3514afa18598feda0bd5ede80b178ed440d25b3dd662afdc387109941e24ed088d925f77c4a79650e705b73e7dbbc60955388d6b9f3dc10f1b1c8f154a7808e33760ccb9b2bb07c7457c49b6aa3f4de8feb7d3337bbe35d0d4683a1840770cdd066d3ec85983c8cb5a9647bf2020bb7d23272364228e84b1b2b977b2d9c6e67c822b4e23594d6c9f13dfee3669d2a669bd0e3dae84fc2b9ebf9b96ccc495ab0fffabb5ceb98e8e403878244c50593f145e0c287f40a3a11bc06b5d6d7a21bd420a9040ff661a3b02ab4b7e7ad55f3c42c3fd49674026d919b78927dd16f24c2da677442d876cacbf148999177c9dfabc2398cc4c4f8950f77e42909367061e30e095261a1b702cd836930868b21978598b63505d8cf08552aeebdf51c4a2fa2dcdc11ffadc3080a688fe620c238b7debd54ce38dcbd7d71c8f9ae3a2298178f2fc768cbb3251c3e5a4766c5a6dd332f6d50bf92864aac9f5e5908a17742f6967c20a48ca62ea2b6ae3cc8b15bbdeb44312f007c84904fe368b4a12c452ebcaaefe84ec1758109a8e3746d75dd5e6adb987de272173ca636e5f73bd5d3a8995b507d6b02a478db8a1775e806cb29ef602a43efeac341f8ea0d454023c5dfe19a11e3f9953e6db58c4d377910b1f7ae7842c0e04ae98c4b81cb52933e5897e02b5f5044bb1f99d16a2666c5bedfb34aa0e77372d4d1f433d124571e3f5cd5c0a5bba33c1833f23694149405bb30aaa8969e85b00d9d5a626bf86ea15071a581c9b7e5cafbd33b7d115a984af5a81abf48dc66275844bd61871f447dc4e40315217d547aa46f146988342f726b95a60236cc6c88b4c5d25315f3da9e81299f532781b74ad7eb16384d5dbd388952ef303aa3a2d482f2d02b653dbfd60994aa8e731e56267cc7fdf65e53c3278907028e51fe78bf07b45291fb59ab65c21d5ded9e51a4497d9ec7b81b8ea993a678c7872946ceb0a3be88d6e8d09a176c0e3bf6bfc6fd2f748300cead9371c13225d196b4cd83193bbd27b8d1b7e5b2a7ad1f5e779af6a316dfc0553dbec935fadb82fe7cfb432b2d0ae152bd64e0d3910839634a9ba2d05e6dbad83759a79be345efc605857e2b30226d03f39aca6adc5e4b7fc93fa295a66e410b8c20b0554ea6656aae098b7b3ffd40cc1989ec151b65cddc9aaf50a8ffce0e8853cfb9d6f58dc3afd75a0a193f9c0424e06c5e39a9dbf68911401ecd2a6cc79fd77e23602aa2c125ecdeb6bc22a6f46c633c1ab255d382920c17b5a18145fbdb93f423e098424b884cc8ed8e0339456ebf5801fd49211e91be196643722dd090ec42c0700b9f518d5aee1036d0c84b671775964a0be96f5d", 0x1000}], 0x5, 0x9, 0x0, 0x4, 0x80, 0x51, 0x6, 0x5}) chdir(&(0x7f00000003c0)='./bus\x00') bpf$MAP_CREATE(0x0, &(0x7f0000001300)=@base={0x9, 0x18, 0x8, 0x40, 0x42, 0x1}, 0x50) r10 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8042, 0x40) accept4(r10, &(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f0000000100)=0x80, 0x80800) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-vmsplice-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_COALESCE_SET-syz_usb_control_io$hid detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000000000106a053103000000000001090224000100008000090400101c0300010009210000000122f80409058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000002380)=[{&(0x7f0000000280)="ce49e8ea0be2ef5c9562604023a05e703c0a4742aed70c9a063077a367f336bb8d24d86d5e59a65d978c04d1852c04b998616b14ede3cc3558102de39352f9c47fe8b3ac1f64a1a2", 0x48}], 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x18, r2, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@ETHTOOL_A_COALESCE_HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x2000c812}, 0x404c080) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY-syz_genetlink_get_family_id$tipc-syz_genetlink_get_family_id$batadv-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$nl_generic-sendmsg$BATADV_CMD_GET_VLAN-setsockopt$IP6T_SO_SET_REPLACE detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000002640), r3) r6 = syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40b113420000010000000109024a0001010080fa0904000008ffffff000705810200020007058202000200070583020002000705840340000107050102000200070502020002000705030200020007050402000200"], 0x0) syz_usb_ep_read(r6, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r6, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r6, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r6, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r6, 0x81, 0x10, &(0x7f0000000000)) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$nl_generic(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYRES32=r0], 0x24}}, 0x0) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000002700)={0x0, 0x0, &(0x7f00000026c0)={&(0x7f0000002680)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="090227bd70f2d892fd90bf26a3a5"], 0x14}, 0x1, 0x0, 0x0, 0x850}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000900)=@security={'security\x00', 0xe, 0x4, 0x518, 0xffffffff, 0x208, 0x0, 0x208, 0xffffffff, 0xffffffff, 0x448, 0x448, 0x448, 0xffffffff, 0x4, &(0x7f0000000300), {[{{@uncond, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0xb, 0xece8, 0xfffffff5, 0x2}}}, {{@ipv6={@private1, @mcast2, [0xff000000, 0xffffff00, 0xffffff00, 0xffffff00], [0xff, 0xff000000, 0x0, 0xff], 'bond0\x00', 'sit0\x00', {}, {}, 0x4, 0x0, 0x2, 0x63}, 0x0, 0xf0, 0x130, 0x0, {}, [@common=@hbh={{0x48}, {0x1, 0x2, 0x0, [0x7, 0x5, 0x1, 0x5, 0x673, 0x7b7, 0x3, 0x36, 0x1, 0x0, 0x8, 0x6236, 0x5, 0xdc, 0x1, 0x7], 0xd}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x95, 0x28, "07d47d5cc10441c7671a12e9557d24b3aafcca736932516c6928fd4e7a14"}}}, {{@ipv6={@local, @private0, [0x0, 0xffffff00, 0xffffff00, 0xffffff], [0xff000000, 0xffffff00, 0xffffff00, 0xffffff00], 'bridge_slave_0\x00', 'pim6reg1\x00', {0xeb40be7c54da356d}, {0xff}, 0x33, 0x0, 0x2, 0x7b}, 0x0, 0x1e0, 0x240, 0x0, {}, [@common=@rt={{0x138}, {0x7, [0x8, 0x3ff], 0xcfca, 0x4, 0x0, [@private1={0xfc, 0x1, '\x00', 0x1}, @private0={0xfc, 0x0, '\x00', 0x1}, @rand_addr=' \x01\x00', @private0, @remote, @loopback, @dev={0xfe, 0x80, '\x00', 0x23}, @dev={0xfe, 0x80, '\x00', 0x2a}, @private2={0xfc, 0x2, '\x00', 0x1}, @local, @remote, @empty, @loopback, @local, @loopback, @private2={0xfc, 0x2, '\x00', 0x1}], 0x3}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@dev={0xfe, 0x80, '\x00', 0xb}, [0xff, 0x0, 0xffffffff, 0xff000000], 0x4e23, 0x4e21, 0x4e20, 0x4e23, 0x80000001, 0xfff9, 0x5, 0xffffffff, 0x5}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x578) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY-syz_genetlink_get_family_id$tipc-syz_genetlink_get_family_id$batadv-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$nl_generic-sendmsg$BATADV_CMD_GET_VLAN detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000002640), r3) r6 = syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40b113420000010000000109024a0001010080fa0904000008ffffff000705810200020007058202000200070583020002000705840340000107050102000200070502020002000705030200020007050402000200"], 0x0) syz_usb_ep_read(r6, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r6, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r6, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r6, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r6, 0x81, 0x10, &(0x7f0000000000)) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$nl_generic(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYRES32=r0], 0x24}}, 0x0) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000002700)={0x0, 0x0, &(0x7f00000026c0)={&(0x7f0000002680)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="090227bd70f2d892fd90bf26a3a5"], 0x14}, 0x1, 0x0, 0x0, 0x850}, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY-syz_genetlink_get_family_id$tipc-syz_genetlink_get_family_id$batadv-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$nl_generic detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) syz_genetlink_get_family_id$batadv(&(0x7f0000002640), r3) r5 = syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40b113420000010000000109024a0001010080fa0904000008ffffff000705810200020007058202000200070583020002000705840340000107050102000200070502020002000705030200020007050402000200"], 0x0) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$nl_generic(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYRES32=r0], 0x24}}, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY-syz_genetlink_get_family_id$tipc-syz_genetlink_get_family_id$batadv-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-socket$nl_generic-syz_genetlink_get_family_id$nl80211 detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) syz_genetlink_get_family_id$batadv(&(0x7f0000002640), r3) r5 = syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40b113420000010000000109024a0001010080fa0904000008ffffff000705810200020007058202000200070583020002000705840340000107050102000200070502020002000705030200020007050402000200"], 0x0) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY-syz_genetlink_get_family_id$tipc-syz_genetlink_get_family_id$batadv-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-socket$nl_generic detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) syz_genetlink_get_family_id$batadv(&(0x7f0000002640), r3) r5 = syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40b113420000010000000109024a0001010080fa0904000008ffffff000705810200020007058202000200070583020002000705840340000107050102000200070502020002000705030200020007050402000200"], 0x0) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) socket$nl_generic(0x10, 0x3, 0x10) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY-syz_genetlink_get_family_id$tipc-syz_genetlink_get_family_id$batadv-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) syz_genetlink_get_family_id$batadv(&(0x7f0000002640), r3) r5 = syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40b113420000010000000109024a0001010080fa0904000008ffffff000705810200020007058202000200070583020002000705840340000107050102000200070502020002000705030200020007050402000200"], 0x0) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY-syz_genetlink_get_family_id$tipc-syz_genetlink_get_family_id$batadv-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) syz_genetlink_get_family_id$batadv(&(0x7f0000002640), r3) r5 = syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40b113420000010000000109024a0001010080fa0904000008ffffff000705810200020007058202000200070583020002000705840340000107050102000200070502020002000705030200020007050402000200"], 0x0) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY-syz_genetlink_get_family_id$tipc-syz_genetlink_get_family_id$batadv-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read-syz_usb_ep_read detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) syz_genetlink_get_family_id$batadv(&(0x7f0000002640), r3) r5 = syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40b113420000010000000109024a0001010080fa0904000008ffffff000705810200020007058202000200070583020002000705840340000107050102000200070502020002000705030200020007050402000200"], 0x0) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY-syz_genetlink_get_family_id$tipc-syz_genetlink_get_family_id$batadv-syz_usb_connect-syz_usb_ep_read-syz_usb_ep_read detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) syz_genetlink_get_family_id$batadv(&(0x7f0000002640), r3) r5 = syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40b113420000010000000109024a0001010080fa0904000008ffffff000705810200020007058202000200070583020002000705840340000107050102000200070502020002000705030200020007050402000200"], 0x0) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY-syz_genetlink_get_family_id$tipc-syz_genetlink_get_family_id$batadv-syz_usb_connect-syz_usb_ep_read detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) syz_genetlink_get_family_id$batadv(&(0x7f0000002640), r3) r5 = syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40b113420000010000000109024a0001010080fa0904000008ffffff000705810200020007058202000200070583020002000705840340000107050102000200070502020002000705030200020007050402000200"], 0x0) syz_usb_ep_read(r5, 0x81, 0x10, &(0x7f0000000000)) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY-syz_genetlink_get_family_id$tipc-syz_genetlink_get_family_id$batadv-syz_usb_connect detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) syz_genetlink_get_family_id$batadv(&(0x7f0000002640), r3) syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40b113420000010000000109024a0001010080fa0904000008ffffff000705810200020007058202000200070583020002000705840340000107050102000200070502020002000705030200020007050402000200"], 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY-syz_genetlink_get_family_id$tipc-syz_genetlink_get_family_id$batadv detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) syz_genetlink_get_family_id$batadv(&(0x7f0000002640), r3) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY-syz_genetlink_get_family_id$tipc detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) syz_genetlink_get_family_id$tipc(&(0x7f0000000440), r3) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64-sendmsg$NL80211_CMD_SET_WIPHY detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r4, &(0x7f0000000f80)=""/4096, 0x1000) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="14008000", @ANYRES16=0x0, @ANYBLOB="040027bd7000fedbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x28000}, 0x8000) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir-getdents64 detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) getdents64(r3, &(0x7f0000000f80)=""/4096, 0x1000) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap-openat$dir detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir-mmap detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs-chdir detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-syz_mount_image$fuse detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) program did not crash testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-socket$nl_generic-mount$incfs detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) socket$nl_generic(0x10, 0x3, 0x10) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-sendmmsg-syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000880)=[{{&(0x7f0000000080)=@qipcrtr={0x2a, 0x2, 0x4000}, 0x80, 0x0}}, {{&(0x7f0000000180)=@xdp={0x2c, 0x7, 0x0, 0x35}, 0x80, 0x0}}], 0x2, 0x45) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-setsockopt$packet_tx_ring-syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x9, 0x2, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-socket$packet-syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) socket$packet(0x11, 0x3, 0x300) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-mount$9p_fd-syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0), 0x200000, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-listen-syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1}, 0xc) listen(r0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-bind$unix-syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1}, 0xc) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-socket$unix-syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) socket$unix(0x1, 0x1, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-creat-syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f0000000200)='./file1\x00', 0x12e) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, 0x0, 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(0x0, &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', 0x0, &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', 0x0, 0x1004002, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=37.358148222s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir simplifying C reproducer testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program did not crash testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program did not crash testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program did not crash testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program did not crash testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true testing program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true testing program (duration=37.358148222s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$fuse-mount$incfs detailed listing: executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true reproducing took 49m50.141906711s repro crashed as (corrupted=false): RBP: 00007ffed98cf730 R08: 00007ffed98d0730 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffed98d07c0 R13: 00007f7721e34474 R14: 000000000000753c R15: 00007ffed98d0800 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:102 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:198 [inline] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:455 Write of size 4 at addr 0000000000000170 by task syz-executor/370 CPU: 0 PID: 370 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_report+0x3d/0x60 mm/kasan/report.c:423 kasan_report+0x122/0x150 mm/kasan/report.c:524 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:102 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:198 [inline] ihold+0x20/0x60 fs/inode.c:455 d_delete_notify include/linux/fsnotify.h:289 [inline] vfs_rmdir+0x24c/0x4f0 fs/namei.c:4211 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1995 deactivate_locked_super+0xb5/0x120 fs/super.c:336 deactivate_super+0xaf/0xe0 fs/super.c:367 cleanup_mnt+0x45e/0x4e0 fs/namespace.c:1192 __cleanup_mnt+0x19/0x20 fs/namespace.c:1199 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f7721d9f317 Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffed98cf678 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f7721d9f317 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffed98cf730 RBP: 00007ffed98cf730 R08: 00007ffed98d0730 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffed98d07c0 R13: 00007f7721e34474 R14: 000000000000753c R15: 00007ffed98d0800 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000170 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 12cb07067 P4D 12cb07067 PUD 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 0 PID: 370 Comm: syz-executor Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:440 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:199 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:455 Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 c1 1e ab ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 ac f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 b1 RSP: 0018:ffffc90000a17ca0 EFLAGS: 00010246 RAX: ffff888113f11400 RBX: 0000000000000000 RCX: ffff888113f11440 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000a17cb0 R08: ffffffff87b757e7 R09: 1ffffffff0f6eafc R10: dffffc0000000000 R11: fffffbfff0f6eafd R12: ffff8881100c7944 R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055558902d500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000012d08f000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:289 [inline] vfs_rmdir+0x24c/0x4f0 fs/namei.c:4211 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1995 deactivate_locked_super+0xb5/0x120 fs/super.c:336 deactivate_super+0xaf/0xe0 fs/super.c:367 cleanup_mnt+0x45e/0x4e0 fs/namespace.c:1192 __cleanup_mnt+0x19/0x20 fs/namespace.c:1199 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f7721d9f317 Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffed98cf678 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f7721d9f317 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffed98cf730 RBP: 00007ffed98cf730 R08: 00007ffed98d0730 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffed98d07c0 R13: 00007f7721e34474 R14: 000000000000753c R15: 00007ffed98d0800 Modules linked in: CR2: 0000000000000170 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:440 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:199 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:455 Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 c1 1e ab ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 ac f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 b1 RSP: 0018:ffffc90000a17ca0 EFLAGS: 00010246 RAX: ffff888113f11400 RBX: 0000000000000000 RCX: ffff888113f11440 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000a17cb0 R08: ffffffff87b757e7 R09: 1ffffffff0f6eafc R10: dffffc0000000000 R11: fffffbfff0f6eafd R12: ffff8881100c7944 R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055558902d500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000012d08f000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 33 36 xor (%rsi),%esi 2: 7c df jl 0xffffffe3 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 c1 1e ab ff call 0xffab1ed4 13: 48 8d bb 70 01 00 00 lea 0x170(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 00 ac f0 ff call 0xfff0ac24 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 70 01 lock xadd %r14d,0x170(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: b1 .byte 0xb1 final repro crashed as (corrupted=false): RBP: 00007ffed98cf730 R08: 00007ffed98d0730 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffed98d07c0 R13: 00007f7721e34474 R14: 000000000000753c R15: 00007ffed98d0800 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:102 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:198 [inline] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:455 Write of size 4 at addr 0000000000000170 by task syz-executor/370 CPU: 0 PID: 370 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_report+0x3d/0x60 mm/kasan/report.c:423 kasan_report+0x122/0x150 mm/kasan/report.c:524 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:102 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:198 [inline] ihold+0x20/0x60 fs/inode.c:455 d_delete_notify include/linux/fsnotify.h:289 [inline] vfs_rmdir+0x24c/0x4f0 fs/namei.c:4211 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1995 deactivate_locked_super+0xb5/0x120 fs/super.c:336 deactivate_super+0xaf/0xe0 fs/super.c:367 cleanup_mnt+0x45e/0x4e0 fs/namespace.c:1192 __cleanup_mnt+0x19/0x20 fs/namespace.c:1199 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f7721d9f317 Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffed98cf678 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f7721d9f317 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffed98cf730 RBP: 00007ffed98cf730 R08: 00007ffed98d0730 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffed98d07c0 R13: 00007f7721e34474 R14: 000000000000753c R15: 00007ffed98d0800 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000170 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 12cb07067 P4D 12cb07067 PUD 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 0 PID: 370 Comm: syz-executor Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:440 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:199 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:455 Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 c1 1e ab ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 ac f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 b1 RSP: 0018:ffffc90000a17ca0 EFLAGS: 00010246 RAX: ffff888113f11400 RBX: 0000000000000000 RCX: ffff888113f11440 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000a17cb0 R08: ffffffff87b757e7 R09: 1ffffffff0f6eafc R10: dffffc0000000000 R11: fffffbfff0f6eafd R12: ffff8881100c7944 R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055558902d500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000012d08f000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:289 [inline] vfs_rmdir+0x24c/0x4f0 fs/namei.c:4211 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1995 deactivate_locked_super+0xb5/0x120 fs/super.c:336 deactivate_super+0xaf/0xe0 fs/super.c:367 cleanup_mnt+0x45e/0x4e0 fs/namespace.c:1192 __cleanup_mnt+0x19/0x20 fs/namespace.c:1199 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f7721d9f317 Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffed98cf678 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f7721d9f317 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffed98cf730 RBP: 00007ffed98cf730 R08: 00007ffed98d0730 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffed98d07c0 R13: 00007f7721e34474 R14: 000000000000753c R15: 00007ffed98d0800 Modules linked in: CR2: 0000000000000170 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:440 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:199 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:455 Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 c1 1e ab ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 ac f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 b1 RSP: 0018:ffffc90000a17ca0 EFLAGS: 00010246 RAX: ffff888113f11400 RBX: 0000000000000000 RCX: ffff888113f11440 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000a17cb0 R08: ffffffff87b757e7 R09: 1ffffffff0f6eafc R10: dffffc0000000000 R11: fffffbfff0f6eafd R12: ffff8881100c7944 R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055558902d500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000012d08f000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 33 36 xor (%rsi),%esi 2: 7c df jl 0xffffffe3 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 c1 1e ab ff call 0xffab1ed4 13: 48 8d bb 70 01 00 00 lea 0x170(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 00 ac f0 ff call 0xfff0ac24 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 70 01 lock xadd %r14d,0x170(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: b1 .byte 0xb1