Extracting prog: 6m50.038144277s
Minimizing prog: 1h31m28.92538089s
Simplifying prog options: 13m10.852537928s
Extracting C: 5m17.560256943s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-ioctl$SIOCSIFHWADDR-mount-inotify_init1-fcntl$setown-fcntl$getownex-syz_open_procfs-write$eventfd-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0)
r3 = inotify_init1(0x0)
fcntl$setown(r3, 0x8, 0xffffffffffffffff)
fcntl$getownex(r3, 0x10, &(0x7f0000000140)={0x0, <r4=>0x0})
r5 = syz_open_procfs(r4, &(0x7f0000000600)='fd/4\x00')
write$eventfd(r5, &(0x7f0000000040)=0x54, 0x8)
ioctl$EXT4_IOC_GROUP_EXTEND(r5, 0x40305839, &(0x7f0000000240))

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-ioctl$SIOCSIFHWADDR-mount-inotify_init1-fcntl$setown-fcntl$getownex-syz_open_procfs-write$eventfd-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0)
r3 = inotify_init1(0x0)
fcntl$setown(r3, 0x8, 0xffffffffffffffff)
fcntl$getownex(r3, 0x10, &(0x7f0000000140)={0x0, <r4=>0x0})
r5 = syz_open_procfs(r4, &(0x7f0000000600)='fd/4\x00')
write$eventfd(r5, &(0x7f0000000040)=0x54, 0x8)
ioctl$EXT4_IOC_GROUP_EXTEND(r5, 0x40305839, &(0x7f0000000240))

program crashed: kernel BUG in may_open
single: successfully extracted reproducer
found reproducer with 15 syscalls
minimizing guilty program
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-ioctl$SIOCSIFHWADDR-mount-inotify_init1-fcntl$setown-fcntl$getownex-syz_open_procfs-write$eventfd
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0)
r3 = inotify_init1(0x0)
fcntl$setown(r3, 0x8, 0xffffffffffffffff)
fcntl$getownex(r3, 0x10, &(0x7f0000000140)={0x0, <r4=>0x0})
r5 = syz_open_procfs(r4, &(0x7f0000000600)='fd/4\x00')
write$eventfd(r5, &(0x7f0000000040)=0x54, 0x8)

program did not crash
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-ioctl$SIOCSIFHWADDR-mount-inotify_init1-fcntl$setown-fcntl$getownex-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0)
r3 = inotify_init1(0x0)
fcntl$setown(r3, 0x8, 0xffffffffffffffff)
fcntl$getownex(r3, 0x10, &(0x7f0000000140)={0x0, <r4=>0x0})
r5 = syz_open_procfs(r4, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r5, 0x40305839, &(0x7f0000000240))

program crashed: kernel BUG in may_open
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-ioctl$SIOCSIFHWADDR-mount-inotify_init1-fcntl$setown-fcntl$getownex-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0)
r3 = inotify_init1(0x0)
fcntl$setown(r3, 0x8, 0xffffffffffffffff)
fcntl$getownex(r3, 0x10, &(0x7f0000000140))
ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40305839, &(0x7f0000000240))

program did not crash
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-ioctl$SIOCSIFHWADDR-mount-inotify_init1-fcntl$setown-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0)
r3 = inotify_init1(0x0)
fcntl$setown(r3, 0x8, 0xffffffffffffffff)
r4 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r4, 0x40305839, &(0x7f0000000240))

program crashed: kernel BUG in may_open
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-ioctl$SIOCSIFHWADDR-mount-inotify_init1-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0)
inotify_init1(0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40305839, &(0x7f0000000240))

program crashed: kernel BUG in may_open
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-ioctl$SIOCSIFHWADDR-mount-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40305839, &(0x7f0000000240))

program crashed: kernel BUG in may_open
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-ioctl$SIOCSIFHWADDR-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}})
r3 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40305839, &(0x7f0000000240))

program crashed: kernel BUG in may_open
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40305839, &(0x7f0000000240))

program crashed: kernel BUG in may_open
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
r2 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40305839, &(0x7f0000000240))

program did not crash
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
fchdir(0xffffffffffffffff)
r2 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40305839, &(0x7f0000000240))

program did not crash
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-syz_open_procfs-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r1)
r2 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40305839, &(0x7f0000000240))

program did not crash
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_setup-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r1)
r2 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40305839, &(0x7f0000000240))

program did not crash
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-prctl$PR_SET_TAGGED_ADDR_CTRL-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r0 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(0xffffffffffffffff, 0x16, 0x20000000, r0)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r1)
r2 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40305839, &(0x7f0000000240))

program did not crash
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EXT4_IOC_MOVE_EXT-io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000000)={0x17c04, 0xffffffffffffffff, 0x0, 0xfffffffe})
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40305839, &(0x7f0000000240))

program crashed: kernel BUG in may_open
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40305839, &(0x7f0000000240))

program crashed: kernel BUG in may_open
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
r0 = io_uring_setup(0x7bda, 0x0)
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
fchdir(r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40305839, &(0x7f0000000240))

program did not crash
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, 0x0)
fchdir(r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40305839, &(0x7f0000000240))

program crashed: kernel BUG in may_open
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, 0x0)
fchdir(r2)
r3 = syz_open_procfs(0x0, 0x0)
ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40305839, &(0x7f0000000240))

program did not crash
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, 0x0)
fchdir(r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40305839, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m29.895081558s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, 0x0)
fchdir(r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40305839, &(0x7f0000000240))

program did not crash
testing program (duration=6m29.895081558s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): io_uring_setup-io_uring_register$IORING_REGISTER_PERSONALITY-io_uring_register$IORING_UNREGISTER_PERSONALITY-syz_open_procfs-fchdir-syz_open_procfs-ioctl$EXT4_IOC_GROUP_EXTEND
detailed listing:
executing program 0:
r0 = io_uring_setup(0x7bda, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x72})
r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0)
io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0x16, 0x20000000, r1)
r2 = syz_open_procfs(0x0, 0x0)
fchdir(r2)
r3 = syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00')
ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40305839, &(0x7f0000000240))

program did not crash
reproducing took 1h56m47.376343986s
repro crashed as (corrupted=false):
VFS_BUG_ON_INODE(1) encountered for inode ffff0000e0e58a10
------------[ cut here ]------------
kernel BUG at fs/namei.c:3467!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 31824 Comm: syz.0.12278 Not tainted 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : may_open+0x3c0/0x3c4 fs/namei.c:3467
lr : may_open+0x3c0/0x3c4 fs/namei.c:3467
sp : ffff80009fdf77b0
x29: ffff80009fdf77b0 x28: 1fffe0001bada520 x27: ffff80008f6578e0
x26: 0000000000280000 x25: dfff800000000000 x24: 00000000000fffff
x23: ffff80009fdf7aa0 x22: 0000000000000006 x21: ffff0000e0e58a10
x20: 0000000000020002 x19: ffff80008f6578e0 x18: 0000000000000000
x17: ffff0001fea8a870 x16: ffff80008adbe9e4 x15: 0000000000000001
x14: 1ffff00013fbee5c x13: 0000000000000000 x12: 0000000000000000
x11: ffff700013fbee5d x10: 0000000000ff0100 x9 : e48fc0b31f571300
x8 : e48fc0b31f571300 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80009fdf7118 x4 : ffff80008f415ba0 x3 : ffff800082fbf044
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003a
Call trace:
 may_open+0x3c0/0x3c4 fs/namei.c:3467 (P)
 do_open fs/namei.c:3878 [inline]
 path_openat+0x22f4/0x2c40 fs/namei.c:4039
 do_filp_open+0x18c/0x36c fs/namei.c:4066
 do_sys_openat2+0x11c/0x1b4 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __arm64_sys_openat+0x120/0x158 fs/open.c:1455
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767
 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
Code: f0051061 91100021 aa1503e0 97cf135e (d4210000) 
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
VFS_BUG_ON_INODE(1) encountered for inode ffff0000e0e58a10
------------[ cut here ]------------
kernel BUG at fs/namei.c:3467!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 31824 Comm: syz.0.12278 Not tainted 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : may_open+0x3c0/0x3c4 fs/namei.c:3467
lr : may_open+0x3c0/0x3c4 fs/namei.c:3467
sp : ffff80009fdf77b0
x29: ffff80009fdf77b0 x28: 1fffe0001bada520 x27: ffff80008f6578e0
x26: 0000000000280000 x25: dfff800000000000 x24: 00000000000fffff
x23: ffff80009fdf7aa0 x22: 0000000000000006 x21: ffff0000e0e58a10
x20: 0000000000020002 x19: ffff80008f6578e0 x18: 0000000000000000
x17: ffff0001fea8a870 x16: ffff80008adbe9e4 x15: 0000000000000001
x14: 1ffff00013fbee5c x13: 0000000000000000 x12: 0000000000000000
x11: ffff700013fbee5d x10: 0000000000ff0100 x9 : e48fc0b31f571300
x8 : e48fc0b31f571300 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80009fdf7118 x4 : ffff80008f415ba0 x3 : ffff800082fbf044
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003a
Call trace:
 may_open+0x3c0/0x3c4 fs/namei.c:3467 (P)
 do_open fs/namei.c:3878 [inline]
 path_openat+0x22f4/0x2c40 fs/namei.c:4039
 do_filp_open+0x18c/0x36c fs/namei.c:4066
 do_sys_openat2+0x11c/0x1b4 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_openat fs/open.c:1460 [inline]
 __se_sys_openat fs/open.c:1455 [inline]
 __arm64_sys_openat+0x120/0x158 fs/open.c:1455
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767
 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
Code: f0051061 91100021 aa1503e0 97cf135e (d4210000) 
---[ end trace 0000000000000000 ]---