Extracting prog: 13m2.129614336s Minimizing prog: 8m17.073802855s Simplifying prog options: 0s Extracting C: 24.411719819s Simplifying C: 11m40.38122917s extracting reproducer from 24 programs testing a last program of every proc single: executing 4 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-syz_open_procfs-read$FUSE-add_key-read$FUSE detailed listing: executing program 0: r0 = userfaultfd(0x80001) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) read$FUSE(r1, &(0x7f0000000040)={0x2020}, 0x2020) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): writev-madvise-write$P9_RGETLOCK-socket$xdp-setsockopt$XDP_UMEM_REG detailed listing: executing program 0: writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a117436c379000000000000000058", 0x1f}], 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x200002e6) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000340)={0x0, 0x312000, 0x800, 0x0, 0x5}, 0x20) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$selinux_policy-mmap-fsopen-openat$cgroup_ro-write$binfmt_script detailed listing: executing program 0: r0 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x12, r0, 0x0) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_icmp_raw-dup-sendmsg$inet-ioctl$SIOCGSTAMP-readv detailed listing: executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) sendmsg$inet(r1, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0xffff, @multicast1}, 0x10, &(0x7f00000014c0)=[{&(0x7f0000000000)="be39", 0xffeb}, {0x0}], 0x2, &(0x7f0000000c80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private}}}], 0x20}, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) readv(r1, &(0x7f0000000280)=[{&(0x7f0000000140)=""/15, 0xf}], 0x1) program did not crash single: failed to extract reproducer bisect: bisecting 24 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5] detailed listing: executing program 2: r0 = socket(0x2, 0x3, 0x88) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x0, 0x0, 0x98b3}, {0x6, 0x8, 0xfd, 0x7}]}, 0x10) bind$inet(r0, &(0x7f0000000080)={0x2, 0xfffa, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000002400)={0x2, 0x0, @multicast2}, 0x10) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000480)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000100), 0x4) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000140), 0x4) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x6e22, 0x9, @empty, 0x8}, 0x1c) listen(r0, 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="540000001200010000000000000000000a0304006e22"], 0x54}}, 0x20044010) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = ioctl$KVM_GET_STATS_FD_cpu(r2, 0xaece) read$FUSE(r3, &(0x7f00000001c0)={0x2020}, 0x2020) executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000300)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) executing program 2: r0 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setreuid(r1, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) setpriority(0x2, 0xff, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000080)={@void, @val={0x0, 0x3, 0x1c, 0x93, 0x14, 0x6}, @ipv4=@igmp={{0x5, 0x4, 0x3, 0x8, 0x14, 0x64, 0x0, 0x3, 0x2, 0x0, @empty, @empty}, {0x11, 0x6, 0x0, @empty}}}, 0x26) executing program 3: socket(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x2, 0x1, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000280)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x5865, r2}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)='\"', 0x1}], 0x1, 0x0, 0x0, 0x2f00}}], 0x1, 0x0) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x82f41, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000d40)={@val={0xa, 0x9000}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x30, 0x3a, 0xff, @remote, @mcast2, {[], @dest_unreach={0x1, 0x2, 0x0, 0x3, '\x00', {0xf, 0x6, 'V#\a', 0x6, 0x87, 0x1, @dev={0xfe, 0x80, '\x00', 0x1b}, @ipv4={'\x00', '\xff\xff', @multicast2}}}}}}}}}, 0x6a) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(r1, 0x4068aea3, &(0x7f0000000080)={0x74, 0x0, 0xf1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x1a0, 0x0, 0x1000000}]}) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000001840)={@void, @val={0x1, 0x3, 0x1c, 0x3, 0x14, 0x6}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x33, 0xfc0, 0x67, 0x0, 0xfd, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, {[@end]}}, "414dc1c90728557ded5995abd8c2dd746ed1b8e7b953b5e7039ee546652f979f45a699fe21e6401621d129bbfcdacc6b80371644b7d06d7ced9f49c41edcd1f2c4e5b6e13a486859035a1f0f7cf9905062e4a7d9b84398ec0a5f4018a0815fd0f9d5f5cf02964d8f9e484244f3afa2a3aac22182bf29dd83fc2bc291c8fec64be60c54e2c3a73c9474d9bbf9d6bbc1c3faf325a485fbc671a53dbab2ce05898db07fa7ed32bf943a142654fbdaeba416136f286952082afa985e3a59d21de084543dd2192156ad57f32238f6cbe9050ca5d73b9d7f9daed4d01c046abcf3439f7bd2c066f6bc259af55781ce2d10451850f2a907c9cd6db4913164efd7b47de7da19b0a98188fdc3704f55d37e22f9e18ad5ecb9fc3a2bbe85e2b488811c531f4af7831f399de76688f025b636f490a2c1140af9b62858617087f5cae53e6640e051945577ffb1e4c07bdfef5034a41a16a6162cdfd7b69330e8ce9902fc3a76f3f1bff2ea11f1c8368687653a926063831b0967480abb48f734ef8cfc15e42fb9361410d938cc9c1b304e8286220488d51488455c3f3b2c686a030bb4d64b2677a9d8aa87dbf39a278dd316db1e7d1da260c0008a256de039f851c4712db2beeed68ac56a5d925786cf0b3b12c1d2f25f0e437b188655fa6b9f5b775020754733fdb615326d945d30abc662a4933d74492c00241d2e025cba5edf85732f0d53488695aa867f1a3e74c077a543107ec5b4d1070e0ac128e2e09ed9d3087a3bc9a3eeacaa976d09b305dcfcf9e0fd14c6f4b1a0331c9382e1ca125be2643acd6c38d9873a6913af9a495e5ebab69aa7637c3704d5ed0eb7b684bff90a026bdee567d8701d543454a4ecc593a75ce070a847acd879459ff9f5671ccded94d231a60a1c1a2a4d8820dd1920f0eb66c8816467d07acce147b5b93c65f56c5f5714c96d8cf6c38ec5993e8687797f054427ae0a1f8390ee20c7fdf967a674983bee76f3982fc296d8b40b297c3c447313d05d81105949ee47e18f824860d33ad80cb8ffb3f10622551bcad32798313311e36f3a59a13c11f8df3a9bea5e95682e21eef4f01a32e3b16817830f5ab971184521c370efe8b3b17ab39caf1949c32395d20286eb2865b7191c051995a4bc0d87e1a1df8c2b474642d9d00a47b8ec249d9099b41897f0412e77384be189f3a9521d5fe2e15108d7c840ccae4e366e3382817d2de0855eebd12805da92782cfc4c69ba54916c5880f2da87a04e15c3afffbba0cacb12162c0681e58cd204e22474f3ba1416d052a6e991640febd529cc0861b6fb26f2cc922b76341b5546a103722a7083b8d69a4458c92655217c7b3fba1a9fc9116da2e0e8fe8381cde006f99f7192fcff78cd5221ab401808385a57438a9395203382bbe4fdbfd0cbe7f53f60e1cd88f94e465e828434d7334d087e375b1913032818049206c86e013ab3e54cc34eb4f1a5575091a20fd4d3cce623d734f74d36594646080083a8eb2c0a9615f5e1460204afbbb285bb6091e5c43255bade58f4be99dca47285966dec4c2a98e6bd99d935c5f39ee8d617d055b801fc9ba3f58c68d123153c0144539146ecf83652843ceb4786ceb2c6dead9bf368c5f05767fe28da6133f8b683992f12d875f46c41fee7a6990ed194416f363eaf91adcd424f7fe4024133f0c3c9a170d0308598bad014008349b0352e2658b17fe9d903e0a10d0aefe8448fbafd7d5cece702c67843560d9bd54f1a516f61b2389fa98eac264d01ee2f3acb30036f01dbbcaa5a0e62017a37742162b43d2a3e0a08ce6dc44b8713df9d090bad5638922f2d417a9da3f248df018c6e6ee29a76a25b3f5c7e77877e0c5cba1e4c1947e0b7815844519624a127d58b48e47c2504174e15a9d24c2559cb8586ac5392c4f7a8a190147f9405b778163f5de42cd51b6e198cd7d8ccbce72d0a22f731d1426dfe22bf0c93de40194bd7b2ec1b8d17b5dcbffbbd3eada2a260a2d3cb5c836aa97a4967cfe492456f1d3b0303fd3c8653af690fa985d8ee29d411461c76ca62df91cdf18faf945757ac430ee13ef938d4f351aeb279402effd2ac4f8ac8a75354fee8a42d944df98efdc96fe5ddcfc02c5ca788cd918b5983141dbadcec555186272c5abea47d79f3eb7f9349b7062c3c093d72a580012e94a6ada93cb8fbde2eb0357951269ae6cc6ba9c35f2c2ad2774d4acc0b8c0a46d231de850d3b4fe9941513ed3b5bf644d99fb79dd22785739f234114ee658418df8624955c14cb726465f91c9da2219383db4fba5ddfa19a432e04bba317a8ac0a4a7fdeae5f1ee0ba67316841c87d240d78cf19f6cbfdb76644331a0c42ed2486224b5a5ad74798adcbd1a141c0425d5d55e55d345d42489cfe3527bfc4a32b211390c19a70ea89b1ec9627a982ba9de1c8bce85eedcb8363dc2c71e71c17657a6ce9445235d04025cd29a432ee6487b4cd84732e38639abb1aee400b2cbd285ac1f57ff37f0ce299a25014c9cb7931f391e5b2fb4c22930018d5f99d0e24627b341e6f56135876fc6c8ed52d769401b2de57e2d76311ac5d188a3859f234a5d5b4b0387e5caa87be5f4f10454ee218e1a781f8d67c9d022234bfa29a62a8f73209da83cdd596864f5bce9b235066ff4f54a7874a993e097c6d3367e0e929347220e45b68b31733ca70707f58470af08c0cd6ed4c91fa958215a68de6b850fb306a32ee661012dd6fe79d786ba2678f4b5cad943ed6fc4caffce07a748ee59b28e3db92b1c62239f13e8e49a654ca5ba43852eda5c74505f7cb786eff763fa1caeceab419302f3882869b3804c55d31b1511fd65fe04c851ce4c8e7e2e09107e757a050cfb1a20c150481bd249e712c4596c5f87d3006609202b2f999a1baa30504d70128c6af0225cd0a64a832657b0ebe4200ae504c2c694d1a404f6da594d45e2de2aa7eb665aa45bcb8cda7ecc2a29e2496154e1cd7e366e71ca2d0a8652cff625de42cce24294e8f7e4617db9ce2b29c233ad401d28f8cce741c247efba5fdfde43f45776dbab2e6858d7bcff5a01be4448792868f80143d7c0b638ddc226a91e4299c7a8eab9603e2e9dcfd2a9be8070515eb83b101b0fb8cddf0bb46166ff109a8094861b1a8187d1c95216877779d387152606568f5f931614f00d4a52416004dc4a8006c2933ba377d9a4c1a9a06e17f17e7957db5a0a87bf2e9e454fcab7aada678fa50ed860aa7243dee5ccdb4d4ae12f93f0b4b2b4182c8ca9340d557606967b9b84c292a5b7c543e9c6bc2ed36eef34913de523ff181c097dfe8f80295357e9071f993f24d2fb4f55a6158d25b1a0e1971809986c8e48acf4784971e18152230b679347ab1e81b029cf711b15daa07c0ce3cfe482c8c6a7956d00021f337934afe3f1e62fcebb12630d9fde0d54750f2d58545ea4077c220a5aa505363a0321a44eed02483cbee7b6f84a3636861c69e9dc26a399d4492d33033756cd4daab72d20dd04c1edc44ef0b9bbdf63ba3e713c5cee50ff96646ca94895cd206ec89862bd6d97551796b408de07c12639247592b1513b719738779cbb64d886cf192f5577c1b2d0c4be28134400291e950aaf328f63068fa988dc065d2385f659bd04beb7d9995d2954c236ecb92c3fc27ae6cb083c59729d1bbf60988557606661e2ccb99798a43b6def2483108ce62758204ac56c27bd42ec1bbddb102a9a20cbd1b2f760157aa6656b714dd4a909b481c83c3b92c2e1452a2be07a1cf13d9235909e59c4663f15ef1e688151300d04383bfb44c595fb16a9045fa8f06df8b54feb69d1b42feb8e76485c243cfe769b1bd09fdabd6edc7547454a76ee601479430eac8ec51e97fb51f2eb6e2d099a7a9dc7e015edc4468435b40950899a236801a54ce77b46a9d74363c6aaf6ea05a997219073f145580b4064862f772613bff0dd604c119f5a0f570b214b4bd529d587443f60778a70bfc062998a4310c3af3990ba4d00fae848fbaf638dd7070d1b8fc36b4e176cbf7219521c893e29310c1d0aed8d9b67fcea66c0710a38e37f61d4eb3aa803a2206369fc24645dc827c09ed7c549adccc23f96baf18aa66d757b406fc267ba243d97231eaf7e934abf90201d4cfece387aa69913e2ac98e0502cd6d6ce737db38e5b1f6d1cf8018a8364fd3f5b9483ea78f655feba6536162f9996d703636a10ae343b6ab0a5a61e7fd8ce27383322687d5e256104bb91f44ac4f55fe27c6347e75ea2e76ffb704c3d13af4dabd20c0d82f19698b1993e86ee98772f0d91362f5e26094dbe6bb03d1418db3b707d76497216f3075cc065adbc3029eaa986ffbb73932c9a1e58920922d48ca4751c653978350ec11c4559b6caf21065fda89e00815cb5a4e7f94b0765c5a3e270c8d56c8456361230245a54525571bfbc4ec90cff3561f38be5d2bfb288812a530c5ae466de8b8d40349d7c6d327fc15738502d665b0bad1815009cb7227fff27ac01075d82696a0b58aac31d2a86fb25794840c59665f9bc78040946c20f9380561c21feec4a33f02d74f7b1eb853804b7bc413d550213c9ca9fd036fb7b49de6388d4b7139facb8854eafd2f190fa52caf613ada77a15eb11accf86805583a9b6e2a25dd67d1b78c12b7d40655faa827177f7242c05e641b207273c2e83e0f0b1b121adc46e6571fb6a36c83fe96b162dec42bec95c3d7e4b208a270f3ec6697ea587a6c59617f83b523c83b09c7cca62d0bbcdadf9082195df7d2edca76d4d68ef47e7d4b07c4feee350b0fcf74456621e3d77d4babc41a75a6e045322d1fbddee131c5630834ec7cb0c9539dcc09ada86dba4374115078345511b96c33a1e68233876620a7f2aff2c0da846e5eb3d3f18c08966e485e33981dbdf3a357488b0e1452b3c56e703e56b736b2bad4a4b94083c8568e87ea85df59cb840b34a71b2748e80d41ff39e7038154b775b4db18887b67bea223f2b4bdffe40031eede920f370ca46cb6cc273f20cec5d571407277a610d7d339a037a4bbee23da4ab3f165be0ed7a2ab05b87d826b0d30587546ac26f55d93f2f0b1809da0f865721ae38866990e42a60e9003f7b4f1c5f2142dcb69ce659bd060368778f4022fe484ec67063bd5446baa1502cbe15a60ba50e83984d6df1127ee8001c07698c3867c1dcbb90446adc177ca75506ae2e3ddc68fb8951b648f05eebd0d0edd121ee51dd0003ff00a3085d5a613a10532c0cb0d2ac78b4852c06f26875f681d35c3966b4129bad16bf8914aa4d8de43140e9e1c341cde07a9d2fd2cce6a52e0bfc46004696887f1b00e628a335ca62cf38121a72d1dfead99c7138189f1cff37cb7682e9c29fd548d5443d97d61efd28c6fe34673161c907203077e4c68d48cefbf0e77a2359794d47b133b77871fd9a6775b962eb678945ef9df48afb580f123c1cd3fadd3f8982e585e7a459b7ecdb9080b9ec945c34011b0a057295dfc5fb94a008d8257f1463536525c72ee5c7f49fdd80b9b6bd948fb34a886ca87758dca9870c56bfa54601cc56946a4236e43742e74e95ae2f6a59a0a85a52ad218c15dcf4a74b1e8320174c50e88a3e1d54ae6d9ea8b4bdbbd1acf9bb39f339ee68fcfa994a29c1e46089459856d15bc6a78eca909fc8c2401371d16bdacc04bb82376"}}, 0xfca) executing program 0: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d") ioctl(r0, 0xc138fd0e, &(0x7f0000000000)) executing program 1: newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) setresuid(r0, r0, 0x0) r1 = getpid() r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r2, r1, 0x7, 0xffffffffffffffff, 0x0) executing program 1: mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000140)={0x0, 0x7217, 0x4000, 0x3, 0x21f}, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xecc7, 0x20000, 0x2, 0x28e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf9a, 0x1248, 0x1200, 0xe3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x8000, 0x2, 0xf6, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec21, 0x100, 0x3, 0x18f}}], 0x4, 0x0, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x1, 0x1, 0xffff1000, 0x2000, &(0x7f0000f8d000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000000)={0x1, 0x0, &(0x7f0000f4e000/0x3000)=nil}) executing program 3: ioperm(0x4, 0x8, 0x5) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) prctl$PR_SET_MM(0x23, 0x6, &(0x7f000005b000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffd000/0x3000)=nil) brk(0x200004ffc000) executing program 3: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x111) rmdir(&(0x7f00000000c0)='./control\x00') executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) sendmsg$inet(r1, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0xffff, @multicast1}, 0x10, &(0x7f00000014c0)=[{&(0x7f0000000000)="be39", 0xffeb}, {0x0}], 0x2, &(0x7f0000000c80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private}}}], 0x20}, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) readv(r1, &(0x7f0000000280)=[{&(0x7f0000000140)=""/15, 0xf}], 0x1) executing program 3: r0 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x12, r0, 0x0) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0) sendfile(r1, r1, 0x0, 0x38c6) executing program 0: mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0xa, 0x262) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x1, @local}, 0xc, {0x2, 0x0, @broadcast}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0x4e22, @multicast2}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3d}}, 0x3a, {0x2, 0x2, @broadcast}, 'geneve1\x00'}) executing program 1: writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a117436c379000000000000000058", 0x1f}], 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x200002e6) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000340)={0x0, 0x312000, 0x800, 0x0, 0x5}, 0x20) executing program 0: r0 = userfaultfd(0x80001) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) read$FUSE(r1, &(0x7f0000000040)={0x2020}, 0x2020) program crashed: WARNING in shmem_rmdir bisect: bisecting 24 programs bisect: split chunks (needed=false): <24> bisect: split chunk #0 of len 24 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5] detailed listing: executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x82f41, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000d40)={@val={0xa, 0x9000}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fd2cd", 0x30, 0x3a, 0xff, @remote, @mcast2, {[], @dest_unreach={0x1, 0x2, 0x0, 0x3, '\x00', {0xf, 0x6, 'V#\a', 0x6, 0x87, 0x1, @dev={0xfe, 0x80, '\x00', 0x1b}, @ipv4={'\x00', '\xff\xff', @multicast2}}}}}}}}}, 0x6a) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(r1, 0x4068aea3, &(0x7f0000000080)={0x74, 0x0, 0xf1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x1a0, 0x0, 0x1000000}]}) executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000001840)={@void, @val={0x1, 0x3, 0x1c, 0x3, 0x14, 0x6}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x33, 0xfc0, 0x67, 0x0, 0xfd, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, {[@end]}}, "414dc1c90728557ded5995abd8c2dd746ed1b8e7b953b5e7039ee546652f979f45a699fe21e6401621d129bbfcdacc6b80371644b7d06d7ced9f49c41edcd1f2c4e5b6e13a486859035a1f0f7cf9905062e4a7d9b84398ec0a5f4018a0815fd0f9d5f5cf02964d8f9e484244f3afa2a3aac22182bf29dd83fc2bc291c8fec64be60c54e2c3a73c9474d9bbf9d6bbc1c3faf325a485fbc671a53dbab2ce05898db07fa7ed32bf943a142654fbdaeba416136f286952082afa985e3a59d21de084543dd2192156ad57f32238f6cbe9050ca5d73b9d7f9daed4d01c046abcf3439f7bd2c066f6bc259af55781ce2d10451850f2a907c9cd6db4913164efd7b47de7da19b0a98188fdc3704f55d37e22f9e18ad5ecb9fc3a2bbe85e2b488811c531f4af7831f399de76688f025b636f490a2c1140af9b62858617087f5cae53e6640e051945577ffb1e4c07bdfef5034a41a16a6162cdfd7b69330e8ce9902fc3a76f3f1bff2ea11f1c8368687653a926063831b0967480abb48f734ef8cfc15e42fb9361410d938cc9c1b304e8286220488d51488455c3f3b2c686a030bb4d64b2677a9d8aa87dbf39a278dd316db1e7d1da260c0008a256de039f851c4712db2beeed68ac56a5d925786cf0b3b12c1d2f25f0e437b188655fa6b9f5b775020754733fdb615326d945d30abc662a4933d74492c00241d2e025cba5edf85732f0d53488695aa867f1a3e74c077a543107ec5b4d1070e0ac128e2e09ed9d3087a3bc9a3eeacaa976d09b305dcfcf9e0fd14c6f4b1a0331c9382e1ca125be2643acd6c38d9873a6913af9a495e5ebab69aa7637c3704d5ed0eb7b684bff90a026bdee567d8701d543454a4ecc593a75ce070a847acd879459ff9f5671ccded94d231a60a1c1a2a4d8820dd1920f0eb66c8816467d07acce147b5b93c65f56c5f5714c96d8cf6c38ec5993e8687797f054427ae0a1f8390ee20c7fdf967a674983bee76f3982fc296d8b40b297c3c447313d05d81105949ee47e18f824860d33ad80cb8ffb3f10622551bcad32798313311e36f3a59a13c11f8df3a9bea5e95682e21eef4f01a32e3b16817830f5ab971184521c370efe8b3b17ab39caf1949c32395d20286eb2865b7191c051995a4bc0d87e1a1df8c2b474642d9d00a47b8ec249d9099b41897f0412e77384be189f3a9521d5fe2e15108d7c840ccae4e366e3382817d2de0855eebd12805da92782cfc4c69ba54916c5880f2da87a04e15c3afffbba0cacb12162c0681e58cd204e22474f3ba1416d052a6e991640febd529cc0861b6fb26f2cc922b76341b5546a103722a7083b8d69a4458c92655217c7b3fba1a9fc9116da2e0e8fe8381cde006f99f7192fcff78cd5221ab401808385a57438a9395203382bbe4fdbfd0cbe7f53f60e1cd88f94e465e828434d7334d087e375b1913032818049206c86e013ab3e54cc34eb4f1a5575091a20fd4d3cce623d734f74d36594646080083a8eb2c0a9615f5e1460204afbbb285bb6091e5c43255bade58f4be99dca47285966dec4c2a98e6bd99d935c5f39ee8d617d055b801fc9ba3f58c68d123153c0144539146ecf83652843ceb4786ceb2c6dead9bf368c5f05767fe28da6133f8b683992f12d875f46c41fee7a6990ed194416f363eaf91adcd424f7fe4024133f0c3c9a170d0308598bad014008349b0352e2658b17fe9d903e0a10d0aefe8448fbafd7d5cece702c67843560d9bd54f1a516f61b2389fa98eac264d01ee2f3acb30036f01dbbcaa5a0e62017a37742162b43d2a3e0a08ce6dc44b8713df9d090bad5638922f2d417a9da3f248df018c6e6ee29a76a25b3f5c7e77877e0c5cba1e4c1947e0b7815844519624a127d58b48e47c2504174e15a9d24c2559cb8586ac5392c4f7a8a190147f9405b778163f5de42cd51b6e198cd7d8ccbce72d0a22f731d1426dfe22bf0c93de40194bd7b2ec1b8d17b5dcbffbbd3eada2a260a2d3cb5c836aa97a4967cfe492456f1d3b0303fd3c8653af690fa985d8ee29d411461c76ca62df91cdf18faf945757ac430ee13ef938d4f351aeb279402effd2ac4f8ac8a75354fee8a42d944df98efdc96fe5ddcfc02c5ca788cd918b5983141dbadcec555186272c5abea47d79f3eb7f9349b7062c3c093d72a580012e94a6ada93cb8fbde2eb0357951269ae6cc6ba9c35f2c2ad2774d4acc0b8c0a46d231de850d3b4fe9941513ed3b5bf644d99fb79dd22785739f234114ee658418df8624955c14cb726465f91c9da2219383db4fba5ddfa19a432e04bba317a8ac0a4a7fdeae5f1ee0ba67316841c87d240d78cf19f6cbfdb76644331a0c42ed2486224b5a5ad74798adcbd1a141c0425d5d55e55d345d42489cfe3527bfc4a32b211390c19a70ea89b1ec9627a982ba9de1c8bce85eedcb8363dc2c71e71c17657a6ce9445235d04025cd29a432ee6487b4cd84732e38639abb1aee400b2cbd285ac1f57ff37f0ce299a25014c9cb7931f391e5b2fb4c22930018d5f99d0e24627b341e6f56135876fc6c8ed52d769401b2de57e2d76311ac5d188a3859f234a5d5b4b0387e5caa87be5f4f10454ee218e1a781f8d67c9d022234bfa29a62a8f73209da83cdd596864f5bce9b235066ff4f54a7874a993e097c6d3367e0e929347220e45b68b31733ca70707f58470af08c0cd6ed4c91fa958215a68de6b850fb306a32ee661012dd6fe79d786ba2678f4b5cad943ed6fc4caffce07a748ee59b28e3db92b1c62239f13e8e49a654ca5ba43852eda5c74505f7cb786eff763fa1caeceab419302f3882869b3804c55d31b1511fd65fe04c851ce4c8e7e2e09107e757a050cfb1a20c150481bd249e712c4596c5f87d3006609202b2f999a1baa30504d70128c6af0225cd0a64a832657b0ebe4200ae504c2c694d1a404f6da594d45e2de2aa7eb665aa45bcb8cda7ecc2a29e2496154e1cd7e366e71ca2d0a8652cff625de42cce24294e8f7e4617db9ce2b29c233ad401d28f8cce741c247efba5fdfde43f45776dbab2e6858d7bcff5a01be4448792868f80143d7c0b638ddc226a91e4299c7a8eab9603e2e9dcfd2a9be8070515eb83b101b0fb8cddf0bb46166ff109a8094861b1a8187d1c95216877779d387152606568f5f931614f00d4a52416004dc4a8006c2933ba377d9a4c1a9a06e17f17e7957db5a0a87bf2e9e454fcab7aada678fa50ed860aa7243dee5ccdb4d4ae12f93f0b4b2b4182c8ca9340d557606967b9b84c292a5b7c543e9c6bc2ed36eef34913de523ff181c097dfe8f80295357e9071f993f24d2fb4f55a6158d25b1a0e1971809986c8e48acf4784971e18152230b679347ab1e81b029cf711b15daa07c0ce3cfe482c8c6a7956d00021f337934afe3f1e62fcebb12630d9fde0d54750f2d58545ea4077c220a5aa505363a0321a44eed02483cbee7b6f84a3636861c69e9dc26a399d4492d33033756cd4daab72d20dd04c1edc44ef0b9bbdf63ba3e713c5cee50ff96646ca94895cd206ec89862bd6d97551796b408de07c12639247592b1513b719738779cbb64d886cf192f5577c1b2d0c4be28134400291e950aaf328f63068fa988dc065d2385f659bd04beb7d9995d2954c236ecb92c3fc27ae6cb083c59729d1bbf60988557606661e2ccb99798a43b6def2483108ce62758204ac56c27bd42ec1bbddb102a9a20cbd1b2f760157aa6656b714dd4a909b481c83c3b92c2e1452a2be07a1cf13d9235909e59c4663f15ef1e688151300d04383bfb44c595fb16a9045fa8f06df8b54feb69d1b42feb8e76485c243cfe769b1bd09fdabd6edc7547454a76ee601479430eac8ec51e97fb51f2eb6e2d099a7a9dc7e015edc4468435b40950899a236801a54ce77b46a9d74363c6aaf6ea05a997219073f145580b4064862f772613bff0dd604c119f5a0f570b214b4bd529d587443f60778a70bfc062998a4310c3af3990ba4d00fae848fbaf638dd7070d1b8fc36b4e176cbf7219521c893e29310c1d0aed8d9b67fcea66c0710a38e37f61d4eb3aa803a2206369fc24645dc827c09ed7c549adccc23f96baf18aa66d757b406fc267ba243d97231eaf7e934abf90201d4cfece387aa69913e2ac98e0502cd6d6ce737db38e5b1f6d1cf8018a8364fd3f5b9483ea78f655feba6536162f9996d703636a10ae343b6ab0a5a61e7fd8ce27383322687d5e256104bb91f44ac4f55fe27c6347e75ea2e76ffb704c3d13af4dabd20c0d82f19698b1993e86ee98772f0d91362f5e26094dbe6bb03d1418db3b707d76497216f3075cc065adbc3029eaa986ffbb73932c9a1e58920922d48ca4751c653978350ec11c4559b6caf21065fda89e00815cb5a4e7f94b0765c5a3e270c8d56c8456361230245a54525571bfbc4ec90cff3561f38be5d2bfb288812a530c5ae466de8b8d40349d7c6d327fc15738502d665b0bad1815009cb7227fff27ac01075d82696a0b58aac31d2a86fb25794840c59665f9bc78040946c20f9380561c21feec4a33f02d74f7b1eb853804b7bc413d550213c9ca9fd036fb7b49de6388d4b7139facb8854eafd2f190fa52caf613ada77a15eb11accf86805583a9b6e2a25dd67d1b78c12b7d40655faa827177f7242c05e641b207273c2e83e0f0b1b121adc46e6571fb6a36c83fe96b162dec42bec95c3d7e4b208a270f3ec6697ea587a6c59617f83b523c83b09c7cca62d0bbcdadf9082195df7d2edca76d4d68ef47e7d4b07c4feee350b0fcf74456621e3d77d4babc41a75a6e045322d1fbddee131c5630834ec7cb0c9539dcc09ada86dba4374115078345511b96c33a1e68233876620a7f2aff2c0da846e5eb3d3f18c08966e485e33981dbdf3a357488b0e1452b3c56e703e56b736b2bad4a4b94083c8568e87ea85df59cb840b34a71b2748e80d41ff39e7038154b775b4db18887b67bea223f2b4bdffe40031eede920f370ca46cb6cc273f20cec5d571407277a610d7d339a037a4bbee23da4ab3f165be0ed7a2ab05b87d826b0d30587546ac26f55d93f2f0b1809da0f865721ae38866990e42a60e9003f7b4f1c5f2142dcb69ce659bd060368778f4022fe484ec67063bd5446baa1502cbe15a60ba50e83984d6df1127ee8001c07698c3867c1dcbb90446adc177ca75506ae2e3ddc68fb8951b648f05eebd0d0edd121ee51dd0003ff00a3085d5a613a10532c0cb0d2ac78b4852c06f26875f681d35c3966b4129bad16bf8914aa4d8de43140e9e1c341cde07a9d2fd2cce6a52e0bfc46004696887f1b00e628a335ca62cf38121a72d1dfead99c7138189f1cff37cb7682e9c29fd548d5443d97d61efd28c6fe34673161c907203077e4c68d48cefbf0e77a2359794d47b133b77871fd9a6775b962eb678945ef9df48afb580f123c1cd3fadd3f8982e585e7a459b7ecdb9080b9ec945c34011b0a057295dfc5fb94a008d8257f1463536525c72ee5c7f49fdd80b9b6bd948fb34a886ca87758dca9870c56bfa54601cc56946a4236e43742e74e95ae2f6a59a0a85a52ad218c15dcf4a74b1e8320174c50e88a3e1d54ae6d9ea8b4bdbbd1acf9bb39f339ee68fcfa994a29c1e46089459856d15bc6a78eca909fc8c2401371d16bdacc04bb82376"}}, 0xfca) executing program 0: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d") ioctl(r0, 0xc138fd0e, &(0x7f0000000000)) executing program 1: newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) setresuid(r0, r0, 0x0) r1 = getpid() r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r2, r1, 0x7, 0xffffffffffffffff, 0x0) executing program 1: mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000140)={0x0, 0x7217, 0x4000, 0x3, 0x21f}, &(0x7f0000000540)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xecc7, 0x20000, 0x2, 0x28e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf9a, 0x1248, 0x1200, 0xe3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x8000, 0x2, 0xf6, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xec21, 0x100, 0x3, 0x18f}}], 0x4, 0x0, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x1, 0x1, 0xffff1000, 0x2000, &(0x7f0000f8d000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000000)={0x1, 0x0, &(0x7f0000f4e000/0x3000)=nil}) executing program 3: ioperm(0x4, 0x8, 0x5) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) prctl$PR_SET_MM(0x23, 0x6, &(0x7f000005b000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffd000/0x3000)=nil) brk(0x200004ffc000) executing program 3: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x111) rmdir(&(0x7f00000000c0)='./control\x00') executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) sendmsg$inet(r1, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0xffff, @multicast1}, 0x10, &(0x7f00000014c0)=[{&(0x7f0000000000)="be39", 0xffeb}, {0x0}], 0x2, &(0x7f0000000c80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private}}}], 0x20}, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) readv(r1, &(0x7f0000000280)=[{&(0x7f0000000140)=""/15, 0xf}], 0x1) executing program 3: r0 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x12, r0, 0x0) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0) sendfile(r1, r1, 0x0, 0x38c6) executing program 0: mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0xa, 0x262) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x1, @local}, 0xc, {0x2, 0x0, @broadcast}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0x4e22, @multicast2}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3d}}, 0x3a, {0x2, 0x2, @broadcast}, 'geneve1\x00'}) executing program 1: writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a117436c379000000000000000058", 0x1f}], 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x200002e6) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000340)={0x0, 0x312000, 0x800, 0x0, 0x5}, 0x20) executing program 0: r0 = userfaultfd(0x80001) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) read$FUSE(r1, &(0x7f0000000040)={0x2020}, 0x2020) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 5, 5] detailed listing: executing program 3: ioperm(0x4, 0x8, 0x5) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) prctl$PR_SET_MM(0x23, 0x6, &(0x7f000005b000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffd000/0x3000)=nil) brk(0x200004ffc000) executing program 3: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x111) rmdir(&(0x7f00000000c0)='./control\x00') executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) sendmsg$inet(r1, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0xffff, @multicast1}, 0x10, &(0x7f00000014c0)=[{&(0x7f0000000000)="be39", 0xffeb}, {0x0}], 0x2, &(0x7f0000000c80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private}}}], 0x20}, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) readv(r1, &(0x7f0000000280)=[{&(0x7f0000000140)=""/15, 0xf}], 0x1) executing program 3: r0 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x12, r0, 0x0) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0) sendfile(r1, r1, 0x0, 0x38c6) executing program 0: mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0xa, 0x262) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x1, @local}, 0xc, {0x2, 0x0, @broadcast}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0x4e22, @multicast2}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3d}}, 0x3a, {0x2, 0x2, @broadcast}, 'geneve1\x00'}) executing program 1: writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a117436c379000000000000000058", 0x1f}], 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x200002e6) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000340)={0x0, 0x312000, 0x800, 0x0, 0x5}, 0x20) executing program 0: r0 = userfaultfd(0x80001) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) read$FUSE(r1, &(0x7f0000000040)={0x2020}, 0x2020) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 bisect: split chunks (needed=true): <8> bisect: split chunk #0 of len 8 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5] detailed listing: executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000080), 0x2, 0x0) sendfile(r1, r1, 0x0, 0x38c6) executing program 0: mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0xa, 0x262) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @dev}, {0x1, @local}, 0xc, {0x2, 0x0, @broadcast}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0x4e22, @multicast2}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3d}}, 0x3a, {0x2, 0x2, @broadcast}, 'geneve1\x00'}) executing program 1: writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a117436c379000000000000000058", 0x1f}], 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x200002e6) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000340)={0x0, 0x312000, 0x800, 0x0, 0x5}, 0x20) executing program 0: r0 = userfaultfd(0x80001) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r0, 0x0, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) read$FUSE(r1, &(0x7f0000000040)={0x2020}, 0x2020) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5] detailed listing: executing program 3: ioperm(0x4, 0x8, 0x5) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) prctl$PR_SET_MM(0x23, 0x6, &(0x7f000005b000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffd000/0x3000)=nil) brk(0x200004ffc000) executing program 3: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x111) rmdir(&(0x7f00000000c0)='./control\x00') executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) sendmsg$inet(r1, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0xffff, @multicast1}, 0x10, &(0x7f00000014c0)=[{&(0x7f0000000000)="be39", 0xffeb}, {0x0}], 0x2, &(0x7f0000000c80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private}}}], 0x20}, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) readv(r1, &(0x7f0000000280)=[{&(0x7f0000000140)=""/15, 0xf}], 0x1) executing program 3: r0 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x12, r0, 0x0) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <4> bisect: split chunk #0 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5] detailed listing: executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) sendmsg$inet(r1, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0xffff, @multicast1}, 0x10, &(0x7f00000014c0)=[{&(0x7f0000000000)="be39", 0xffeb}, {0x0}], 0x2, &(0x7f0000000c80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private}}}], 0x20}, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) readv(r1, &(0x7f0000000280)=[{&(0x7f0000000140)=""/15, 0xf}], 0x1) executing program 3: r0 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x12, r0, 0x0) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5] detailed listing: executing program 3: ioperm(0x4, 0x8, 0x5) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) prctl$PR_SET_MM(0x23, 0x6, &(0x7f000005b000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffd000/0x3000)=nil) brk(0x200004ffc000) executing program 3: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x111) rmdir(&(0x7f00000000c0)='./control\x00') program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs-chdir-mkdir-rmdir detailed listing: executing program 3: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x111) rmdir(&(0x7f00000000c0)='./control\x00') program crashed: WARNING in shmem_rmdir bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 3: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x111) rmdir(&(0x7f00000000c0)='./control\x00') bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs-chdir-mkdir-rmdir detailed listing: executing program 0: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x111) rmdir(&(0x7f00000000c0)='./control\x00') program crashed: WARNING in shmem_rmdir bisect: concatenation succeeded found reproducer with 5 syscalls minimizing guilty program testing program (duration=43.389891292s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs-chdir-mkdir detailed listing: executing program 0: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x111) program crashed: WARNING in shmem_rmdir testing program (duration=43.389891292s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs-chdir detailed listing: executing program 0: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') program crashed: WARNING in shmem_rmdir testing program (duration=43.389891292s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir testing program (duration=43.389891292s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir detailed listing: executing program 0: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) program did not crash testing program (duration=43.389891292s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount$incfs detailed listing: executing program 0: mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program did not crash testing program (duration=43.389891292s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(0x0, 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program did not crash testing program (duration=43.389891292s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(0x0, &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program did not crash testing program (duration=43.389891292s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', 0x0, &(0x7f0000000000), 0xc002, 0x0) program did not crash testing program (duration=43.389891292s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', 0x0, 0xc002, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=43.389891292s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir simplifying C reproducer testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing compiled C program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: WARNING in shmem_rmdir testing program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true testing program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true testing program (duration=43.389891292s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000001c0)='./bus\x00', 0x57) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) program crashed: WARNING in shmem_rmdir validation run: crashed=true reproducing took 36m8.856848491s repro crashed as (corrupted=false): veth0_vlan: entered promiscuous mode veth1_macvtap: entered promiscuous mode ------------[ cut here ]------------ WARNING: CPU: 1 PID: 375 at fs/inode.c:340 drop_nlink+0xce/0x110 fs/inode.c:340 Modules linked in: CPU: 1 UID: 0 PID: 375 Comm: syz-executor Not tainted syzkaller #0 84c4865013cb051b9e1c8192e6ebfa0ba91d02b9 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:drop_nlink+0xce/0x110 fs/inode.c:340 Code: 04 00 00 be 08 00 00 00 e8 ff 0b ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 18 7a b5 03 cc e8 12 21 95 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c RSP: 0018:ffffc900011bfc88 EFLAGS: 00010293 RAX: ffffffff81f2578e RBX: ffff888115c98b98 RCX: ffff888127a80000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011bfcb0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52000237f80 R12: dffffc0000000000 R13: 1ffff11022b9317c R14: ffff888115c98be0 R15: 0000000000000000 FS: 000055557f8fb500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055557f91e958 CR3: 0000000126cbe000 CR4: 00000000003526b0 Call Trace: shmem_rmdir+0x5f/0x90 mm/shmem.c:3820 vfs_rmdir+0x3de/0x560 fs/namei.c:4348 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd5/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f8bc519f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc42749498 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f8bc519f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc42749550 RBP: 00007ffc42749550 R08: 00007ffc4274a550 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc4274a5e0 R13: 00007f8bc52344bb R14: 00000000000067e5 R15: 00007ffc4274a620 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 fs/inode.c:452 Write of size 4 at addr 0000000000000168 by task syz-executor/375 CPU: 0 UID: 0 PID: 375 Comm: syz-executor Tainted: G W syzkaller #0 84c4865013cb051b9e1c8192e6ebfa0ba91d02b9 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_report+0x3d/0x70 mm/kasan/report.c:484 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x25a/0x2b0 mm/kasan/generic.c:189 __kasan_check_write+0x18/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] ihold+0x24/0x70 fs/inode.c:452 d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd5/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f8bc519f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc42749498 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f8bc519f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc42749550 RBP: 00007ffc42749550 R08: 00007ffc4274a550 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc4274a5e0 R13: 00007f8bc52344bb R14: 00000000000067e5 R15: 00007ffc4274a620 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000168 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 8000000115b78067 P4D 8000000115b78067 PUD 0 Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 375 Comm: syz-executor Tainted: G B W syzkaller #0 84c4865013cb051b9e1c8192e6ebfa0ba91d02b9 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 fd 17 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 bc 02 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 0d RSP: 0018:ffffc900011bfcc8 EFLAGS: 00010246 RAX: ffff888127a80000 RBX: 0000000000000000 RCX: ffff888127a80000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011bfcd8 R08: ffffffff88bbb947 R09: 1ffffffff1177728 R10: dffffc0000000000 R11: fffffbfff1177729 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055557f8fb500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 0000000126cbe000 CR4: 00000000003526b0 Call Trace: d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd5/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f8bc519f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc42749498 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f8bc519f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc42749550 RBP: 00007ffc42749550 R08: 00007ffc4274a550 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc4274a5e0 R13: 00007f8bc52344bb R14: 00000000000067e5 R15: 00007ffc4274a620 Modules linked in: CR2: 0000000000000168 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 fd 17 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 bc 02 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 0d RSP: 0018:ffffc900011bfcc8 EFLAGS: 00010246 RAX: ffff888127a80000 RBX: 0000000000000000 RCX: ffff888127a80000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011bfcd8 R08: ffffffff88bbb947 R09: 1ffffffff1177728 R10: dffffc0000000000 R11: fffffbfff1177729 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055557f8fb500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 0000000126cbe000 CR4: 00000000003526b0 ---------------- Code disassembly (best guess): 0: f3 0f 1e fa endbr64 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 fd 17 95 ff call 0xff951810 13: 48 8d bb 68 01 00 00 lea 0x168(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 bc 02 ee ff call 0xffee02e0 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 68 01 lock xadd %r14d,0x168(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 0d .byte 0xd final repro crashed as (corrupted=false): veth0_vlan: entered promiscuous mode veth1_macvtap: entered promiscuous mode ------------[ cut here ]------------ WARNING: CPU: 1 PID: 375 at fs/inode.c:340 drop_nlink+0xce/0x110 fs/inode.c:340 Modules linked in: CPU: 1 UID: 0 PID: 375 Comm: syz-executor Not tainted syzkaller #0 84c4865013cb051b9e1c8192e6ebfa0ba91d02b9 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:drop_nlink+0xce/0x110 fs/inode.c:340 Code: 04 00 00 be 08 00 00 00 e8 ff 0b ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 18 7a b5 03 cc e8 12 21 95 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c RSP: 0018:ffffc900011bfc88 EFLAGS: 00010293 RAX: ffffffff81f2578e RBX: ffff888115c98b98 RCX: ffff888127a80000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011bfcb0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52000237f80 R12: dffffc0000000000 R13: 1ffff11022b9317c R14: ffff888115c98be0 R15: 0000000000000000 FS: 000055557f8fb500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055557f91e958 CR3: 0000000126cbe000 CR4: 00000000003526b0 Call Trace: shmem_rmdir+0x5f/0x90 mm/shmem.c:3820 vfs_rmdir+0x3de/0x560 fs/namei.c:4348 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd5/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f8bc519f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc42749498 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f8bc519f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc42749550 RBP: 00007ffc42749550 R08: 00007ffc4274a550 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc4274a5e0 R13: 00007f8bc52344bb R14: 00000000000067e5 R15: 00007ffc4274a620 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 fs/inode.c:452 Write of size 4 at addr 0000000000000168 by task syz-executor/375 CPU: 0 UID: 0 PID: 375 Comm: syz-executor Tainted: G W syzkaller #0 84c4865013cb051b9e1c8192e6ebfa0ba91d02b9 Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:94 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120 print_report+0x3d/0x70 mm/kasan/report.c:484 kasan_report+0x162/0x1a0 mm/kasan/report.c:594 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x25a/0x2b0 mm/kasan/generic.c:189 __kasan_check_write+0x18/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_inc_return include/linux/atomic/atomic-instrumented.h:453 [inline] ihold+0x24/0x70 fs/inode.c:452 d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd5/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f8bc519f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc42749498 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f8bc519f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc42749550 RBP: 00007ffc42749550 R08: 00007ffc4274a550 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc4274a5e0 R13: 00007f8bc52344bb R14: 00000000000067e5 R15: 00007ffc4274a620 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000168 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 8000000115b78067 P4D 8000000115b78067 PUD 0 Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 375 Comm: syz-executor Tainted: G B W syzkaller #0 84c4865013cb051b9e1c8192e6ebfa0ba91d02b9 Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 fd 17 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 bc 02 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 0d RSP: 0018:ffffc900011bfcc8 EFLAGS: 00010246 RAX: ffff888127a80000 RBX: 0000000000000000 RCX: ffff888127a80000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011bfcd8 R08: ffffffff88bbb947 R09: 1ffffffff1177728 R10: dffffc0000000000 R11: fffffbfff1177729 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055557f8fb500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 0000000126cbe000 CR4: 00000000003526b0 Call Trace: d_delete_notify include/linux/fsnotify.h:357 [inline] vfs_rmdir+0x25c/0x560 fs/namei.c:4361 incfs_kill_sb+0x102/0x220 fs/incfs/vfs.c:1970 deactivate_locked_super+0xd5/0x270 fs/super.c:478 deactivate_super+0xb8/0xe0 fs/super.c:511 cleanup_mnt+0x438/0x4d0 fs/namespace.c:1380 __cleanup_mnt+0x1d/0x40 fs/namespace.c:1387 task_work_run+0x1e5/0x260 kernel/task_work.c:246 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f8bc519f397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffc42749498 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f8bc519f397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc42749550 RBP: 00007ffc42749550 R08: 00007ffc4274a550 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc4274a5e0 R13: 00007f8bc52344bb R14: 00000000000067e5 R15: 00007ffc4274a620 Modules linked in: CR2: 0000000000000168 ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_add_return include/linux/atomic/atomic-arch-fallback.h:564 [inline] RIP: 0010:raw_atomic_inc_return include/linux/atomic/atomic-arch-fallback.h:1020 [inline] RIP: 0010:atomic_inc_return include/linux/atomic/atomic-instrumented.h:454 [inline] RIP: 0010:ihold+0x2a/0x70 fs/inode.c:452 Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 fd 17 95 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 bc 02 ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 0d RSP: 0018:ffffc900011bfcc8 EFLAGS: 00010246 RAX: ffff888127a80000 RBX: 0000000000000000 RCX: ffff888127a80000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc900011bfcd8 R08: ffffffff88bbb947 R09: 1ffffffff1177728 R10: dffffc0000000000 R11: fffffbfff1177729 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055557f8fb500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000168 CR3: 0000000126cbe000 CR4: 00000000003526b0 ---------------- Code disassembly (best guess): 0: f3 0f 1e fa endbr64 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 fd 17 95 ff call 0xff951810 13: 48 8d bb 68 01 00 00 lea 0x168(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 bc 02 ee ff call 0xffee02e0 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 68 01 lock xadd %r14d,0x168(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 0d .byte 0xd