Extracting prog: 1h25m34.69688002s Minimizing prog: 1h12m3.443249768s Simplifying prog options: 1m41.003323907s Extracting C: 53.096098701s Simplifying C: 4m11.331912659s extracting reproducer from 69 programs testing a last program of every proc single: executing 19 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-syz_usb_control_io$printer-syz_usb_control_io$lan78xx-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETOFFLOAD-openat$tun-ioctl$TUNSETIFF-syz_usb_control_io$uac1 detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="5b5f2562b510f210950b2a777382010203b41da35cbef047c54fc016480109022400010000000009000000000000008109050a02ff0300fa000905820250"], 0x0) r1 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f0000000600)=ANY=[@ANYBLOB="001606"], 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOFFLOAD(r2, 0x400454ce, 0xb) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) syz_usb_control_io$uac1(r0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$sock_SIOCETHTOOL-syz_usb_connect$uac1-socket-ioctl$sock_SIOCETHTOOL-syz_usb_connect$uac1 detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000001100)={'veth1\x00', &(0x7f0000000040)=@ethtool_link_settings={0x4c, 0x100, 0x0, 0x4, 0x40, 0x7, 0x2c, 0x4b, 0x1, 0x4, [0x6, 0x8, 0xffff, 0xc1e, 0x47a3, 0x40d9e, 0x1d, 0x1]}}) syz_usb_connect$uac1(0x3, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000010392aa03f4000010203010902600003010500080904000000010100000a240107000a000216020904010000010200000904010101010200000905010920000b0307072501040401000904020000010200000904020101010200000905820940000d070607250104010600"], 0x0) socket(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000001100)={'veth1\x00', &(0x7f0000000040)=@ethtool_link_settings={0x4c, 0x100, 0x0, 0x4, 0x40, 0x7, 0x2c, 0x4b, 0x1, 0x4, [0x6, 0x8, 0xffff, 0xc1e, 0x47a3, 0x40d9e, 0x1d, 0x1]}}) (async) syz_usb_connect$uac1(0x3, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000010392aa03f4000010203010902600003010500080904000000010100000a240107000a000216020904010000010200000904010101010200000905010920000b0307072501040401000904020000010200000904020101010200000905820940000d070607250104010600"], 0x0) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-landlock_create_ruleset-landlock_restrict_self-bind$inet detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc20a, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x110, 0x2d, "", [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x8001, 0x9, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x0, 0x5, 0x3}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000140)={0x0, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ioctl$HIDIOCGUSAGE-syz_usb_connect detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022400010000000009040000150300000009214000000122"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000140), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, &(0x7f00000001c0)={0x3, 0xffffffff, 0x0, 0x8, 0x7, 0x7}) syz_usb_connect(0x2, 0x3f, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-eventfd2-open-socketpair$nbd-pipe2$9p-mount$9p_fd-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_clone-write$P9_RVERSION-mkdirat-mount-openat-ioctl-unshare-socket$packet-memfd_create-openat$sysfs-openat-write$rfkill-fsconfig$FSCONFIG_SET_PATH-socket$can_bcm-connect$can_bcm-syz_usb_connect-socket$packet-getsockopt$XDP_STATISTICS-ioctl$sock_SIOCGIFINDEX-sendmsg$can_bcm-setsockopt$packet_int detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = eventfd2(0x50, 0x0) (async) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x1) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f0000001240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}]}}) (async) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x0, 0xfffffffffffffffd}, 0x0) (async) sched_setscheduler(0x0, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) (async) write$P9_RVERSION(r3, &(0x7f0000000180)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r0, @ANYRESHEX=r3], 0x15) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r4, 0xc138fd06, &(0x7f0000003000)="040000000000000000000000380100000000000000000000000000000000000000000000000000006d") (async) unshare(0x22020600) (async) r5 = socket$packet(0x11, 0x3, 0x300) (async) r6 = memfd_create(&(0x7f0000000180)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xecz\xabq\x95t*T9\xa9\b X \x04\"\x17\xbf\xcb\xccF\xda\xcf\xdd^\xa0\x15\xc0\xcb^h>\x1b\xb5d\xc7\x7f0\x9a&\xb0\x12#\x9c`\xa6\xed\x05\x95g\a\xccYb\xaf\xe9\xb6G?\x9f\xf5\xfe\xc1\xc0JJ\xc8\xd9d\x80\x13\x8fX\xb4\x19\xc4\\\xcb\x89-)\x90\x01\v\xac^\xdbBQ|\xaej;\x92\\\xf8u\x19Y\xee\x99EI\xf1t\xadn<\x9b\xc9\x87\xd0\xa7\x1a\x81\xb9\xc87sq\xd7\x15\xd6\x91O\x9c\x99!9>\xff\xa8\xfa\xe6=d\xcf\xca\xa9\xc61!\xc6P\x13\xd0\x88gZ\xbe\xdfl\xfa\xff\xb0m;d07tx\xbb\xabd\xe5\x16\xc4\xae\xf0', 0x0) (async) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/rcu_expedited', 0x169a82, 0x109) (async) r8 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/vm/drop_caches\x00', 0x1, 0x0) write$rfkill(r8, &(0x7f0000000180)={0x8, 0x4, 0x1, 0x0, 0x1}, 0x8) (async) fsconfig$FSCONFIG_SET_PATH(r8, 0x3, &(0x7f00000023c0)='fsc_ypt:', &(0x7f0000002400)='./file0\x00', r7) r9 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r9, &(0x7f0000000080), 0x10) syz_usb_connect(0x0, 0x5a, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ec13b2106d04f308280b0102030109024800010000000009046900000e0100002b4101", @ANYRESHEX=0x0, @ANYRES64], 0x0) (async) r10 = socket$packet(0x11, 0x3, 0x300) getsockopt$XDP_STATISTICS(r8, 0x11b, 0x7, &(0x7f0000000340), &(0x7f0000000380)=0x30) (async) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000040)={'gre0\x00', 0x0}) sendmsg$can_bcm(r9, &(0x7f00000002c0)={&(0x7f0000000000)={0x1d, r11}, 0x10, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYRES64=r6], 0x48}}, 0x0) setsockopt$packet_int(r5, 0x107, 0x3, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-eventfd2-open-socketpair$nbd-pipe2$9p-mount$9p_fd-prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-syz_clone-write$P9_RVERSION-mkdirat-mount-openat-ioctl-unshare-socket$packet-memfd_create-openat$sysfs-openat-write$rfkill-fsconfig$FSCONFIG_SET_PATH-socket$can_bcm-connect$can_bcm-syz_usb_connect-socket$packet-getsockopt$XDP_STATISTICS-ioctl$sock_SIOCGIFINDEX-sendmsg$can_bcm-setsockopt$packet_int detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = eventfd2(0x50, 0x0) (async) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x1) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f0000001240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_9p2000}]}}) (async) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x0, 0xfffffffffffffffd}, 0x0) (async) sched_setscheduler(0x0, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) (async) write$P9_RVERSION(r3, &(0x7f0000000180)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r0, @ANYRESHEX=r3], 0x15) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r4, 0xc138fd06, &(0x7f0000003000)="040000000000000000000000380100000000000000000000000000000000000000000000000000006d") (async) unshare(0x22020600) (async) r5 = socket$packet(0x11, 0x3, 0x300) (async) r6 = memfd_create(&(0x7f0000000180)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xecz\xabq\x95t*T9\xa9\b X \x04\"\x17\xbf\xcb\xccF\xda\xcf\xdd^\xa0\x15\xc0\xcb^h>\x1b\xb5d\xc7\x7f0\x9a&\xb0\x12#\x9c`\xa6\xed\x05\x95g\a\xccYb\xaf\xe9\xb6G?\x9f\xf5\xfe\xc1\xc0JJ\xc8\xd9d\x80\x13\x8fX\xb4\x19\xc4\\\xcb\x89-)\x90\x01\v\xac^\xdbBQ|\xaej;\x92\\\xf8u\x19Y\xee\x99EI\xf1t\xadn<\x9b\xc9\x87\xd0\xa7\x1a\x81\xb9\xc87sq\xd7\x15\xd6\x91O\x9c\x99!9>\xff\xa8\xfa\xe6=d\xcf\xca\xa9\xc61!\xc6P\x13\xd0\x88gZ\xbe\xdfl\xfa\xff\xb0m;d07tx\xbb\xabd\xe5\x16\xc4\xae\xf0', 0x0) (async) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/rcu_expedited', 0x169a82, 0x109) (async) r8 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/vm/drop_caches\x00', 0x1, 0x0) write$rfkill(r8, &(0x7f0000000180)={0x8, 0x4, 0x1, 0x0, 0x1}, 0x8) (async) fsconfig$FSCONFIG_SET_PATH(r8, 0x3, &(0x7f00000023c0)='fsc_ypt:', &(0x7f0000002400)='./file0\x00', r7) r9 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r9, &(0x7f0000000080), 0x10) syz_usb_connect(0x0, 0x5a, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ec13b2106d04f308280b0102030109024800010000000009046900000e0100002b4101", @ANYRESHEX=0x0, @ANYRES64], 0x0) (async) r10 = socket$packet(0x11, 0x3, 0x300) getsockopt$XDP_STATISTICS(r8, 0x11b, 0x7, &(0x7f0000000340), &(0x7f0000000380)=0x30) (async) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000040)={'gre0\x00', 0x0}) sendmsg$can_bcm(r9, &(0x7f00000002c0)={&(0x7f0000000000)={0x1d, r11}, 0x10, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYRES64=r6], 0x48}}, 0x0) setsockopt$packet_int(r5, 0x107, 0x3, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): quotactl$Q_SYNC detailed listing: executing program 0: quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_PIT-setsockopt$SO_ATTACH_FILTER-quotactl$Q_SYNC detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_PIT(r2, 0x4020aeb2, 0x0) (async) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x20, 0x0, 0x0, 0xfffff00d}]}, 0x10) (async) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): quotactl$Q_SYNC detailed listing: executing program 0: quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-mmap$IORING_OFF_SQ_RING-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_PIT-setsockopt$SO_ATTACH_FILTER-quotactl$Q_SYNC detailed listing: executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_PIT(r2, 0x4020aeb2, 0x0) (async) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x20, 0x0, 0x0, 0xfffff00d}]}, 0x10) (async) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-execveat-sendmmsg$inet6-openat$kvm-ioctl$KVM_CREATE_VM-mkdirat$cgroup_root-ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS-openat$cgroup_root-openat$cgroup_procs-write$cgroup_pid-sync-syz_usb_connect-mkdirat-mount-setsockopt$sock_int-recvmmsg-write$binfmt_misc-openat-ioctl-openat$cgroup_ro-write$binfmt_script-mmap-preadv-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000040)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc0sr\x95\xbf3:\x99\x02\x00\x00\x00\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\x00\x01\x00\x00\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x92\xe3 P\xbf\xa0\v`s\xec\x18>(\xc2N\xb4\xa0\\\xf2\x1a\xd1v7\x0f\x91', 0x0) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000077c0)=[{{0x0, 0x0, &(0x7f0000002540)=[{&(0x7f0000000040)="71fd6b97aa047209aa044978dc3d4f0596b7fa73041569b2f234e7801e3aeac71a76b67b95f3b37abdb2f9e46e49e856bab0cd1158b6ac18e2bf", 0x3a}], 0x1}}], 0x1, 0x40) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r2, 0x8008f513, &(0x7f0000000100)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000001c0), 0x12) sync() syz_usb_connect(0x1, 0x51, &(0x7f0000000000)=ANY=[@ANYBLOB="120101024cf1c50863070210845f010203"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x22, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10000, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r5, 0xc138fd05, &(0x7f0000000000)="04000000020000000000") r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) preadv(r6, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-execveat-sendmmsg$inet6-openat$kvm-ioctl$KVM_CREATE_VM-mkdirat$cgroup_root-ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS-openat$cgroup_root-openat$cgroup_procs-write$cgroup_pid-sync-syz_usb_connect-mkdirat-mount-setsockopt$sock_int-recvmmsg-write$binfmt_misc-openat-ioctl-openat$cgroup_ro-write$binfmt_script-mmap-preadv-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_RUN detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000040)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc0sr\x95\xbf3:\x99\x02\x00\x00\x00\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\x00\x01\x00\x00\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x92\xe3 P\xbf\xa0\v`s\xec\x18>(\xc2N\xb4\xa0\\\xf2\x1a\xd1v7\x0f\x91', 0x0) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000077c0)=[{{0x0, 0x0, &(0x7f0000002540)=[{&(0x7f0000000040)="71fd6b97aa047209aa044978dc3d4f0596b7fa73041569b2f234e7801e3aeac71a76b67b95f3b37abdb2f9e46e49e856bab0cd1158b6ac18e2bf", 0x3a}], 0x1}}], 0x1, 0x40) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r2, 0x8008f513, &(0x7f0000000100)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000001c0), 0x12) sync() syz_usb_connect(0x1, 0x51, &(0x7f0000000000)=ANY=[@ANYBLOB="120101024cf1c50863070210845f010203"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x22, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10000, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r5, 0xc138fd05, &(0x7f0000000000)="04000000020000000000") r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) preadv(r6, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe2$9p-pipe2$9p-mkdirat-socket-sendmsg$nl_generic-mount$9p_fd-write$P9_RVERSION-syz_open_dev$MSR-landlock_create_ruleset-landlock_restrict_self-syz_open_procfs-ioctl$sock_inet6_udp_SIOCINQ-write$P9_RATTACH-openat$selinux_status-gettid-socket-sendmsg$nl_generic-sendmsg$nl_generic-recvmmsg-fcntl$dupfd-write$P9_RGETATTR detailed listing: executing program 0: pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0) (async, rerun: 64) pipe2$9p(&(0x7f0000000010)={0x0, 0x0}, 0x0) (rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) (async) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004c80)=ANY=[@ANYBLOB="140000001600010000000000000000000a000000ae8ac2165847a9c5d9a0d1c3010251162d90c99ca4ccac72baca3ab5f61bb1ba063bc89d98dbb9eee79beb726c28831753aa6e6caae079"], 0x14}}, 0x0) (async) mount$9p_fd(0x0, &(0x7f0000000200)='./mnt\x00', &(0x7f0000000240), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r3]) (async) write$P9_RVERSION(r1, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x2000, 0x8, '9P2000.L'}, 0x15) syz_open_dev$MSR(0x0, 0x0, 0x0) (async, rerun: 64) r5 = landlock_create_ruleset(&(0x7f0000000080)={0x2832, 0x0, 0x2}, 0x18, 0x0) (rerun: 64) landlock_restrict_self(r5, 0x0) (async) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') ioctl$sock_inet6_udp_SIOCINQ(r6, 0xc02063a1, 0x0) (async) write$P9_RATTACH(r1, &(0x7f0000000080)={0x14, 0x69, 0x0, {0x80}}, 0x14) r7 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) (async) gettid() (async) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001c0021ef000000000000000007000000160000000200fc000a0002"], 0x28}, 0x1, 0x0, 0x0, 0x4000090}, 0x8010) (async) sendmsg$nl_generic(r8, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) recvmmsg(r8, &(0x7f0000004ac0)=[{{&(0x7f00000002c0)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @dev}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000340)=""/96, 0x60}, {&(0x7f00000003c0)=""/152, 0x98}, {&(0x7f0000000480)=""/255, 0xff}, {&(0x7f0000000580)=""/35, 0x23}], 0x4}, 0x6}, {{&(0x7f0000000600)=@xdp, 0x80, &(0x7f0000000680)}, 0x4}, {{&(0x7f00000006c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001a00)=[{&(0x7f0000000740)=""/51, 0x33}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000001780)=""/41, 0x29}, {&(0x7f00000017c0)=""/9, 0x9}, {&(0x7f0000001800)=""/14, 0xe}, {&(0x7f0000001840)=""/40, 0x28}, {&(0x7f0000001880)=""/165, 0xa5}, {&(0x7f0000001940)=""/175, 0xaf}], 0x8}, 0x81}, {{&(0x7f0000001a80)=@nl=@unspec, 0x80, &(0x7f0000001dc0)=[{&(0x7f0000001b00)=""/7, 0x7}, {&(0x7f0000001b40)=""/212, 0xd4}, {&(0x7f0000001c40)=""/187, 0xbb}, {&(0x7f0000001d00)=""/133, 0x85}], 0x4, &(0x7f0000001e00)=""/215, 0xd7}, 0x3}, {{0x0, 0x0, &(0x7f0000003680)=[{&(0x7f0000001f00)=""/154, 0x9a}, {&(0x7f0000001fc0)=""/131, 0x83}, {&(0x7f0000002080)=""/78, 0x4e}, {&(0x7f0000002100)=""/163, 0xa3}, {&(0x7f00000021c0)=""/231, 0xe7}, {&(0x7f00000022c0)=""/139, 0x8b}, {&(0x7f0000002380)=""/197, 0xc5}, {&(0x7f0000002480)=""/226, 0xe2}, {&(0x7f0000002580)=""/4096, 0x1000}, {&(0x7f0000003580)=""/241, 0xf1}], 0xa, &(0x7f0000003740)=""/10, 0xa}, 0xffffffff}, {{&(0x7f0000003780)=@nfc_llcp, 0x80, &(0x7f0000004a00)=[{&(0x7f0000003800)=""/146, 0x92}, {&(0x7f00000038c0)=""/198, 0xc6}, {&(0x7f00000039c0)=""/19, 0x13}, {&(0x7f0000003a00)=""/4096, 0x1000}], 0x4, &(0x7f0000004a40)=""/114, 0x72}, 0x80}], 0x6, 0x20, &(0x7f0000004c40)) (async) fcntl$dupfd(r2, 0x406, r7) (async, rerun: 64) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x3dfb, {0x80}, 0x416f, 0x0, 0x0, 0x0, 0x8000000000000000, 0x1000, 0x1000, 0x8, 0x100000000000, 0x0, 0x100000, 0x0, 0x0, 0x1}}, 0xa0) (rerun: 64) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe2$9p-pipe2$9p-mkdirat-socket-sendmsg$nl_generic-mount$9p_fd-write$P9_RVERSION-syz_open_dev$MSR-landlock_create_ruleset-landlock_restrict_self-syz_open_procfs-ioctl$sock_inet6_udp_SIOCINQ-write$P9_RATTACH-openat$selinux_status-gettid-socket-sendmsg$nl_generic-sendmsg$nl_generic-recvmmsg-fcntl$dupfd-write$P9_RGETATTR detailed listing: executing program 0: pipe2$9p(&(0x7f0000000000)={0x0, 0x0}, 0x0) (async, rerun: 64) pipe2$9p(&(0x7f0000000010)={0x0, 0x0}, 0x0) (rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) (async) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000004c80)=ANY=[@ANYBLOB="140000001600010000000000000000000a000000ae8ac2165847a9c5d9a0d1c3010251162d90c99ca4ccac72baca3ab5f61bb1ba063bc89d98dbb9eee79beb726c28831753aa6e6caae079"], 0x14}}, 0x0) (async) mount$9p_fd(0x0, &(0x7f0000000200)='./mnt\x00', &(0x7f0000000240), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r3]) (async) write$P9_RVERSION(r1, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x2000, 0x8, '9P2000.L'}, 0x15) syz_open_dev$MSR(0x0, 0x0, 0x0) (async, rerun: 64) r5 = landlock_create_ruleset(&(0x7f0000000080)={0x2832, 0x0, 0x2}, 0x18, 0x0) (rerun: 64) landlock_restrict_self(r5, 0x0) (async) r6 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') ioctl$sock_inet6_udp_SIOCINQ(r6, 0xc02063a1, 0x0) (async) write$P9_RATTACH(r1, &(0x7f0000000080)={0x14, 0x69, 0x0, {0x80}}, 0x14) r7 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) (async) gettid() (async) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001c0021ef000000000000000007000000160000000200fc000a0002"], 0x28}, 0x1, 0x0, 0x0, 0x4000090}, 0x8010) (async) sendmsg$nl_generic(r8, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) recvmmsg(r8, &(0x7f0000004ac0)=[{{&(0x7f00000002c0)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @dev}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000340)=""/96, 0x60}, {&(0x7f00000003c0)=""/152, 0x98}, {&(0x7f0000000480)=""/255, 0xff}, {&(0x7f0000000580)=""/35, 0x23}], 0x4}, 0x6}, {{&(0x7f0000000600)=@xdp, 0x80, &(0x7f0000000680)}, 0x4}, {{&(0x7f00000006c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001a00)=[{&(0x7f0000000740)=""/51, 0x33}, {&(0x7f0000000780)=""/4096, 0x1000}, {&(0x7f0000001780)=""/41, 0x29}, {&(0x7f00000017c0)=""/9, 0x9}, {&(0x7f0000001800)=""/14, 0xe}, {&(0x7f0000001840)=""/40, 0x28}, {&(0x7f0000001880)=""/165, 0xa5}, {&(0x7f0000001940)=""/175, 0xaf}], 0x8}, 0x81}, {{&(0x7f0000001a80)=@nl=@unspec, 0x80, &(0x7f0000001dc0)=[{&(0x7f0000001b00)=""/7, 0x7}, {&(0x7f0000001b40)=""/212, 0xd4}, {&(0x7f0000001c40)=""/187, 0xbb}, {&(0x7f0000001d00)=""/133, 0x85}], 0x4, &(0x7f0000001e00)=""/215, 0xd7}, 0x3}, {{0x0, 0x0, &(0x7f0000003680)=[{&(0x7f0000001f00)=""/154, 0x9a}, {&(0x7f0000001fc0)=""/131, 0x83}, {&(0x7f0000002080)=""/78, 0x4e}, {&(0x7f0000002100)=""/163, 0xa3}, {&(0x7f00000021c0)=""/231, 0xe7}, {&(0x7f00000022c0)=""/139, 0x8b}, {&(0x7f0000002380)=""/197, 0xc5}, {&(0x7f0000002480)=""/226, 0xe2}, {&(0x7f0000002580)=""/4096, 0x1000}, {&(0x7f0000003580)=""/241, 0xf1}], 0xa, &(0x7f0000003740)=""/10, 0xa}, 0xffffffff}, {{&(0x7f0000003780)=@nfc_llcp, 0x80, &(0x7f0000004a00)=[{&(0x7f0000003800)=""/146, 0x92}, {&(0x7f00000038c0)=""/198, 0xc6}, {&(0x7f00000039c0)=""/19, 0x13}, {&(0x7f0000003a00)=""/4096, 0x1000}], 0x4, &(0x7f0000004a40)=""/114, 0x72}, 0x80}], 0x6, 0x20, &(0x7f0000004c40)) (async) fcntl$dupfd(r2, 0x406, r7) (async, rerun: 64) write$P9_RGETATTR(r1, &(0x7f00000000c0)={0xa0, 0x19, 0x0, {0x3dfb, {0x80}, 0x416f, 0x0, 0x0, 0x0, 0x8000000000000000, 0x1000, 0x1000, 0x8, 0x100000000000, 0x0, 0x100000, 0x0, 0x0, 0x1}}, 0xa0) (rerun: 64) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-mkdirat-openat2-rmdir-mkdirat-mount$overlay-openat$dir-writev-socket$nl_generic-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_BEARER_ENABLE-sendmsg$TIPC_NL_KEY_FLUSH-clock_gettime-getsockopt$sock_cred detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x20400, 0x20) writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000000)={0x28, r1, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'xfrm0\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8041}, 0x0) sendmsg$TIPC_NL_KEY_FLUSH(0xffffffffffffffff, 0x0, 0x810) clock_gettime(0x0, &(0x7f0000000140)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000100)=0xc) program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns single: successfully extracted reproducer found reproducer with 17 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-mkdirat-openat2-rmdir-mkdirat-mount$overlay-openat$dir-writev-socket$nl_generic-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_BEARER_ENABLE-sendmsg$TIPC_NL_KEY_FLUSH-clock_gettime detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x20400, 0x20) writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000000)={0x28, r1, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'xfrm0\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8041}, 0x0) sendmsg$TIPC_NL_KEY_FLUSH(0xffffffffffffffff, 0x0, 0x810) clock_gettime(0x0, &(0x7f0000000140)) program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-mkdirat-openat2-rmdir-mkdirat-mount$overlay-openat$dir-writev-socket$nl_generic-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_BEARER_ENABLE-sendmsg$TIPC_NL_KEY_FLUSH detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x20400, 0x20) writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000000)={0x28, r1, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'xfrm0\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8041}, 0x0) sendmsg$TIPC_NL_KEY_FLUSH(0xffffffffffffffff, 0x0, 0x810) program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-mkdirat-openat2-rmdir-mkdirat-mount$overlay-openat$dir-writev-socket$nl_generic-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_BEARER_ENABLE detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x20400, 0x20) writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000000)={0x28, r1, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'xfrm0\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8041}, 0x0) program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-mkdirat-openat2-rmdir-mkdirat-mount$overlay-openat$dir-writev-socket$nl_generic-syz_genetlink_get_family_id$tipc2 detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x20400, 0x20) writev(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-mkdirat-openat2-rmdir-mkdirat-mount$overlay-openat$dir-writev-socket$nl_generic detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x20400, 0x20) writev(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-mkdirat-openat2-rmdir-mkdirat-mount$overlay-openat$dir-writev detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x20400, 0x20) writev(0xffffffffffffffff, 0x0, 0x0) program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-mkdirat-openat2-rmdir-mkdirat-mount$overlay-openat$dir detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x20400, 0x20) program crashed: BUG: scheduling while atomic in kernfs_drain testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-mkdirat-openat2-rmdir-mkdirat-mount$overlay detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-mkdirat-openat2-rmdir-mkdirat detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-mkdirat-openat2-rmdir detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-mkdirat-openat2 detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) openat2(0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1\x00', &(0x7f0000000080)={0x0, 0x0, 0x20}, 0x18) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-mkdirat-rmdir detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mount-rmdir detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mkdirat-mkdirat-rmdir detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mount-mkdirat-rmdir detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mknodat-mkdirat-mount-mkdirat-rmdir detailed listing: executing program 0: mknodat(0xffffffffffffff9c, 0x0, 0xc000, 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir program crashed: BUG: scheduling while atomic in kernfs_remove a never seen crash title: BUG: scheduling while atomic in kernfs_remove, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir program crashed: BUG: scheduling while atomic in kernfs_remove a never seen crash title: BUG: scheduling while atomic in kernfs_remove, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) rmdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00') program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns validation run: crashed=true reproducing took 2h46m57.211271074s repro crashed as (corrupted=false): BUG: scheduling while atomic: syz.4.19/398/0x00000002 Modules linked in: CPU: 0 UID: 0 PID: 398 Comm: syz.4.19 Not tainted syzkaller #0 02f2c9a1947d185dcc234937001f7d1e6f97c77a Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 dump_stack+0x19/0x20 lib/dump_stack.c:129 __schedule_bug+0x12b/0x200 kernel/sched/core.c:6626 schedule_debug kernel/sched/core.c:6653 [inline] __schedule+0xb85/0x20b0 kernel/sched/core.c:7697 __schedule_loop kernel/sched/core.c:7957 [inline] schedule+0xc5/0x240 kernel/sched/core.c:7972 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8029 rwsem_down_write_slowpath+0x5c9/0x1b60 kernel/locking/rwsem.c:1239 __down_write_common kernel/locking/rwsem.c:1383 [inline] __down_write kernel/locking/rwsem.c:1392 [inline] down_write+0x163/0x2b0 kernel/locking/rwsem.c:1659 kernfs_remove_by_name_ns+0x8c/0x180 fs/kernfs/dir.c:1737 kernfs_remove_by_name include/linux/kernfs.h:637 [inline] sysfs_unmerge_group+0xd7/0x130 fs/sysfs/group.c:399 rpm_sysfs_remove drivers/base/power/sysfs.c:826 [inline] dpm_sysfs_remove+0x7b/0xd0 drivers/base/power/sysfs.c:835 device_del+0x241/0xcf0 drivers/base/core.c:3856 device_unregister drivers/base/core.c:3922 [inline] device_destroy+0xb0/0x100 drivers/base/core.c:4521 android_device_destroy+0x118/0x180 drivers/usb/gadget/android_configfs_uevent.c:223 gadgets_drop+0x1d/0x30 drivers/usb/gadget/configfs.c:2075 client_drop_item fs/configfs/dir.c:943 [inline] configfs_rmdir+0x8b7/0x9b0 fs/configfs/dir.c:1546 vfs_rmdir+0x3db/0x560 fs/namei.c:4348 do_rmdir+0x29a/0x590 fs/namei.c:4407 __do_sys_rmdir fs/namei.c:4426 [inline] __se_sys_rmdir fs/namei.c:4424 [inline] __x64_sys_rmdir+0x4b/0x60 fs/namei.c:4424 x64_sys_call+0xaf7/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:85 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f98b379e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdf4042f58 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 RAX: ffffffffffffffda RBX: 00007f98b3a25fa0 RCX: 00007f98b379e0d9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 RBP: 00007f98b3835024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f98b3a25fac R14: 00007f98b3a25fa0 R15: 00007f98b3a25fa0 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 398 at lib/stackdepot.c:635 stack_depot_save_flags+0x266/0x800 lib/stackdepot.c:633 Modules linked in: CPU: 1 UID: 0 PID: 398 Comm: syz.4.19 Tainted: G W syzkaller #0 02f2c9a1947d185dcc234937001f7d1e6f97c77a Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:stack_depot_save_flags+0x266/0x800 lib/stackdepot.c:635 Code: 48 83 3d b4 f5 db 05 00 0f 84 00 04 00 00 48 c7 45 c0 00 00 00 00 48 89 d3 65 8b 05 cc 66 1e 7d 4d 89 d7 a9 00 00 f0 00 74 2d <0f> 0b 48 c7 45 c8 00 00 00 00 9c 8f 45 c8 4c 8b 6d c8 fa 48 c7 c7 RSP: 0018:ffffc90003b3f980 EFLAGS: 00010206 RAX: 000000007fffffff RBX: ffff8881f5736960 RCX: 0000000000536960 RDX: ffff8881f5736960 RSI: 0000000000000001 RDI: 00000000d19b058c RBP: ffffc90003b3f9e0 R08: 0000000031f25f53 R09: 00000000729e16d5 R10: 000000000000000d R11: ffffffff81759ed0 R12: 00000000c8d53696 R13: 0000000000000000 R14: ffffc90003b3f9f0 R15: 000000000000000d FS: 000055558e081500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb776470000 CR3: 0000000117e0e000 CR4: 00000000003526b0 Call Trace: kasan_save_stack mm/kasan/common.c:50 [inline] kasan_save_track+0x4f/0x80 mm/kasan/common.c:70 kasan_save_free_info+0x44/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:249 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:266 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2445 [inline] slab_free mm/slub.c:4714 [inline] kfree+0x158/0x440 mm/slub.c:4875 gadget_info_attr_release+0xcb/0x130 drivers/usb/gadget/configfs.c:412 config_item_cleanup fs/configfs/item.c:128 [inline] config_item_release fs/configfs/item.c:137 [inline] kref_put include/linux/kref.h:65 [inline] config_item_put+0x178/0x240 fs/configfs/item.c:149 configfs_rmdir+0x8e8/0x9b0 fs/configfs/dir.c:1550 vfs_rmdir+0x3db/0x560 fs/namei.c:4348 do_rmdir+0x29a/0x590 fs/namei.c:4407 __do_sys_rmdir fs/namei.c:4426 [inline] __se_sys_rmdir fs/namei.c:4424 [inline] __x64_sys_rmdir+0x4b/0x60 fs/namei.c:4424 x64_sys_call+0xaf7/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:85 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f98b379e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdf4042f58 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 RAX: ffffffffffffffda RBX: 00007f98b3a25fa0 RCX: 00007f98b379e0d9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 RBP: 00007f98b3835024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f98b3a25fac R14: 00007f98b3a25fa0 R15: 00007f98b3a25fa0 ---[ end trace 0000000000000000 ]--- BUG: scheduling while atomic: syz.4.19/398/0x00000000 Modules linked in: CPU: 1 UID: 0 PID: 398 Comm: syz.4.19 Tainted: G W syzkaller #0 02f2c9a1947d185dcc234937001f7d1e6f97c77a Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: final repro crashed as (corrupted=false): BUG: scheduling while atomic: syz.4.19/398/0x00000002 Modules linked in: CPU: 0 UID: 0 PID: 398 Comm: syz.4.19 Not tainted syzkaller #0 02f2c9a1947d185dcc234937001f7d1e6f97c77a Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 dump_stack+0x19/0x20 lib/dump_stack.c:129 __schedule_bug+0x12b/0x200 kernel/sched/core.c:6626 schedule_debug kernel/sched/core.c:6653 [inline] __schedule+0xb85/0x20b0 kernel/sched/core.c:7697 __schedule_loop kernel/sched/core.c:7957 [inline] schedule+0xc5/0x240 kernel/sched/core.c:7972 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8029 rwsem_down_write_slowpath+0x5c9/0x1b60 kernel/locking/rwsem.c:1239 __down_write_common kernel/locking/rwsem.c:1383 [inline] __down_write kernel/locking/rwsem.c:1392 [inline] down_write+0x163/0x2b0 kernel/locking/rwsem.c:1659 kernfs_remove_by_name_ns+0x8c/0x180 fs/kernfs/dir.c:1737 kernfs_remove_by_name include/linux/kernfs.h:637 [inline] sysfs_unmerge_group+0xd7/0x130 fs/sysfs/group.c:399 rpm_sysfs_remove drivers/base/power/sysfs.c:826 [inline] dpm_sysfs_remove+0x7b/0xd0 drivers/base/power/sysfs.c:835 device_del+0x241/0xcf0 drivers/base/core.c:3856 device_unregister drivers/base/core.c:3922 [inline] device_destroy+0xb0/0x100 drivers/base/core.c:4521 android_device_destroy+0x118/0x180 drivers/usb/gadget/android_configfs_uevent.c:223 gadgets_drop+0x1d/0x30 drivers/usb/gadget/configfs.c:2075 client_drop_item fs/configfs/dir.c:943 [inline] configfs_rmdir+0x8b7/0x9b0 fs/configfs/dir.c:1546 vfs_rmdir+0x3db/0x560 fs/namei.c:4348 do_rmdir+0x29a/0x590 fs/namei.c:4407 __do_sys_rmdir fs/namei.c:4426 [inline] __se_sys_rmdir fs/namei.c:4424 [inline] __x64_sys_rmdir+0x4b/0x60 fs/namei.c:4424 x64_sys_call+0xaf7/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:85 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f98b379e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdf4042f58 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 RAX: ffffffffffffffda RBX: 00007f98b3a25fa0 RCX: 00007f98b379e0d9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 RBP: 00007f98b3835024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f98b3a25fac R14: 00007f98b3a25fa0 R15: 00007f98b3a25fa0 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 398 at lib/stackdepot.c:635 stack_depot_save_flags+0x266/0x800 lib/stackdepot.c:633 Modules linked in: CPU: 1 UID: 0 PID: 398 Comm: syz.4.19 Tainted: G W syzkaller #0 02f2c9a1947d185dcc234937001f7d1e6f97c77a Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:stack_depot_save_flags+0x266/0x800 lib/stackdepot.c:635 Code: 48 83 3d b4 f5 db 05 00 0f 84 00 04 00 00 48 c7 45 c0 00 00 00 00 48 89 d3 65 8b 05 cc 66 1e 7d 4d 89 d7 a9 00 00 f0 00 74 2d <0f> 0b 48 c7 45 c8 00 00 00 00 9c 8f 45 c8 4c 8b 6d c8 fa 48 c7 c7 RSP: 0018:ffffc90003b3f980 EFLAGS: 00010206 RAX: 000000007fffffff RBX: ffff8881f5736960 RCX: 0000000000536960 RDX: ffff8881f5736960 RSI: 0000000000000001 RDI: 00000000d19b058c RBP: ffffc90003b3f9e0 R08: 0000000031f25f53 R09: 00000000729e16d5 R10: 000000000000000d R11: ffffffff81759ed0 R12: 00000000c8d53696 R13: 0000000000000000 R14: ffffc90003b3f9f0 R15: 000000000000000d FS: 000055558e081500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb776470000 CR3: 0000000117e0e000 CR4: 00000000003526b0 Call Trace: kasan_save_stack mm/kasan/common.c:50 [inline] kasan_save_track+0x4f/0x80 mm/kasan/common.c:70 kasan_save_free_info+0x44/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:249 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:266 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2445 [inline] slab_free mm/slub.c:4714 [inline] kfree+0x158/0x440 mm/slub.c:4875 gadget_info_attr_release+0xcb/0x130 drivers/usb/gadget/configfs.c:412 config_item_cleanup fs/configfs/item.c:128 [inline] config_item_release fs/configfs/item.c:137 [inline] kref_put include/linux/kref.h:65 [inline] config_item_put+0x178/0x240 fs/configfs/item.c:149 configfs_rmdir+0x8e8/0x9b0 fs/configfs/dir.c:1550 vfs_rmdir+0x3db/0x560 fs/namei.c:4348 do_rmdir+0x29a/0x590 fs/namei.c:4407 __do_sys_rmdir fs/namei.c:4426 [inline] __se_sys_rmdir fs/namei.c:4424 [inline] __x64_sys_rmdir+0x4b/0x60 fs/namei.c:4424 x64_sys_call+0xaf7/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:85 do_syscall_x64 arch/x86/entry/common.c:47 [inline] do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f98b379e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdf4042f58 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 RAX: ffffffffffffffda RBX: 00007f98b3a25fa0 RCX: 00007f98b379e0d9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000600 RBP: 00007f98b3835024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f98b3a25fac R14: 00007f98b3a25fa0 R15: 00007f98b3a25fa0 ---[ end trace 0000000000000000 ]--- BUG: scheduling while atomic: syz.4.19/398/0x00000000 Modules linked in: CPU: 1 UID: 0 PID: 398 Comm: syz.4.19 Tainted: G W syzkaller #0 02f2c9a1947d185dcc234937001f7d1e6f97c77a Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: