Warning: Permanently added '10.128.1.181' (ED25519) to the list of known hosts. [*] Starting reproducer for sysfs_break_active_protection refcount bug... [+] Running as root (euid=0) [+] Verified /dev/md0../dev/md7 device nodes. [+] Verified /sys/module/md_mod/parameters/new_array is accessible. [+] Detected 2 online CPU(s). [+] Created 4 worker threads successfully. [+] Starting race loop (up to 25.0 seconds)... [ 107.515440][ T6052] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 107.528129][ T6053] md: md0 stopped. [ 107.532251][ T6055] md: md0 stopped. [ 107.900604][ T6052] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 107.916744][ T6055] md: md1 stopped. [ 107.916872][ T6056] refcount_t: addition on 0; use-after-free. [ 107.917498][ T6056] ------------[ cut here ]------------ [ 107.917508][ T6056] kernel BUG at lib/refcount.c:34! [ 107.917551][ T6056] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 107.944215][ T6056] CPU: 1 UID: 0 PID: 6056 Comm: syz-executor398 Not tainted syzkaller #0 PREEMPT(full) [ 107.954030][ T6056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 107.964089][ T6056] RIP: 0010:refcount_warn_saturate+0xf0/0x110 [ 107.970171][ T6056] Code: 80 c1 03 38 c1 0f 8c 6a ff ff ff 4c 89 f7 e8 e7 44 51 fd e9 5d ff ff ff e8 dd 23 da fc 48 c7 c7 e0 a3 8c 8c e8 a1 d1 38 fc 90 <0f> 0b e8 c9 23 da fc 48 c7 c7 60 a4 8c 8c e8 8d d1 38 fc 90 0f 0b [ 107.989783][ T6056] RSP: 0018:ffffc90002e5fb78 EFLAGS: 00010246 [ 107.995892][ T6056] RAX: 000000000000002a RBX: 0000000000000002 RCX: 4550039d880cf800 [ 108.003905][ T6056] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 108.011868][ T6056] RBP: 0000000000000000 R08: ffffffff9014c84b R09: 1ffffffff2029909 [ 108.019862][ T6056] R10: dffffc0000000000 R11: fffffbfff202990a R12: dffffc0000000000 [ 108.028133][ T6056] R13: 1ffffffff22654c6 R14: ffff88807c40e128 R15: dffffc0000000000 [ 108.036113][ T6056] FS: 00007f63dcdeb6c0(0000) GS:ffff88812350b000(0000) knlGS:0000000000000000 [ 108.045226][ T6056] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 108.051990][ T6056] CR2: 000055b9ba686138 CR3: 0000000074ef4000 CR4: 00000000003526f0 [ 108.060126][ T6056] Call Trace: [ 108.063608][ T6056] [ 108.066532][ T6056] kobject_get+0xfa/0x120 [ 108.070950][ T6056] sysfs_break_active_protection+0x28/0xa0 [ 108.076931][ T6056] md_attr_store+0x28f/0x640 [ 108.081527][ T6056] ? __pfx_sysfs_kf_write+0x10/0x10 [ 108.086719][ T6056] kernfs_fop_write_iter+0x3a4/0x540 [ 108.091996][ T6056] vfs_write+0x612/0xba0 [ 108.096247][ T6056] ? __pfx_vfs_write+0x10/0x10 [ 108.101024][ T6056] ? __fget_files+0x2a/0x420 [ 108.105716][ T6056] ? fdget+0x1ac/0x250 [ 108.109783][ T6056] __x64_sys_pwrite64+0x210/0x2c0 [ 108.114803][ T6056] ? __pfx___x64_sys_pwrite64+0x10/0x10 [ 108.120347][ T6056] do_syscall_64+0x166/0x520 [ 108.124934][ T6056] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.131081][ T6056] ? clear_bhb_loop+0x70/0xc0 [ 108.135759][ T6056] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.141733][ T6056] RIP: 0033:0x7f63de64ba9e [ 108.146159][ T6056] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08 [ 108.165929][ T6056] RSP: 002b:00007f63dcdeb0f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 108.174425][ T6056] RAX: ffffffffffffffda RBX: 00007f63dcdeb6c0 RCX: 00007f63de64ba9e [ 108.182386][ T6056] RDX: 0000000000000005 RSI: 00007f63de69003a RDI: 0000000000000006 [ 108.190387][ T6056] RBP: 0000000000000006 R08: 0000000000000000 R09: 0000000000000000 [ 108.198345][ T6056] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f63de69003a [ 108.206308][ T6056] R13: 0000000000000003 R14: 00007f63de6c3100 R15: 00007f63de6c4b4c [ 108.214276][ T6056] [ 108.217283][ T6056] Modules linked in: [ 108.221437][ T6056] ---[ end trace 0000000000000000 ]--- [ 108.678986][ T6056] RIP: 0010:refcount_warn_saturate+0xf0/0x110 [ 108.679026][ T6056] Code: 80 c1 03 38 c1 0f 8c 6a ff ff ff 4c 89 f7 e8 e7 44 51 fd e9 5d ff ff ff e8 dd 23 da fc 48 c7 c7 e0 a3 8c 8c e8 a1 d1 38 fc 90 <0f> 0b e8 c9 23 da fc 48 c7 c7 60 a4 8c 8c e8 8d d1 38 fc 90 0f 0b [ 108.679042][ T6056] RSP: 0018:ffffc90002e5fb78 EFLAGS: 00010246 [ 108.679061][ T6056] RAX: 000000000000002a RBX: 0000000000000002 RCX: 4550039d880cf800 [ 108.679074][ T6056] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 108.679086][ T6056] RBP: 0000000000000000 R08: ffffffff9014c84b R09: 1ffffffff2029909 [ 108.679099][ T6056] R10: dffffc0000000000 R11: fffffbfff202990a R12: dffffc0000000000 [ 108.679113][ T6056] R13: 1ffffffff22654c6 R14: ffff88807c40e128 R15: dffffc0000000000 [ 108.679128][ T6056] FS: 00007f63dcdeb6c0(0000) GS:ffff88812350b000(0000) knlGS:0000000000000000 [ 108.679145][ T6056] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 108.679158][ T6056] CR2: 00007f94a870e7d0 CR3: 0000000074ef4000 CR4: 00000000003526f0 [ 108.679177][ T6056] Kernel panic - not syncing: Fatal exception [ 108.780897][ T6056] Kernel Offset: disabled [ 108.785223][ T6056] Rebooting in 86400 seconds..