program: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000540)=0x2, 0x4) sendmmsg$inet_sctp(r0, &(0x7f00000058c0)=[{&(0x7f0000000180)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000880)=[{&(0x7f0000000340)="a1", 0x1}], 0x1}], 0x1, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000140)={r1}, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/nvmet/subsystems/subsys1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/nvmet/subsystems/subsys1/namespaces/1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1a4) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000300)={0x70, 0x0, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x4c, 0x2, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x40005}, 0x40) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="1801000030"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$int_in(r2, 0x40000000af01, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000340)={0x0, 0x1, 0x0, &(0x7f0000001600)=""/118, 0x0, 0x3332f000}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000100)) r5 = dup(r4) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000040)={0x0, r5}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./config/nvmet/subsystems/subsys1/namespaces/1/device_path\x00', 0x0, 0x0) write(r6, &(0x7f0000000200)='./file0\x00', 0x8) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./config/nvmet/subsystems/subsys1/namespaces/1/buffered_io\x00', 0x1, 0x0) write(r7, &(0x7f0000000200)='1\x00', 0x2) r8 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./config/nvmet/subsystems/subsys1/namespaces/1/enable\x00', 0x1, 0x0) write(r8, &(0x7f0000000200)='1\x00', 0x2) write(r8, &(0x7f0000000200)='0\x00', 0x2) [ 119.191513][ T4638] Bluetooth: hci0: command tx timeout [ 119.315802][ T5324] nvmet: adding nsid 1 to subsystem subsys1 [ 119.322934][ T5324] netlink: 'syz.0.0': attribute type 1 has an invalid length. [ 119.326670][ T5324] netlink: 232 bytes leftover after parsing attributes in process `syz.0.0'. [ 119.330848][ T5324] netlink: 'syz.0.0': attribute type 1 has an invalid length. [ 119.340746][ T24] audit: type=1800 audit(1786363793.172:2): pid=5324 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.0" name="device_path" dev="configfs" ino=4234 res=0 errno=0 [ 119.350661][ T5324] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 119.355679][ T5324] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 119.359198][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 119.362703][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 119.366663][ T5324] RIP: 0010:strlen+0x29/0x70 [ 119.368531][ T5324] Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00 [ 119.376192][ T5324] RSP: 0018:ffffc9000e937978 EFLAGS: 00010246 [ 119.378615][ T5324] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000 [ 119.381695][ T5324] RDX: ffffc90020001000 RSI: 0000000000000053 RDI: 0000000000000000 [ 119.384732][ T5324] RBP: ffffc9000e937ab8 R08: ffffffff90576c37 R09: 1ffffffff20aed86 [ 119.387898][ T5324] R10: dffffc0000000000 R11: fffffbfff20aed87 R12: 1ffff92001d26f40 [ 119.391011][ T5324] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff [ 119.394034][ T5324] FS: 00007ff4e96d76c0(0000) GS:ffff88808c549000(0000) knlGS:0000000000000000 [ 119.397524][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 119.400204][ T5324] CR2: 00007ff4e9701230 CR3: 000000001fc7b000 CR4: 0000000000352ef0 [ 119.403242][ T5324] Call Trace: [ 119.404580][ T5324] [ 119.405830][ T5324] do_getname_kernel+0x1d/0x230 [ 119.407830][ T5324] ? getname_kernel+0xd/0x20 [ 119.409787][ T5324] filp_open+0x87/0x1d0 [ 119.411486][ T5324] ? __pfx_filp_open+0x10/0x10 [ 119.413428][ T5324] ? __pfx___mutex_lock+0x10/0x10 [ 119.415333][ T5324] ? nvmet_ns_enable_store+0xc8/0x170 [ 119.417411][ T5324] nvmet_file_ns_enable+0x74/0x350 [ 119.419467][ T5324] nvmet_ns_enable+0xaa/0x780 [ 119.421302][ T5324] ? configfs_write_iter+0x238/0x430 [ 119.423504][ T5324] nvmet_ns_enable_store+0xd7/0x170 [ 119.425610][ T5324] ? __pfx_nvmet_ns_enable_store+0x10/0x10 [ 119.427761][ T5324] ? down_read+0x2be/0x330 [ 119.429601][ T5324] ? __pfx_nvmet_ns_enable_store+0x10/0x10 [ 119.432096][ T5324] configfs_write_iter+0x337/0x430 [ 119.434166][ T5324] vfs_write+0x612/0xba0 [ 119.435948][ T5324] ? __pfx_vfs_write+0x10/0x10 [ 119.437741][ T5324] ? __fget_files+0x2a/0x420 [ 119.439797][ T5324] ksys_write+0x150/0x270 [ 119.441658][ T5324] ? __pfx_ksys_write+0x10/0x10 [ 119.443572][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.446049][ T5324] do_syscall_64+0x174/0x580 [ 119.448190][ T5324] ? trace_irq_disable+0x3b/0x140 [ 119.450491][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 119.452750][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 119.455355][ T5324] RIP: 0033:0x7ff4e879e0d9 [ 119.457314][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 119.464905][ T5324] RSP: 002b:00007ff4e96d6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 119.468149][ T5324] RAX: ffffffffffffffda RBX: 00007ff4e8a26090 RCX: 00007ff4e879e0d9 [ 119.471371][ T5324] RDX: 0000000000000002 RSI: 0000200000000200 RDI: 000000000000000b [ 119.474814][ T5324] RBP: 00007ff4e8835024 R08: 0000000000000000 R09: 0000000000000000 [ 119.478314][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 119.481401][ T5324] R13: 00007ff4e8a26128 R14: 00007ff4e8a26090 R15: 00007ffd9a9499a8 [ 119.484204][ T5324] [ 119.485388][ T5324] Modules linked in: [ 119.487436][ T5324] ---[ end trace 0000000000000000 ]--- [ 119.495735][ T5324] RIP: 0010:strlen+0x29/0x70 [ 119.497880][ T5324] Code: 90 f3 0f 1e fa 41 57 41 56 41 54 53 48 c7 c0 ff ff ff ff 49 be 00 00 00 00 00 fc ff df 48 89 fb 49 89 c7 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 75 11 48 ff c3 49 8d 47 01 42 80 7c 3f 01 00 [ 119.506743][ T5324] RSP: 0018:ffffc9000e937978 EFLAGS: 00010246 [ 119.509406][ T5324] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000100000 [ 119.513100][ T5324] RDX: ffffc90020001000 RSI: 0000000000000053 RDI: 0000000000000000 [ 119.516383][ T5324] RBP: ffffc9000e937ab8 R08: ffffffff90576c37 R09: 1ffffffff20aed86 [ 119.520154][ T5324] R10: dffffc0000000000 R11: fffffbfff20aed87 R12: 1ffff92001d26f40 [ 119.523570][ T5324] R13: dffffc0000000000 R14: dffffc0000000000 R15: ffffffffffffffff [ 119.526742][ T5324] FS: 00007ff4e96d76c0(0000) GS:ffff88808c549000(0000) knlGS:0000000000000000 [ 119.530871][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 119.533641][ T5324] CR2: 00007ff4e96b5fe8 CR3: 000000001fc7b000 CR4: 0000000000352ef0 [ 119.537075][ T5324] Kernel panic - not syncing: Fatal exception [ 119.540299][ T5324] Kernel Offset: disabled [ 119.542231][ T5324] Rebooting in 86400 seconds..