program: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000080), 0x2, 0x0) write$cgroup_freezer_state(r1, &(0x7f00000000c0)='FROZEN\x00', 0x7) mkdirat$cgroup(r0, &(0x7f00000002c0)='syz1\x00', 0x1ff) (fail_nth: 25) [ 77.127360][ T5300] udevd[5300]: incorrect bcachefs checksum on /dev/loop0 [ 75.712485][ T4673] Bluetooth: hci0: command tx timeout [ 75.804913][ T5324] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 75.814081][ T5324] FAULT_INJECTION: forcing a failure. [ 75.814081][ T5324] name failslab, interval 1, probability 0, space 0, times 1 [ 75.819555][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted 6.16.0-rc2-syzkaller-00278-g3f75bfff44be #0 PREEMPT(full) [ 75.819571][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 75.819578][ T5324] Call Trace: [ 75.819584][ T5324] [ 75.819590][ T5324] dump_stack_lvl+0x189/0x250 [ 75.819673][ T5324] ? __pfx____ratelimit+0x10/0x10 [ 75.819720][ T5324] ? __pfx_dump_stack_lvl+0x10/0x10 [ 75.819737][ T5324] ? __pfx__printk+0x10/0x10 [ 75.819755][ T5324] ? __pfx___might_resched+0x10/0x10 [ 75.819775][ T5324] should_fail_ex+0x414/0x560 [ 75.819821][ T5324] should_failslab+0xa8/0x100 [ 75.819835][ T5324] __kmalloc_cache_noprof+0x70/0x3d0 [ 75.819847][ T5324] ? percpu_ref_init+0xc5/0x360 [ 75.819864][ T5324] ? __pfx_css_release+0x10/0x10 [ 75.819879][ T5324] percpu_ref_init+0xc5/0x360 [ 75.819893][ T5324] ? init_and_link_css+0x2d8/0x3d0 [ 75.819910][ T5324] cgroup_apply_control_enable+0x42b/0xa80 [ 75.819923][ T5324] ? css_next_descendant_pre+0x183/0x260 [ 75.819944][ T5324] cgroup_mkdir+0xc40/0xe60 [ 75.819963][ T5324] ? __pfx_cgroup_mkdir+0x10/0x10 [ 75.819975][ T5324] kernfs_iop_mkdir+0x211/0x350 [ 75.819995][ T5324] vfs_mkdir+0x306/0x510 [ 75.820017][ T5324] do_mkdirat+0x247/0x590 [ 75.820035][ T5324] ? __pfx_do_mkdirat+0x10/0x10 [ 75.820054][ T5324] ? getname_flags+0x1e5/0x540 [ 75.820071][ T5324] __x64_sys_mkdirat+0x87/0xa0 [ 75.820089][ T5324] do_syscall_64+0xfa/0x3b0 [ 75.820100][ T5324] ? lockdep_hardirqs_on+0x9c/0x150 [ 75.820116][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.820127][ T5324] ? clear_bhb_loop+0x60/0xb0 [ 75.820142][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.820153][ T5324] RIP: 0033:0x7f6351b8e929 [ 75.820164][ T5324] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 75.820174][ T5324] RSP: 002b:00007f6352a9d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 75.820188][ T5324] RAX: ffffffffffffffda RBX: 00007f6351db5fa0 RCX: 00007f6351b8e929 [ 75.820196][ T5324] RDX: 00000000000001ff RSI: 00002000000002c0 RDI: 0000000000000003 [ 75.820203][ T5324] RBP: 00007f6352a9d090 R08: 0000000000000000 R09: 0000000000000000 [ 75.820210][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 75.820216][ T5324] R13: 0000000000000000 R14: 00007f6351db5fa0 R15: 00007ffe1767fa68 [ 75.820236][ T5324] [ 75.942873][ T5317] BUG: unable to handle page fault for address: ffffed1011a4a201 [ 75.946195][ T5317] #PF: supervisor read access in kernel mode [ 75.948778][ T5317] #PF: error_code(0x0000) - not-present page [ 75.951314][ T5317] PGD 5ffcd067 P4D 5ffcd067 PUD 2fff7067 PMD 0 [ 75.953926][ T5317] Oops: Oops: 0000 [#1] SMP KASAN NOPTI [ 75.956242][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: kworker/0:4 Not tainted 6.16.0-rc2-syzkaller-00278-g3f75bfff44be #0 PREEMPT(full) [ 75.961060][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 75.965320][ T5317] Workqueue: cgroup_destroy css_free_rwork_fn [ 75.968070][ T5317] RIP: 0010:css_rstat_flush+0x5ff/0x1fa0 [ 75.970398][ T5317] Code: f4 bd d1 0d 01 0f 85 e6 14 00 00 e8 cb 1e 07 00 4c 03 6c 24 20 4d 8d 7d 08 4c 89 fb 48 c1 eb 03 48 b8 00 00 00 00 00 fc ff df <80> 3c 03 00 74 08 4c 89 ff e8 c3 9c 6a 00 49 83 3f 00 0f 84 5d 01 [ 75.977758][ T5317] RSP: 0018:ffffc9000d627780 EFLAGS: 00010802 [ 75.980137][ T5317] RAX: dffffc0000000000 RBX: 1ffff11011a4a201 RCX: ffff888000378000 [ 75.983359][ T5317] RDX: 0000000000000000 RSI: ffffffff8be28b20 RDI: ffffffff8be28ae0 [ 75.986582][ T5317] RBP: ffffc9000d6279b8 R08: ffffffff8fa10cf7 R09: 1ffffffff1f4219e [ 75.989963][ T5317] R10: dffffc0000000000 R11: fffffbfff1f4219f R12: ffff88801fc40db0 [ 75.993290][ T5317] R13: ffff88808d251000 R14: 0000000000000000 R15: ffff88808d251008 [ 75.996422][ T5317] FS: 0000000000000000(0000) GS:ffff88808d251000(0000) knlGS:0000000000000000 [ 76.000051][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.002783][ T5317] CR2: ffffed1011a4a201 CR3: 0000000051113000 CR4: 0000000000352ef0 [ 76.006119][ T5317] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 76.009344][ T5317] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 76.012628][ T5317] Call Trace: [ 76.014089][ T5317] [ 76.015380][ T5317] ? check_path+0x21/0x40 [ 76.017237][ T5317] ? irqentry_exit+0x74/0x90 [ 76.019230][ T5317] ? __pfx_css_rstat_flush+0x10/0x10 [ 76.021588][ T5317] ? process_scheduled_works+0x9ef/0x17b0 [ 76.024033][ T5317] css_rstat_exit+0xa9/0x320 [ 76.026139][ T5317] ? percpu_ref_exit+0xc5/0x1c0 [ 76.028224][ T5317] css_free_rwork_fn+0x8b/0xc50 [ 76.030363][ T5317] ? process_scheduled_works+0x9ef/0x17b0 [ 76.032730][ T5317] ? process_scheduled_works+0x9ef/0x17b0 [ 76.035077][ T5317] process_scheduled_works+0xae1/0x17b0 [ 76.037440][ T5317] ? __pfx_process_scheduled_works+0x10/0x10 [ 76.039926][ T5317] worker_thread+0x8a0/0xda0 [ 76.041919][ T5317] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 76.044604][ T5317] ? __kthread_parkme+0x7b/0x200 [ 76.046788][ T5317] kthread+0x70e/0x8a0 [ 76.048533][ T5317] ? __pfx_worker_thread+0x10/0x10 [ 76.050819][ T5317] ? __pfx_kthread+0x10/0x10 [ 76.052738][ T5317] ? _raw_spin_unlock_irq+0x23/0x50 [ 76.054546][ T5317] ? lockdep_hardirqs_on+0x9c/0x150 [ 76.056580][ T5317] ? __pfx_kthread+0x10/0x10 [ 76.058362][ T5317] ret_from_fork+0x3f9/0x770 [ 76.060101][ T5317] ? __pfx_ret_from_fork+0x10/0x10 [ 76.062013][ T5317] ? __pfx_kthread+0x10/0x10 [ 76.063758][ T5317] ret_from_fork_asm+0x1a/0x30 [ 76.065573][ T5317] [ 76.066960][ T5317] Modules linked in: [ 76.068484][ T5317] CR2: ffffed1011a4a201 [ 76.069971][ T5317] ---[ end trace 0000000000000000 ]--- [ 76.072103][ T5317] RIP: 0010:css_rstat_flush+0x5ff/0x1fa0 [ 76.074537][ T5317] Code: f4 bd d1 0d 01 0f 85 e6 14 00 00 e8 cb 1e 07 00 4c 03 6c 24 20 4d 8d 7d 08 4c 89 fb 48 c1 eb 03 48 b8 00 00 00 00 00 fc ff df <80> 3c 03 00 74 08 4c 89 ff e8 c3 9c 6a 00 49 83 3f 00 0f 84 5d 01 [ 76.082553][ T5317] RSP: 0018:ffffc9000d627780 EFLAGS: 00010802 [ 76.085127][ T5317] RAX: dffffc0000000000 RBX: 1ffff11011a4a201 RCX: ffff888000378000 [ 76.088507][ T5317] RDX: 0000000000000000 RSI: ffffffff8be28b20 RDI: ffffffff8be28ae0 [ 76.091901][ T5317] RBP: ffffc9000d6279b8 R08: ffffffff8fa10cf7 R09: 1ffffffff1f4219e [ 76.095273][ T5317] R10: dffffc0000000000 R11: fffffbfff1f4219f R12: ffff88801fc40db0 [ 76.098551][ T5317] R13: ffff88808d251000 R14: 0000000000000000 R15: ffff88808d251008 [ 76.101975][ T5317] FS: 0000000000000000(0000) GS:ffff88808d251000(0000) knlGS:0000000000000000 [ 76.105692][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 76.108522][ T5317] CR2: ffffed1011a4a201 CR3: 0000000051113000 CR4: 0000000000352ef0 [ 76.111876][ T5317] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 76.115223][ T5317] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 76.119324][ T5317] Kernel panic - not syncing: Fatal exception [ 76.122192][ T5317] Kernel Offset: disabled [ 76.123960][ T5317] Rebooting in 86400 seconds..