last executing test programs: 61.963358ms ago: executing program 1 (id=2): r0 = syz_io_uring_setup(0x2622, &(0x7f0000000100)={0x0, 0xf40, 0x1000, 0x1, 0x3c8}, 0x0, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="020300091b0000000000000000000000040003000000000000000000000000000000000000000000000000000000000005000600000000000a00000000000000fe8000000000000000000000000000bb00000000000000000400040000000000000000000000000000000000000000000000000000000000020001000000000000000000000000ff05000500000000000a00000000000000fe8896380000000000000001000000010000000000000000030007000000000002004e24ac14141f0000000000000000020013"], 0xd8}}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x105a42, 0x32) ftruncate(r2, 0x6000000) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x24, 0x0, 0x1, 0x400000, 0x0, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @initdev={0xac, 0x1e, 0x0, 0x0}}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast1}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0xc0686611, &(0x7f0000000180)={0x68, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) gettimeofday(&(0x7f0000000040), 0x0) copy_file_range(r2, 0x0, r2, &(0x7f00000004c0)=0x100, 0x9, 0x0) r4 = syz_ublk_setup_io_uring(0x9d31, &(0x7f0000000340)={0x0, 0x1, 0x400, 0x0, 0xfffffffc}, &(0x7f00000002c0)=0x0, &(0x7f0000000540)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0xf14, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, &(0x7f0000000280)) syz_io_uring_setup(0x16fd, &(0x7f0000000180)={0x0, 0xd2fb, 0x80, 0x2, 0x43, 0x0, r0}, &(0x7f0000000200), &(0x7f0000000240)=0x0, &(0x7f0000000280)) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1, 0x2172, 0xffffffffffffffff, 0x5ef5c000) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r9, 0x29, 0xcf, 0x0, &(0x7f0000000100)) syz_io_uring_modify_offsets$generic(r5, r8, 0x64, 0x4) 52.790868ms ago: executing program 2 (id=3): sched_setscheduler(0x0, 0x5, &(0x7f0000000480)) (async) ioprio_set$pid(0x2, 0x0, 0x0) (async) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) (async) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000000100)={'rose0\x00', {0x2, 0x0, @private}}) (async, rerun: 64) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x60001, 0x0) (async, rerun: 64) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x4}]}, 0x10) (async) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="080086dd0001280004000003a60c6eec00be00442ffffe800000000088fc70738daf7b3200b500"/54], 0xfdef) (async) syz_open_procfs$namespace(r0, &(0x7f00000000c0)='ns/net\x00') (async, rerun: 32) ptrace$ARCH_MAP_VDSO_32(0x1e, r0, 0x4, 0x2002) (async, rerun: 32) ioprio_get$pid(0x2, 0x0) (async, rerun: 32) r5 = landlock_create_ruleset(&(0x7f0000000080)={0xc0d8, 0x1, 0x1}, 0x18, 0x0) (rerun: 32) landlock_restrict_self(r5, 0x0) (async) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0xf0, 0x12, 0x633, 0x70bd2c, 0x0, {{@in6=@private2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a}, {@in=@multicast2, 0xfffffffd, 0x32}, @in6=@empty, {0x0, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0xfffffffffffffffc}, {0x0, 0x0, 0x0, 0xa}, {}, 0x100, 0x0, 0x2}}, 0xf0}}, 0x0) (async, rerun: 32) fsetxattr(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="6f2c210300000000000000c18e7bce9b221a2cb6a376da6f43b7469cec76de6e0edb6974a7bd5db3d172968f64165dadead56e6915f7ef8c53f01d0abf71118c6c8f02ad4e8e10219b08702fcb9d81d6e14efa4f5dd6e3a7f743b711b89dc0d0bc8f2f3ee9210e9adc427203d6cb76e361680b15931dcf2c0664b9c3f7e57c8b99e29cb922d2be6008f989045564f3eef1c171c5f8f9bd43caae661074f562a9da1bc042596bcdc036630ce2b0f771a7b578589cedaa2c854e5c6af2be7553982040f4e5528f0985d02bb093c43cd3d9a6b3ecfa75cd8b4a3ea7d508e085fd641b2ce7e30d755dd695d538b7c5de94"], &(0x7f0000000240)='rose0\x00', 0x6, 0x1) (rerun: 32) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) bind$inet(r6, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) 40.985659ms ago: executing program 3 (id=4): lsm_set_self_attr(0x66, &(0x7f0000000440)=ANY=[@ANYBLOB="6500000000000000050000000000000003000000000000000300110000000000cfa7ae"], 0x23, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mkdir(&(0x7f0000000100)='./bus\x00', 0xe8) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000000)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) mount$incfs(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000000), 0x82, 0x0) 0s ago: executing program 0 (id=1): r0 = socket(0xc05541b8e44bcf38, 0x3, 0xfffffffd) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) read$FUSE(r1, &(0x7f0000000080)={0x2020}, 0x2020) setsockopt$sock_linger(r0, 0x1, 0x3c, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.88' (ED25519) to the list of known hosts. [ 23.243782][ T36] audit: type=1400 audit(1780776784.490:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.247115][ T287] cgroup: Unknown subsys name 'net' [ 23.266469][ T36] audit: type=1400 audit(1780776784.490:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.293891][ T36] audit: type=1400 audit(1780776784.520:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.294369][ T287] cgroup: Unknown subsys name 'devices' [ 23.415505][ T287] cgroup: Unknown subsys name 'hugetlb' [ 23.421141][ T287] cgroup: Unknown subsys name 'rlimit' [ 23.536986][ T36] audit: type=1400 audit(1780776784.780:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.560220][ T36] audit: type=1400 audit(1780776784.780:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 23.585009][ T36] audit: type=1400 audit(1780776784.780:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.610046][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 23.618894][ T36] audit: type=1400 audit(1780776784.860:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.644345][ T36] audit: type=1400 audit(1780776784.860:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.668716][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.670430][ T36] audit: type=1400 audit(1780776784.910:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.704123][ T36] audit: type=1400 audit(1780776784.910:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.091932][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.099375][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.106524][ T295] bridge_slave_0: entered allmulticast mode [ 25.112819][ T295] bridge_slave_0: entered promiscuous mode [ 25.121924][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.129036][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.136472][ T294] bridge_slave_0: entered allmulticast mode [ 25.142702][ T294] bridge_slave_0: entered promiscuous mode [ 25.152253][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.159378][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.166551][ T294] bridge_slave_1: entered allmulticast mode [ 25.172829][ T294] bridge_slave_1: entered promiscuous mode [ 25.178913][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.185979][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.193060][ T295] bridge_slave_1: entered allmulticast mode [ 25.199453][ T295] bridge_slave_1: entered promiscuous mode [ 25.242581][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.249698][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.256831][ T296] bridge_slave_0: entered allmulticast mode [ 25.263044][ T296] bridge_slave_0: entered promiscuous mode [ 25.272959][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.280125][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.287365][ T296] bridge_slave_1: entered allmulticast mode [ 25.293658][ T296] bridge_slave_1: entered promiscuous mode [ 25.299741][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.307022][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.314132][ T297] bridge_slave_0: entered allmulticast mode [ 25.320416][ T297] bridge_slave_0: entered promiscuous mode [ 25.345140][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.352291][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.359721][ T297] bridge_slave_1: entered allmulticast mode [ 25.366064][ T297] bridge_slave_1: entered promiscuous mode [ 25.517582][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.524684][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.531981][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.539142][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.547716][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.554816][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.562118][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.569222][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.578829][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.586012][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.593347][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.600392][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.609021][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.616119][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.623431][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.630507][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.676354][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.684140][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.691327][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.698800][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.706843][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.714324][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.721538][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.729009][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.755503][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.762562][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.770440][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.777493][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.785203][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.792256][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.800005][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.807113][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.826790][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.833892][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.859069][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.866198][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.890800][ T297] veth0_vlan: entered promiscuous mode [ 25.906042][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.913096][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.920985][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.928085][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.940410][ T295] veth0_vlan: entered promiscuous mode [ 25.967995][ T296] veth0_vlan: entered promiscuous mode [ 25.974861][ T295] veth1_macvtap: entered promiscuous mode [ 25.988773][ T297] veth1_macvtap: entered promiscuous mode [ 26.001386][ T296] veth1_macvtap: entered promiscuous mode [ 26.043677][ T294] veth0_vlan: entered promiscuous mode [ 26.059645][ T295] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 26.074614][ T294] veth1_macvtap: entered promiscuous mode [ 26.175508][ T297] ------------[ cut here ]------------ [ 26.181071][ T297] WARNING: CPU: 0 PID: 297 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 26.190467][ T297] Modules linked in: [ 26.194485][ T297] CPU: 0 UID: 0 PID: 297 Comm: syz-executor Not tainted syzkaller #0 455e6e6e4058e005312aabb3f62c8d3b97c06770 [ 26.206212][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 26.216353][ T297] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 26.222000][ T297] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ee 4a 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 f6 a4 3e ff <0f> 0b e9 3e ff ff ff e8 ea a4 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 26.241824][ T297] RSP: 0018:ffffc9000b62fb48 EFLAGS: 00010293 [ 26.248039][ T297] RAX: ffffffff8249233a RBX: 0000000000000000 RCX: ffff888103b04c00 [ 26.256151][ T297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.264171][ T297] RBP: ffffc9000b62fb70 R08: ffff88811dd7045f R09: 1ffff11023bae08b [ 26.272178][ T297] R10: dffffc0000000000 R11: ffffed1023bae08c R12: 0000000000000000 [ 26.280197][ T297] R13: dffffc0000000000 R14: ffff88811dd703c0 R15: ffff88812d89aee0 [ 26.288212][ T297] FS: 0000555581baf500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 26.297298][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.303963][ T297] CR2: 0000555581bda998 CR3: 000000012c108000 CR4: 00000000003526b0 [ 26.311969][ T297] Call Trace: [ 26.315315][ T297] [ 26.318277][ T297] ovl_do_remove+0x81b/0xda0 [ 26.322916][ T297] ? ovl_set_redirect+0x780/0x780 [ 26.328060][ T297] ? down_write+0xee/0x2b0 [ 26.332529][ T297] ? __cfi_down_write+0x10/0x10 [ 26.337457][ T297] ovl_rmdir+0x1e/0x30 [ 26.341662][ T297] vfs_rmdir+0x3e0/0x560 [ 26.345974][ T297] incfs_kill_sb+0x109/0x230 [ 26.350604][ T297] deactivate_locked_super+0xd8/0x2a0 [ 26.356158][ T297] deactivate_super+0xb8/0xe0 [ 26.360879][ T297] cleanup_mnt+0x406/0x4a0 [ 26.365397][ T297] __cleanup_mnt+0x1d/0x40 [ 26.369855][ T297] task_work_run+0x1e5/0x260 [ 26.374522][ T297] ? __cfi_task_work_run+0x10/0x10 [ 26.379683][ T297] ? __x64_sys_umount+0x12e/0x180 [ 26.384770][ T297] ? __cfi___x64_sys_umount+0x10/0x10 [ 26.390187][ T297] ? __kasan_check_read+0x15/0x20 [ 26.395271][ T297] resume_user_mode_work+0x35/0x50 [ 26.400425][ T297] syscall_exit_to_user_mode+0x63/0xb0 [ 26.402659][ T328] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5'. [ 26.405956][ T297] do_syscall_64+0x63/0xf0 [ 26.405992][ T297] ? clear_bhb_loop+0x50/0xa0 [ 26.406022][ T297] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.429899][ T297] RIP: 0033:0x7feb9cd9e097 [ 26.434394][ T297] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 26.454485][ T297] RSP: 002b:00007ffd45cc31c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 26.462939][ T297] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007feb9cd9e097 [ 26.471025][ T297] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd45cc3280 [ 26.479058][ T297] RBP: 00007ffd45cc3280 R08: 00007ffd45cc4280 R09: 00000000ffffffff [ 26.487095][ T297] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd45cc4310 [ 26.495117][ T297] R13: 00007feb9ce321ca R14: 0000000000006619 R15: 00007ffd45cc4350 [ 26.503130][ T297] [ 26.506226][ T297] ---[ end trace 0000000000000000 ]--- [ 26.512929][ T297] ------------[ cut here ]------------ [ 26.518505][ T297] WARNING: CPU: 0 PID: 297 at fs/overlayfs/util.c:605 ovl_dir_modified+0x15a/0x190 [ 26.527889][ T297] Modules linked in: [ 26.531858][ T297] CPU: 0 UID: 0 PID: 297 Comm: syz-executor Tainted: G W syzkaller #0 455e6e6e4058e005312aabb3f62c8d3b97c06770 [ 26.545061][ T297] Tainted: [W]=WARN [ 26.548895][ T297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 26.559021][ T297] RIP: 0010:ovl_dir_modified+0x15a/0x190 [ 26.564727][ T297] Code: c1 e8 03 42 80 3c 28 00 74 08 4c 89 f7 e8 ee 4a 97 ff 49 ff 06 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 f6 a4 3e ff <0f> 0b e9 3e ff ff ff e8 ea a4 3e ff 0f 0b e9 6e ff ff ff 44 89 f9 [ 26.584533][ T297] RSP: 0018:ffffc9000b62fb48 EFLAGS: 00010293 [ 26.590647][ T297] RAX: ffffffff8249233a RBX: 0000000000000000 RCX: ffff888103b04c00 [ 26.598765][ T297] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 26.606811][ T297] RBP: ffffc9000b62fb70 R08: ffff88811dd7045f R09: 1ffff11023bae08b [ 26.614864][ T297] R10: dffffc0000000000 R11: ffffed1023bae08c R12: 0000000000000000 [ 26.622866][ T297] R13: dffffc0000000000 R14: ffff88811dd703c0 R15: ffff88812d89aee0 [ 26.630935][ T297] FS: 0000555581baf500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 26.639934][ T297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 26.646591][ T297] CR2: 0000555581bda998 CR3: 000000012c108000 CR4: 00000000003526b0 [ 26.654739][ T297] Call Trace: [ 26.658041][ T297] [ 26.661006][ T297] ovl_do_remove+0x81b/0xda0 [ 26.665693][ T297] ? ovl_set_redirect+0x780/0x780 [ 26.670767][ T297] ? down_write+0xee/0x2b0 [ 26.675341][ T297] ? __cfi_down_write+0x10/0x10 [ 26.680236][ T297] ovl_rmdir+0x1e/0x30 [ 26.684362][ T297] vfs_rmdir+0x3e0/0x560 [ 26.688642][ T297] incfs_kill_sb+0x1a0/0x230 [ 26.693297][ T297] deactivate_locked_super+0xd8/0x2a0 [ 26.698707][ T297] deactivate_super+0xb8/0xe0 [ 26.703456][ T297] cleanup_mnt+0x406/0x4a0 [ 26.707926][ T297] __cleanup_mnt+0x1d/0x40 [ 26.712364][ T297] task_work_run+0x1e5/0x260 [ 26.717052][ T297] ? __cfi_task_work_run+0x10/0x10 [ 26.722199][ T297] ? __x64_sys_umount+0x12e/0x180 [ 26.727296][ T297] ? __cfi___x64_sys_umount+0x10/0x10 [ 26.732709][ T297] ? __kasan_check_read+0x15/0x20 [ 26.737791][ T297] resume_user_mode_work+0x35/0x50 [ 26.742932][ T297] syscall_exit_to_user_mode+0x63/0xb0 [ 26.748467][ T297] do_syscall_64+0x63/0xf0 [ 26.752913][ T297] ? clear_bhb_loop+0x50/0xa0 [ 26.757717][ T297] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 26.763687][ T297] RIP: 0033:0x7feb9cd9e097 [ 26.768134][ T297] Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 26.787880][ T297] RSP: 002b:00007ffd45cc31c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 26.796367][ T297] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007feb9cd9e097 [ 26.804421][ T297] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd45cc3280 [ 26.812467][ T297] RBP: 00007ffd45cc3280 R08: 00007ffd45cc4280 R09: 00000000ffffffff [ 26.820521][ T297] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd45cc4310 [ 26.828564][ T297] R13: 00007feb9ce321ca R14: 0000000000006619 R15: 00007ffd45cc4350 [ 26.836663][ T297] [ 26.839708][ T297] ---[ end trace 0000000000000000 ]---