Extracting prog: 3m15.434012875s Minimizing prog: 26m35.071141843s Simplifying prog options: 0s Extracting C: 26.023070075s Simplifying C: 10m20.189388913s extracting reproducer from 67 programs testing a last program of every proc single: executing 17 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-mkdirat-mount$tmpfs-chdir-openat$cgroup_ro-write$binfmt_script-mmap-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-ioctl$UFFDIO_ZEROPAGE-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_FEATURES_SET detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2c) mount$tmpfs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always']) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)={'#! ', './file0'}, 0xb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x28011, r1, 0x0) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000540)={0xaa, 0x310}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000001000/0x1000)=nil, 0x1000}}) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000d00), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x24, r3, 0x1, 0x0, 0x25dfdbfb, {}, [@ETHTOOL_A_FEATURES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_FEATURES_WANTED={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) program did not crash program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-pselect6-mprotect-syz_usb_control_io$uac1-syz_open_dev$evdev-ioctl$EVIOCGLED-ioctl$EVIOCSFF-syz_open_dev$evdev-write$char_usb-timer_settime-mmap-signalfd4-read$FUSE-timer_create-timer_gettime-timer_create-timer_settime-ioctl$UFFDIO_WRITEPROTECT-pipe detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) pselect6(0x0, 0x0, &(0x7f0000000380)={0x5, 0xfffffffffffffffe, 0x3ff, 0x8, 0x4, 0x6, 0x1, 0x2}, &(0x7f0000000440)={0x0, 0xf32f, 0x1, 0xa5, 0x2, 0xfa, 0x2, 0xc26}, &(0x7f0000000480)={0x0, 0x989680}, &(0x7f0000000500)={&(0x7f00000004c0)={[0xd23]}, 0x8}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, &(0x7f0000000240)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$evdev(&(0x7f0000001540), 0x0, 0x0) ioctl$EVIOCGLED(r1, 0x5452, &(0x7f0000000240)=""/77) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x57, 0x0, 0x0, {0xfffe, 0x1}, {0x74, 0x2}, @period={0x5c, 0x46, 0x1, 0xffc0, 0x3, {0x3, 0x9, 0xfd59, 0xca9}, 0x0, 0x0}}) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x78, 0x822b01) write$char_usb(r2, &(0x7f0000000040)="e2", 0x1068) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x9, 0x204031, 0xffffffffffffffff, 0x18305000) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x4]}, 0x8, 0x80000) read$FUSE(r3, &(0x7f0000003b80)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) timer_create(0x2, &(0x7f0000000200)={0x0, 0x38, 0x2, @tid=r4}, &(0x7f0000000240)=0x0) timer_gettime(r5, &(0x7f0000000280)) timer_create(0x4, &(0x7f0000533fa0)={0x0, 0x21, 0x0, @thr={&(0x7f0000000100)="44237415ee6c7002d93050cc7b384afdba8fc06405955644bb01d26fbfb9297730fa825faa100e44e4105385c0b405b4ae68b94b95640dddf5182dcd8533d4723bf7aff2eb948a2122c6f8877e766ead3863c1dca757e06a599748a1d4516863f2f05c5ec4866a472b9e7389314b4a67be70c77e29eb842ab072667fac78b5259188c04a40badb99be6dd0b7577cc405648bd9a5f6b9b8fc0b8e3c81df33b2dc7f98bdacf4c04b5cf176c71261ec774de4ecacb1", &(0x7f00000001c0)="79e57b9f2db1c5ae8f9294c5915815523619e583472436d3a02a39f4049c3b924052fa59ce"}}, &(0x7f0000bbdffc)=0x0) timer_settime(r6, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) ioctl$UFFDIO_WRITEPROTECT(r3, 0xc018aa06, &(0x7f0000000000)={{&(0x7f0000054000/0x2000)=nil, 0x2000}, 0x1}) pipe(0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socket$nl_route-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-mprotect-connect$unix-sendmmsg$unix-ioctl$KVM_CREATE_VM-openat-fsync-ioctl$KVM_HYPERV_EVENTFD-recvmmsg-socket$nl_route-openat2$dir-mknodat-open-syz_clone-ptrace-ptrace$pokeuser-socket$inet_udp-setsockopt$ARPT_SO_SET_REPLACE detailed listing: executing program 0: r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x170bd2a, 0xffffffff, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe5, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0xfffd}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002fc0)=@newtfilter={0x7c, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r1, {0xc, 0x1}, {0x0, 0xfff1}, {0x8, 0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0x44, 0x2, [@TCA_BASIC_POLICE={0x40, 0x4, [@TCA_POLICE_TBF={0x3c, 0x1, {0x7f, 0x8, 0x52, 0x7, 0x2, {0x8a, 0x1, 0x100, 0xa9b6, 0xa5a0}, {0x6, 0x1, 0x4, 0xad49, 0xb, 0x3}, 0x3b, 0x2, 0x2a86}}]}]}}, @TCA_RATE={0x6, 0x5, {0x5, 0xcf}}]}, 0x7c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) mprotect(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x18) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x145) fsync(r6) ioctl$KVM_HYPERV_EVENTFD(r5, 0x4018aebd, &(0x7f00000000c0)={0x1, r6, 0x1}) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000000)={0x200, 0x1d8, 0x20}, 0x18) mknodat(r7, &(0x7f0000000040)='./file0\x00', 0x1, 0x0) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x41) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r8) ptrace$pokeuser(0x6, r8, 0x358, 0xfffffffffffffff8) r9 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r9, 0xa02000000000000, 0x60, &(0x7f0000000440)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x130, 0x0, 0x220, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@local, @empty, 0x0, 0x0, 0x0, 0x0, {@empty, {[0xff]}}, {@mac=@local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pimreg\x00', 'veth0_to_bridge\x00'}, 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f67b23ffdfa27f907a03732da3acbc6518e62a77ca06f258762e88c0d9f9d2f413b94a105f4bdf01425ce81c5d000000000000000500ffffffff00"}}}, {{@arp={@multicast2, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x101, 0x8, 0xd590}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x10}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mkdir-mount$incfs-inotify_add_watch-socket$nl_route-sched_setscheduler-getpid-syz_pidfd_open-setns-unshare-syz_clone-chdir-mount$overlay-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r3 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r4, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r4, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r6, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r3, @ANYRESOCT=r5, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x400017e) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r7 = getpid() r8 = syz_pidfd_open(r7, 0x0) setns(r8, 0x24020000) unshare(0xa849903f6d3d73cb) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000b80), 0x408, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@index_on}]}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@getqdisc={0x48, 0x26, 0x4, 0x70bd2d, 0x25ffdbfb, {0x0, 0x0, 0x0, r2, {0xfff2, 0x9}, {0xb, 0xa}, {0x1}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x24004800}, 0x40000) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir single: successfully extracted reproducer found reproducer with 29 syscalls minimizing guilty program testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mkdir-mount$incfs-inotify_add_watch-socket$nl_route-sched_setscheduler-getpid-syz_pidfd_open-setns-unshare-syz_clone-chdir-mount$overlay detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x400017e) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r6 = getpid() r7 = syz_pidfd_open(r6, 0x0) setns(r7, 0x24020000) unshare(0xa849903f6d3d73cb) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000b80), 0x408, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@index_on}]}) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mkdir-mount$incfs-inotify_add_watch-socket$nl_route-sched_setscheduler-getpid-syz_pidfd_open-setns-unshare-syz_clone-chdir detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x400017e) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r6 = getpid() r7 = syz_pidfd_open(r6, 0x0) setns(r7, 0x24020000) unshare(0xa849903f6d3d73cb) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mkdir-mount$incfs-inotify_add_watch-socket$nl_route-sched_setscheduler-getpid-syz_pidfd_open-setns-unshare-syz_clone detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x400017e) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r6 = getpid() r7 = syz_pidfd_open(r6, 0x0) setns(r7, 0x24020000) unshare(0xa849903f6d3d73cb) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mkdir-mount$incfs-inotify_add_watch-socket$nl_route-sched_setscheduler-getpid-syz_pidfd_open-setns-unshare detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x400017e) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r6 = getpid() r7 = syz_pidfd_open(r6, 0x0) setns(r7, 0x24020000) unshare(0xa849903f6d3d73cb) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mkdir-mount$incfs-inotify_add_watch-socket$nl_route-sched_setscheduler-getpid-syz_pidfd_open-setns detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x400017e) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r6 = getpid() r7 = syz_pidfd_open(r6, 0x0) setns(r7, 0x24020000) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mkdir-mount$incfs-inotify_add_watch-socket$nl_route-sched_setscheduler-getpid-syz_pidfd_open detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x400017e) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r6 = getpid() syz_pidfd_open(r6, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mkdir-mount$incfs-inotify_add_watch-socket$nl_route-sched_setscheduler-getpid detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x400017e) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, 0x0) getpid() program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mkdir-mount$incfs-inotify_add_watch-socket$nl_route-sched_setscheduler detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x400017e) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mkdir-mount$incfs-inotify_add_watch-socket$nl_route detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x400017e) socket$nl_route(0x10, 0x3, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mkdir-mount$incfs-inotify_add_watch detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x400017e) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mkdir-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mkdir detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) program did not crash testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-syz_mount_image$erofs-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file0\x00', 0x200800c, &(0x7f0000000340)=ANY=[], 0x0, 0x24a, &(0x7f0000000680)="$eJzsmDtrFFEUx//3zmvH1aCNhY2FARXJPmabNCkiCFYiJL4qXcwYYjZZ2R3BXRAJNjbaWQg2Fn4Bi4CpUtj5BSJaqCAouIWFTZqR+5jZyc5kdzLY5fyKu/8599x7zzlz5xQLgiAOLd+//f36/OLsIhhwFNNwtP2nATCmNE/4f3n18MLLuUuv331++2F96vFWZDf0r1gShokFDCiNOd8EsD1v4El8Urx6N8QnTOuHRXChfwl9DRzntf0GGCpa3wHHda19MNzS+n5Ct4V/pXJvpeVX7rZbS0LUxFAXgyeGhna1ovgGGwxL2hiGBlgi/m6vv9pstfxOQph6LmOqkIgLm4EFG4N5LmPF9pSMUFTx5rOnG8IU1aam6iepg6Ou92uAYUHbZ+FEtVElSeR/yozyFxUYzT+d7e576SsmJiVZUmLuz38plhA2lDgxU2yfqNqjU8dTlvGCy7KM7GNF9ev2+kLl3dAodnWkMPe5iyx6g3b8Qg92RFksv5I3ixcugOIvF+g5GRFaKctBs1DCUKtODrY+pn1+pFc5eyoWsslHsPz3p5T/riLzruYXLvqrvFDFJgS2s6n6R/iG4SyG/cNM9I9qsPag2u31Z1bWmsv+sr/ueQ2nHHc8v1aV7Sjd+OJ+6Mr+dCSxv5XdKmFzG4+aQdCpq9FmNlwEQceTz17is1nYbP++rZcFuAzgzPDY4cdipMOylQ+XvkKdSzuhvE+EBEEQBEEQBEEQBEEQBEEQ4zgNJv8FFewcA1xtD/fiXZXWfwEAAP//XYhBpQ==") mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-syz_mount_image$msdos-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) r2 = syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r3, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r5, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000100)='.\x00', 0xe1, &(0x7f00000010c0)=ANY=[@ANYRESHEX, @ANYRES8=r2, @ANYRESOCT=r4, @ANYRES32=0x0, @ANYBLOB="fc68e0d2c140279780d826222f31831feb264124bd9964696d95ff26b9f76d2070adcf85e869f6741108f1ed1766e1165a8efb872da6e6933aced440a8b2bf18660be3470d031879a16c6708435095b47453676b821234a64504faa47e2f01e607befe65d6a191c09323f1d370b3e5548e8ae06813258b097f02ec0cace8e885f5da924f885376018809b6cf04b59415f95f42b4945c6c3c95aceca260cae7d0207f112f5827"], 0x0, 0x0, &(0x7f0000000000)) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-getsockopt$sock_buf-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r2, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r2, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r3, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-socket$inet_tcp-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r2, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r2, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-socket$nl_route-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r2, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r2, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-syz_mount_image$msdos-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r2, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r2, &(0x7f00000013c0)=""/208, 0x31, 0x401) syz_mount_image$msdos(&(0x7f0000000f40), &(0x7f00000011c0)='./bus\x00', 0x1a4e40f, &(0x7f0000001a00)=ANY=[@ANYRES64=0x0, @ANYBLOB="c2e7b082469794b7665a5884d035d7e1c37a7b75d400c84171d4dc70379123fcb906c7badee7835dcac5f5710e5e29af658a5e1c86907a61581ea79db5dde492b42fca2e248c76db0424f22d0926ef96738fa3ad2e4e23b8b05c5b8c07544f79ac9fdadbdb2832896dee9ffe6c759cca034cab83bbf8c05bb12058f27b833e3228605c6d", @ANYRES8=0x0, @ANYRESHEX=r0], 0xb, 0x0, &(0x7f0000000000)) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-pread64-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r2, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) pread64(r2, &(0x7f00000013c0)=""/208, 0x31, 0x401) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-syz_usb_connect$cdc_ecm-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r2, &(0x7f00000000c0)=""/4092, 0xffc) syz_usb_connect$cdc_ecm(0x0, 0x85, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000020000102505a1a240000000010109027300010100200009040000ff02020000052406000005240000000d240f010000000000000000000524"], 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-read$hiddev-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) read$hiddev(r2, &(0x7f00000000c0)=""/4092, 0xffc) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-openat$procfs-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-syz_mount_image$ext4-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x2f, 0x42, 0x3, 0xe91, 0x12, @loopback, @dev={0xfe, 0x80, '\x00', 0xb}, 0x20, 0x7, 0x5, 0x10001}}) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-sendmsg$nl_route-syz_mount_image$ext4-mount$incfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001240)=ANY=[@ANYBLOB="280000001400090527bd7000fddbdf25021f00ff", @ANYRES32=0x0, @ANYBLOB="06000200e0fe08bf7200080022030000130261a59daf1e24c3019435c02c3516bbf81291c91795d4f69ac37323464f761cac52bed80e9181a7b9b75f7f3a2c271b"], 0x28}, 0x1, 0x0, 0x0, 0x24044094}, 0x0) syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-sendmsg$key-syz_mount_image$ext4-mount$incfs detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="0206080903b05a002cbd700071dbdf250158ceebe4ec9da72a8d04180002fa08f3"], 0x18}}, 0x0) syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$key-syz_mount_image$ext4-mount$incfs detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) socket$key(0xf, 0x3, 0x2) syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-syz_mount_image$ext4-mount$incfs detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") mount$incfs(0x0, &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") mount$incfs(&(0x7f00000007c0)='.\x00', 0x0, &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', 0x0, 0x1004002, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=35.51587204s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir simplifying C reproducer testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program did not crash testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program did not crash testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program did not crash testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true testing program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true testing program (duration=35.51587204s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-mount$incfs detailed listing: executing program 0: syz_mount_image$ext4(&(0x7f0000000600)='ext4\x00', &(0x7f0000001380)='./bus\x00', 0x8, &(0x7f00000012c0)={[], [], 0x2e}, 0x0, 0x450, &(0x7f00000014c0)="$eJzs289vFFUcAPDvzLYgv2xF/MEPtYrGxh8tLagcvGg04WJiogc81lIIslBDayKESDUGj4a/QD2a+Bd40otRTxqvejcmxHARPZgxszsDS7tbd7tbtrCfTzLtezNv973vzLzdN/N2AhhYY/mfJGJ7RPwaESP17M0Fxur/rl29MPv31QuzSWTZG38mtXJ/Xb0wWxYtX7etyIynEenHSextUu/CufOnZqrVubNFfnLx9LuTC+fOP3vy9MyJuRNzZ6YPHz50cOqF56ef60mcO/K27vlgft/uI29dfm326OW3f/gqb+/2YntjHHWjXdc5FmM378sGT3T97hvLjoZ0MtTHhtCRSkTkh2u41v9HohI3Dt5IvPpRXxsHrKssy7LNK9ZWysRSBtzBkuh3C4D+KL/o8+vfcrmFw4++u/JS/QIoj/tasdS3DEValBledn3bS2MRcXTpn8/yJZrehwAA6K1v8vHPM83Gf2nc31Du7mJuaDQi7omInRFxb0Tsioj7ImplH4iIBzusf2xZfuX45+ctawqsTfn478Vibuvm8V85+ovRSpHbUYt/ODl+sjp3oNgn4zG8Oc9PrVLHt6/88mmrbY3jv3zJ6y/HgkU7/hhadoPu2MziTDcxN7ryYcSeoWbxJ9fnrvL/uyNizxreP99nJ5/6cl+r7f8f/yp6MM+UfRHxZP34L8Wy+EvJ6vOTk3dFde7AZHlWrPTjT5deb1V/V/H3QH78tzY9/6/HP5o0ztcudF7Hpd8+aXlNs9bzf1PyZi29qVj3/szi4tmpiE3J0sr10zdeW+bL8nn84/ub9/+dEf9+Xrxub0TkJ/FDEfFwRDxStP3RiHgsIvavEv/3Lz/+ztrjX195/Mc6Ov6dJyqnvvu6Vf3tHf9DtdR4saadz792G9jNvgMAAIDbRVr7DXySTlxPp+nERP03/Ltia1qdX1h8+vj8e2eO1X8rPxrDaXmna6ThfuhUcW+4zE8vyx+s3TfOsizbUstPzM5X12tOHWjPthb9P/d7pd+tA9ZdR/NorZ5oA25LnteEwaX/w+DS/2Fw6f8wuJr1/4sR1/rQFOAW8/0Pg0v/h8Gl/8Pg0v9hIHXzXP9qiZ1H1uud77REZWM0o+NEpBuiGWtLpBujGfXE5ohot/DFuFUN6/cnEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQG/8FwAA//8Hl+jb") mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true reproducing took 42m53.003983799s repro crashed as (corrupted=false): RBP: 00007ffdcb06cce0 R08: 00007ffdcb06dce0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdcb06dd70 R13: 00007f5099d06120 R14: 00000000000058d7 R15: 00007ffdcb06ddb0 ---[ end trace 50c77b6ce30573c2 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:423 Write of size 4 at addr 0000000000000170 by task syz-executor/354 CPU: 0 PID: 354 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:439 [inline] kasan_report+0xd8/0x130 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] ihold+0x20/0x60 fs/inode.c:423 d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x247/0x3e0 fs/namei.c:3873 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x45b/0x510 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f5099c72017 Code: a2 c7 05 dc 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffdcb06cc28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5099c72017 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdcb06cce0 RBP: 00007ffdcb06cce0 R08: 00007ffdcb06dce0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdcb06dd70 R13: 00007f5099d06120 R14: 00000000000058d7 R15: 00007ffdcb06ddb0 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000170 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 10fa12067 P4D 10fa12067 PUD 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 1 PID: 354 Comm: syz-executor Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 51 65 b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 e9 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 d1 RSP: 0018:ffffc90004d27d10 EFLAGS: 00010246 RAX: ffff88810cf0bb00 RBX: 0000000000000000 RCX: 0000000000000286 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90004d27d20 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf848 R12: 1ffff11021a4d19e R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055556e936500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 0000000129af5000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x247/0x3e0 fs/namei.c:3873 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x45b/0x510 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f5099c72017 Code: a2 c7 05 dc 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffdcb06cc28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5099c72017 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdcb06cce0 RBP: 00007ffdcb06cce0 R08: 00007ffdcb06dce0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdcb06dd70 R13: 00007f5099d06120 R14: 00000000000058d7 R15: 00007ffdcb06ddb0 Modules linked in: CR2: 0000000000000170 ---[ end trace 50c77b6ce30573c3 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 51 65 b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 e9 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 d1 RSP: 0018:ffffc90004d27d10 EFLAGS: 00010246 RAX: ffff88810cf0bb00 RBX: 0000000000000000 RCX: 0000000000000286 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90004d27d20 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf848 R12: 1ffff11021a4d19e R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055556e936500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 0000000129af5000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 51 65 b7 ff call 0xffb76564 13: 48 8d bb 70 01 00 00 lea 0x170(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 00 e9 f1 ff call 0xfff1e924 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 70 01 lock xadd %r14d,0x170(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: d1 .byte 0xd1 final repro crashed as (corrupted=false): RBP: 00007ffdcb06cce0 R08: 00007ffdcb06dce0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdcb06dd70 R13: 00007f5099d06120 R14: 00000000000058d7 R15: 00007ffdcb06ddb0 ---[ end trace 50c77b6ce30573c2 ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:423 Write of size 4 at addr 0000000000000170 by task syz-executor/354 CPU: 0 PID: 354 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:439 [inline] kasan_report+0xd8/0x130 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] ihold+0x20/0x60 fs/inode.c:423 d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x247/0x3e0 fs/namei.c:3873 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x45b/0x510 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f5099c72017 Code: a2 c7 05 dc 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffdcb06cc28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5099c72017 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdcb06cce0 RBP: 00007ffdcb06cce0 R08: 00007ffdcb06dce0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdcb06dd70 R13: 00007f5099d06120 R14: 00000000000058d7 R15: 00007ffdcb06ddb0 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000170 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 10fa12067 P4D 10fa12067 PUD 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 1 PID: 354 Comm: syz-executor Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 51 65 b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 e9 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 d1 RSP: 0018:ffffc90004d27d10 EFLAGS: 00010246 RAX: ffff88810cf0bb00 RBX: 0000000000000000 RCX: 0000000000000286 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90004d27d20 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf848 R12: 1ffff11021a4d19e R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055556e936500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 0000000129af5000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x247/0x3e0 fs/namei.c:3873 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x45b/0x510 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f5099c72017 Code: a2 c7 05 dc 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffdcb06cc28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5099c72017 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdcb06cce0 RBP: 00007ffdcb06cce0 R08: 00007ffdcb06dce0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdcb06dd70 R13: 00007f5099d06120 R14: 00000000000058d7 R15: 00007ffdcb06ddb0 Modules linked in: CR2: 0000000000000170 ---[ end trace 50c77b6ce30573c3 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 51 65 b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 e9 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 d1 RSP: 0018:ffffc90004d27d10 EFLAGS: 00010246 RAX: ffff88810cf0bb00 RBX: 0000000000000000 RCX: 0000000000000286 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90004d27d20 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf848 R12: 1ffff11021a4d19e R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055556e936500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 0000000129af5000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 51 65 b7 ff call 0xffb76564 13: 48 8d bb 70 01 00 00 lea 0x170(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 00 e9 f1 ff call 0xfff1e924 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 70 01 lock xadd %r14d,0x170(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: d1 .byte 0xd1