Extracting prog: 1m26.193858616s
Minimizing prog: 33m10.038267362s
Simplifying prog options: 0s
Extracting C: 1m9.339908347s
Simplifying C: 6m43.570486738s


extracting reproducer from 43 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-openat$kvm-mount-mkdirat-mkdirat-mkdirat-rmdir-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$ieee802154-sendmsg$IEEE802154_LLSEC_SETPARAMS-rmdir-rmdir-rmdir-ioctl$sock_inet_SIOCSIFDSTADDR
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
rmdir(0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ieee802154(0x0, r2)
sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, 0x0, 0x4000000)
rmdir(0x0)
rmdir(0x0)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')
ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000500)={'bridge_slave_0\x00', {0x2, 0x4e23, @local}})

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
single: successfully extracted reproducer
found reproducer with 22 syscalls
minimizing guilty program
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-openat$kvm-mount-mkdirat-mkdirat-mkdirat-rmdir-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$ieee802154-sendmsg$IEEE802154_LLSEC_SETPARAMS-rmdir-rmdir-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
rmdir(0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ieee802154(0x0, r2)
sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, 0x0, 0x4000000)
rmdir(0x0)
rmdir(0x0)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-openat$kvm-mount-mkdirat-mkdirat-mkdirat-rmdir-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$ieee802154-sendmsg$IEEE802154_LLSEC_SETPARAMS-rmdir-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
rmdir(0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ieee802154(0x0, r2)
sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, 0x0, 0x4000000)
rmdir(0x0)
rmdir(0x0)

program did not crash
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-openat$kvm-mount-mkdirat-mkdirat-mkdirat-rmdir-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$ieee802154-sendmsg$IEEE802154_LLSEC_SETPARAMS-rmdir-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
rmdir(0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ieee802154(0x0, r2)
sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, 0x0, 0x4000000)
rmdir(0x0)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-openat$kvm-mount-mkdirat-mkdirat-mkdirat-rmdir-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$ieee802154-sendmsg$IEEE802154_LLSEC_SETPARAMS-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
rmdir(0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ieee802154(0x0, r2)
sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, 0x0, 0x4000000)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-openat$kvm-mount-mkdirat-mkdirat-mkdirat-rmdir-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$ieee802154-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
rmdir(0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ieee802154(0x0, r2)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in __kernfs_remove
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-openat$kvm-mount-mkdirat-mkdirat-mkdirat-rmdir-syz_init_net_socket$nl_generic-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
rmdir(0x0)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-openat$kvm-mount-mkdirat-mkdirat-mkdirat-rmdir-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
rmdir(0x0)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-openat$kvm-mount-mkdirat-mkdirat-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-openat$kvm-mount-mkdirat-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-openat$kvm-mount-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in __kernfs_remove
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-openat$kvm-mount-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-openat$kvm-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mremap-mount-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-madvise-mount-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_drain
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-sync-mount-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
sync()
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-io_pgetevents-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340)=<r1=>0x0)
io_pgetevents(r1, 0xdb, 0x5, &(0x7f0000000380)=[{}, {}, {}, {}, {}], &(0x7f0000000440), &(0x7f00000004c0)={&(0x7f0000000480)={[0x1]}, 0x8})
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-io_setup-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
io_setup(0x7, &(0x7f0000000340))
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-writev-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
writev(r0, &(0x7f0000000200)=[{&(0x7f0000000240)="9070cb64b2762d93007307e0ec3f35659ffaeab71c692afc2a8ad029fcb67b21ef9714bdbc08e14610109b86602c6a68c885dfc6f417a6bc4305359c664fa51acbd61a67c8c00d43266650ec9d44d59bd0b28ed3067ef1e756837412c1e766cd0077a666b2f536e9e3d1d7cccadeb2586f484a5431eb05174e79d33a5b7e61b2853fe9067f69849aba4edcc26ba2a29ea88089943cfb95424c762385207bfc22ecbf5250319de00358ec76790d5b63cc6fb8725da90771cabd32967efccbe2d597c4b5768ccd950d", 0xc8}, {&(0x7f0000000100)="516c2501594ef57644217a2921237d6b3ee4e15ba84cb28bb5e2ecb78e3120b5a89aa76e8276ef314471cc7a4e346731ee17cc0f61d265d4f82d501f597c9d30d8627a42f669d3118647988ce15b8413a4a29d2f8f703c6ad48f51db1ebdb670e083cdd529f7c38af188cd1f412ba937b7a920da3272f624f4d358649056cea526b6b263ccc4cdfd9452cf2c21ac463a717db0124a91077fd9a17b3f9c694c1925935856d59c76465d8d025cf3b7af16708840da26c47ac3a450e6b446183f3f829249e21ec30cb42e5157dedfff4816fba9350a3c2d816a331b163af8d20fd361730272397be0f708f02696882c", 0xee}], 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-rt_sigtimedwait-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
socket$inet_udp(0x2, 0x2, 0x0)
rt_sigtimedwait(&(0x7f0000000000)={[0x5b0]}, &(0x7f0000000040), &(0x7f00000000c0)={0x77359400}, 0x8)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
socket$inet_udp(0x2, 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program did not crash
testing program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=48.17807191s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_remove
simplifying C reproducer
testing compiled C program (duration=48.17807191s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing compiled C program (duration=48.17807191s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
program did not crash
testing compiled C program (duration=48.17807191s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing compiled C program (duration=48.17807191s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_drain
testing compiled C program (duration=48.17807191s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing compiled C program (duration=48.17807191s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
testing compiled C program (duration=48.17807191s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
program crashed: BUG: scheduling while atomic in kernfs_remove
testing program (duration=48.17807191s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
validation run: crashed=true
testing program (duration=48.17807191s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
validation run: crashed=true
testing program (duration=48.17807191s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-rmdir
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
rmdir(&(0x7f00000002c0)='./config/usb_gadget/g1\x00')

program crashed: BUG: scheduling while atomic in kernfs_remove_by_name_ns
validation run: crashed=true
reproducing took 45m53.696072756s
repro crashed as (corrupted=false):
BUG: scheduling while atomic: syz.2.18/384/0x00000002
Modules linked in:
CPU: 1 UID: 0 PID: 384 Comm: syz.2.18 Not tainted syzkaller #0 a4a563d0c71b2f3eba821a1af94cbf4bdc8174ca
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 __schedule_bug+0x12b/0x200 kernel/sched/core.c:6626
 schedule_debug kernel/sched/core.c:6653 [inline]
 __schedule+0xb85/0x20b0 kernel/sched/core.c:7697
 __schedule_loop kernel/sched/core.c:7957 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7972
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8029
 rwsem_down_write_slowpath+0x5c9/0x1b60 kernel/locking/rwsem.c:1239
 __down_write_common kernel/locking/rwsem.c:1383 [inline]
 __down_write kernel/locking/rwsem.c:1392 [inline]
 down_write+0x163/0x2b0 kernel/locking/rwsem.c:1659
 kernfs_remove_by_name_ns+0x8c/0x180 fs/kernfs/dir.c:1737
 kernfs_remove_by_name include/linux/kernfs.h:637 [inline]
 sysfs_unmerge_group+0xd7/0x130 fs/sysfs/group.c:399
 rpm_sysfs_remove drivers/base/power/sysfs.c:826 [inline]
 dpm_sysfs_remove+0x7b/0xd0 drivers/base/power/sysfs.c:835
 device_del+0x241/0xcf0 drivers/base/core.c:3856
 device_unregister drivers/base/core.c:3922 [inline]
 device_destroy+0xb0/0x100 drivers/base/core.c:4521
 android_device_destroy+0x118/0x180 drivers/usb/gadget/android_configfs_uevent.c:223
 gadgets_drop+0x1d/0x30 drivers/usb/gadget/configfs.c:2075
 client_drop_item fs/configfs/dir.c:943 [inline]
 configfs_rmdir+0x8ba/0x9b0 fs/configfs/dir.c:1546
 vfs_rmdir+0x3db/0x560 fs/namei.c:4348
 do_rmdir+0x29a/0x590 fs/namei.c:4407
 __do_sys_rmdir fs/namei.c:4426 [inline]
 __se_sys_rmdir fs/namei.c:4424 [inline]
 __x64_sys_rmdir+0x4b/0x60 fs/namei.c:4424
 x64_sys_call+0xaf7/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:85
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f4ff339de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd818bd0e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f4ff3625fa0 RCX: 00007f4ff339de99
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000002c0
RBP: 00007f4ff3433eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4ff3625fac R14: 00007f4ff3625fa0 R15: 00007f4ff3625fa0
 </TASK>
BUG: scheduling while atomic: syz.2.18/384/0x00000000
Modules linked in:
Modules linked in:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 0 P4D 0 
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 384 Comm: syz.2.18 Tainted: G        W          syzkaller #0 a4a563d0c71b2f3eba821a1af94cbf4bdc8174ca
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:page_fault_oops+0x82e/0x9d0 arch/x86/mm/fault.c:707
Code: 8b 1d 46 8a bf 7e 48 83 c3 20 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8 2c d0 9a 00 48 8b 1b 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 13 d0 9a 00 48 8b 1b bf 9d 6e ac
RSP: 0018:ffffc90000eaf020 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 341621853369e000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90000eaf1c0 R08: ffff8881f6e294d3 R09: 1ffff1103edc529a
R10: dffffc0000000000 R11: ffffed103edc529b R12: ffffc90000eaf2d8
R13: 1ffff920001d5e10 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001209ec000 CR4: 00000000003526b0
Call Trace:
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:page_fault_oops+0x82e/0x9d0 arch/x86/mm/fault.c:707
Code: 8b 1d 46 8a bf 7e 48 83 c3 20 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8 2c d0 9a 00 48 8b 1b 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 13 d0 9a 00 48 8b 1b bf 9d 6e ac
RSP: 0018:ffffc90000eaf020 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 341621853369e000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90000eaf1c0 R08: ffff8881f6e294d3 R09: 1ffff1103edc529a
R10: dffffc0000000000 R11: ffffed103edc529b R12: ffffc90000eaf2d8
R13: 1ffff920001d5e10 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001209ec000 CR4: 00000000003526b0
----------------
Code disassembly (best guess):
   0:	8b 1d 46 8a bf 7e    	mov    0x7ebf8a46(%rip),%ebx        # 0x7ebf8a4c
   6:	48 83 c3 20          	add    $0x20,%rbx
   a:	48 89 d8             	mov    %rbx,%rax
   d:	48 c1 e8 03          	shr    $0x3,%rax
  11:	42 80 3c 30 00       	cmpb   $0x0,(%rax,%r14,1)
  16:	74 08                	je     0x20
  18:	48 89 df             	mov    %rbx,%rdi
  1b:	e8 2c d0 9a 00       	call   0x9ad04c
  20:	48 8b 1b             	mov    (%rbx),%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 30 00       	cmpb   $0x0,(%rax,%r14,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 13 d0 9a 00       	call   0x9ad04c
  39:	48 8b 1b             	mov    (%rbx),%rbx
  3c:	bf                   	.byte 0xbf
  3d:	9d                   	popf
  3e:	6e                   	outsb  %ds:(%rsi),(%dx)
  3f:	ac                   	lods   %ds:(%rsi),%al

final repro crashed as (corrupted=false):
BUG: scheduling while atomic: syz.2.18/384/0x00000002
Modules linked in:
CPU: 1 UID: 0 PID: 384 Comm: syz.2.18 Not tainted syzkaller #0 a4a563d0c71b2f3eba821a1af94cbf4bdc8174ca
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 __schedule_bug+0x12b/0x200 kernel/sched/core.c:6626
 schedule_debug kernel/sched/core.c:6653 [inline]
 __schedule+0xb85/0x20b0 kernel/sched/core.c:7697
 __schedule_loop kernel/sched/core.c:7957 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7972
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:8029
 rwsem_down_write_slowpath+0x5c9/0x1b60 kernel/locking/rwsem.c:1239
 __down_write_common kernel/locking/rwsem.c:1383 [inline]
 __down_write kernel/locking/rwsem.c:1392 [inline]
 down_write+0x163/0x2b0 kernel/locking/rwsem.c:1659
 kernfs_remove_by_name_ns+0x8c/0x180 fs/kernfs/dir.c:1737
 kernfs_remove_by_name include/linux/kernfs.h:637 [inline]
 sysfs_unmerge_group+0xd7/0x130 fs/sysfs/group.c:399
 rpm_sysfs_remove drivers/base/power/sysfs.c:826 [inline]
 dpm_sysfs_remove+0x7b/0xd0 drivers/base/power/sysfs.c:835
 device_del+0x241/0xcf0 drivers/base/core.c:3856
 device_unregister drivers/base/core.c:3922 [inline]
 device_destroy+0xb0/0x100 drivers/base/core.c:4521
 android_device_destroy+0x118/0x180 drivers/usb/gadget/android_configfs_uevent.c:223
 gadgets_drop+0x1d/0x30 drivers/usb/gadget/configfs.c:2075
 client_drop_item fs/configfs/dir.c:943 [inline]
 configfs_rmdir+0x8ba/0x9b0 fs/configfs/dir.c:1546
 vfs_rmdir+0x3db/0x560 fs/namei.c:4348
 do_rmdir+0x29a/0x590 fs/namei.c:4407
 __do_sys_rmdir fs/namei.c:4426 [inline]
 __se_sys_rmdir fs/namei.c:4424 [inline]
 __x64_sys_rmdir+0x4b/0x60 fs/namei.c:4424
 x64_sys_call+0xaf7/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:85
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f4ff339de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd818bd0e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f4ff3625fa0 RCX: 00007f4ff339de99
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000002c0
RBP: 00007f4ff3433eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4ff3625fac R14: 00007f4ff3625fa0 R15: 00007f4ff3625fa0
 </TASK>
BUG: scheduling while atomic: syz.2.18/384/0x00000000
Modules linked in:
Modules linked in:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 0 P4D 0 
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 384 Comm: syz.2.18 Tainted: G        W          syzkaller #0 a4a563d0c71b2f3eba821a1af94cbf4bdc8174ca
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:page_fault_oops+0x82e/0x9d0 arch/x86/mm/fault.c:707
Code: 8b 1d 46 8a bf 7e 48 83 c3 20 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8 2c d0 9a 00 48 8b 1b 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 13 d0 9a 00 48 8b 1b bf 9d 6e ac
RSP: 0018:ffffc90000eaf020 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 341621853369e000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90000eaf1c0 R08: ffff8881f6e294d3 R09: 1ffff1103edc529a
R10: dffffc0000000000 R11: ffffed103edc529b R12: ffffc90000eaf2d8
R13: 1ffff920001d5e10 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001209ec000 CR4: 00000000003526b0
Call Trace:
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:page_fault_oops+0x82e/0x9d0 arch/x86/mm/fault.c:707
Code: 8b 1d 46 8a bf 7e 48 83 c3 20 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8 2c d0 9a 00 48 8b 1b 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 13 d0 9a 00 48 8b 1b bf 9d 6e ac
RSP: 0018:ffffc90000eaf020 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 341621853369e000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90000eaf1c0 R08: ffff8881f6e294d3 R09: 1ffff1103edc529a
R10: dffffc0000000000 R11: ffffed103edc529b R12: ffffc90000eaf2d8
R13: 1ffff920001d5e10 R14: dffffc0000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001209ec000 CR4: 00000000003526b0
----------------
Code disassembly (best guess):
   0:	8b 1d 46 8a bf 7e    	mov    0x7ebf8a46(%rip),%ebx        # 0x7ebf8a4c
   6:	48 83 c3 20          	add    $0x20,%rbx
   a:	48 89 d8             	mov    %rbx,%rax
   d:	48 c1 e8 03          	shr    $0x3,%rax
  11:	42 80 3c 30 00       	cmpb   $0x0,(%rax,%r14,1)
  16:	74 08                	je     0x20
  18:	48 89 df             	mov    %rbx,%rdi
  1b:	e8 2c d0 9a 00       	call   0x9ad04c
  20:	48 8b 1b             	mov    (%rbx),%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 30 00       	cmpb   $0x0,(%rax,%r14,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 13 d0 9a 00       	call   0x9ad04c
  39:	48 8b 1b             	mov    (%rbx),%rbx
  3c:	bf                   	.byte 0xbf
  3d:	9d                   	popf
  3e:	6e                   	outsb  %ds:(%rsi),(%dx)
  3f:	ac                   	lods   %ds:(%rsi),%al