Extracting prog: 1m1.542415601s Minimizing prog: 37m13.897278338s Simplifying prog options: 0s Extracting C: 24.880198631s Simplifying C: 10m45.06326072s extracting reproducer from 57 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close-umount2-userfaultfd-userfaultfd-mount$9p_fd-mount$9p_fd-mkdirat$cgroup-getsockopt$IP_SET_OP_GET_BYINDEX-syz_mount_image$ext4-syz_mount_image$ext4-openat$cgroup_ro-openat$cgroup_ro-mmap-ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r4, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r5 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r5, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) getdents(r6, 0x0, 0x0) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r3, 0x0, r5, 0x0, 0x8000, 0x0) vmsplice(r5, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r2) umount2(&(0x7f00000005c0)='./file0\x00', 0x9) userfaultfd(0x80001) (async) userfaultfd(0x80001) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) mkdirat$cgroup(r4, &(0x7f0000000580)='syz1\x00', 0x1ff) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x3e, 0x0, &(0x7f00000000c0)) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x800, &(0x7f0000000780), 0x2, 0x471, &(0x7f0000000100)="$eJzs3M1rHGUYAPBndpP0I20Ta/3ohxqtYvAjadLPoxUFDwqCHuoxJmmpTRtpIthStBWpRyl4F4+C/gOe9CIqCIJXvUuhSC6t4mFkdmeaTbqbJukmE93fDyZ93513+z7PvvNuZubNbgAdayD7kURsi4jfIqKvXl3YYKD+z625S+N/zV0aTyJN3/gzqbW7OXdpvGhaPK83rwxWIiofJ7G3Sb8zFy6eGZuamjyf14dnz747PHPh4vOnz46dmjw1eW702LFDO34+emT0cFvyzGK6ueeD6X27X3nr2mvjJ669/eNXSZH/ojzaZGCpnU+laZu7K9f2hnLSVWIgrEg1IrLh6q7N/76oxvzg9cXLH5UaHLCm0jRNe1vvvpwC/2NJlB0BUI7iF312/Vts63TqsSHcOF6/AMryvjW3IyKK/LuikrfpXnR9204DEXHi8t+fZ1uszX0IAIAFvj0eafW5Zud/lXiwod2OfG2oPyLui4idEXF/ROyKiAciam0fioiHV9j/4kWSO89/KtdXldgyZed/vZX62lax5f0WTfqreW17Lf/u5OTpqckD+WsyGN2bsvrIEn1899Kvn7ba13j+l21Z/8W5YB7H9a5NC58zMTY7di85N7pxJWJPV7P8k9srAUlE7I6IPavs4/QzX+5rte/u+S+hDetM6RcRT9fXNi/HovwLSav1yYMjR4+MHh7eHFOTB4aLo+JOP/1y9fVW/S8r/zVcK8zGf2s0H/9cf9K4Xjuz8j6u/v5Jy2ua1R7/PcmbtXJP/tj7Y7Oz50ciepJX60E3Pj46/9yiXrTP8h/c33z+74z5V2JvRGQH8SMR8WhEPJbH/nhEPBER+5fI/4cXn3xn9fnP+7pviU5WKct/Yjnjn5Vq43/7QLjQE2OLHmleqJ75/psFnfavJP9s/A/VSoO1n5uX9f63nLhWdzQDAADAf08lIrZFUhm6Xa5Uhobqfy+/K7ZWpqZnZp89Of3euYn6ZwT6o7tS3Onqa7gfOpJf1hf10UX1g/l948+qW2r1ofHpqYmyk4cO19ti/mf+qJYdHbDmfF4LOpf5D53L/IfOZf5D52oy/7eUEQew/pr9/v+whDiA9dc4/18oMQ5g/bn+h85l/kPnMv+hI81sibt/SL70QvEGdQ//zz8lZ5Gmd3x/QtsL3S2++ODKvb10zQtR2RjHRvmFTRsjjDYXSn5jAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaJN/AwAA///KK+CH") (async) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x800, &(0x7f0000000780), 0x2, 0x471, &(0x7f0000000100)="$eJzs3M1rHGUYAPBndpP0I20Ta/3ohxqtYvAjadLPoxUFDwqCHuoxJmmpTRtpIthStBWpRyl4F4+C/gOe9CIqCIJXvUuhSC6t4mFkdmeaTbqbJukmE93fDyZ93513+z7PvvNuZubNbgAdayD7kURsi4jfIqKvXl3YYKD+z625S+N/zV0aTyJN3/gzqbW7OXdpvGhaPK83rwxWIiofJ7G3Sb8zFy6eGZuamjyf14dnz747PHPh4vOnz46dmjw1eW702LFDO34+emT0cFvyzGK6ueeD6X27X3nr2mvjJ669/eNXSZH/ojzaZGCpnU+laZu7K9f2hnLSVWIgrEg1IrLh6q7N/76oxvzg9cXLH5UaHLCm0jRNe1vvvpwC/2NJlB0BUI7iF312/Vts63TqsSHcOF6/AMryvjW3IyKK/LuikrfpXnR9204DEXHi8t+fZ1uszX0IAIAFvj0eafW5Zud/lXiwod2OfG2oPyLui4idEXF/ROyKiAciam0fioiHV9j/4kWSO89/KtdXldgyZed/vZX62lax5f0WTfqreW17Lf/u5OTpqckD+WsyGN2bsvrIEn1899Kvn7ba13j+l21Z/8W5YB7H9a5NC58zMTY7di85N7pxJWJPV7P8k9srAUlE7I6IPavs4/QzX+5rte/u+S+hDetM6RcRT9fXNi/HovwLSav1yYMjR4+MHh7eHFOTB4aLo+JOP/1y9fVW/S8r/zVcK8zGf2s0H/9cf9K4Xjuz8j6u/v5Jy2ua1R7/PcmbtXJP/tj7Y7Oz50ciepJX60E3Pj46/9yiXrTP8h/c33z+74z5V2JvRGQH8SMR8WhEPJbH/nhEPBER+5fI/4cXn3xn9fnP+7pviU5WKct/Yjnjn5Vq43/7QLjQE2OLHmleqJ75/psFnfavJP9s/A/VSoO1n5uX9f63nLhWdzQDAADAf08lIrZFUhm6Xa5Uhobqfy+/K7ZWpqZnZp89Of3euYn6ZwT6o7tS3Onqa7gfOpJf1hf10UX1g/l948+qW2r1ofHpqYmyk4cO19ti/mf+qJYdHbDmfF4LOpf5D53L/IfOZf5D52oy/7eUEQew/pr9/v+whDiA9dc4/18oMQ5g/bn+h85l/kPnMv+hI81sibt/SL70QvEGdQ//zz8lZ5Gmd3x/QtsL3S2++ODKvb10zQtR2RjHRvmFTRsjjDYXSn5jAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaJN/AwAA///KK+CH") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r7, 0xc080661a, &(0x7f0000000000)={@desc={0x1, 0x0, @desc4}}) program crashed: KASAN: use-after-free Read in incfs_free_mount_info single: successfully extracted reproducer found reproducer with 40 syscalls minimizing guilty program testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close-umount2-userfaultfd-userfaultfd-mount$9p_fd-mount$9p_fd-mkdirat$cgroup-getsockopt$IP_SET_OP_GET_BYINDEX-syz_mount_image$ext4-syz_mount_image$ext4-openat$cgroup_ro-openat$cgroup_ro-mmap detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r4, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r5 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r5, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) getdents(r6, 0x0, 0x0) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r3, 0x0, r5, 0x0, 0x8000, 0x0) vmsplice(r5, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r2) umount2(&(0x7f00000005c0)='./file0\x00', 0x9) userfaultfd(0x80001) (async) userfaultfd(0x80001) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) mkdirat$cgroup(r4, &(0x7f0000000580)='syz1\x00', 0x1ff) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x3e, 0x0, &(0x7f00000000c0)) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x800, &(0x7f0000000780), 0x2, 0x471, &(0x7f0000000100)="$eJzs3M1rHGUYAPBndpP0I20Ta/3ohxqtYvAjadLPoxUFDwqCHuoxJmmpTRtpIthStBWpRyl4F4+C/gOe9CIqCIJXvUuhSC6t4mFkdmeaTbqbJukmE93fDyZ93513+z7PvvNuZubNbgAdayD7kURsi4jfIqKvXl3YYKD+z625S+N/zV0aTyJN3/gzqbW7OXdpvGhaPK83rwxWIiofJ7G3Sb8zFy6eGZuamjyf14dnz747PHPh4vOnz46dmjw1eW702LFDO34+emT0cFvyzGK6ueeD6X27X3nr2mvjJ669/eNXSZH/ojzaZGCpnU+laZu7K9f2hnLSVWIgrEg1IrLh6q7N/76oxvzg9cXLH5UaHLCm0jRNe1vvvpwC/2NJlB0BUI7iF312/Vts63TqsSHcOF6/AMryvjW3IyKK/LuikrfpXnR9204DEXHi8t+fZ1uszX0IAIAFvj0eafW5Zud/lXiwod2OfG2oPyLui4idEXF/ROyKiAciam0fioiHV9j/4kWSO89/KtdXldgyZed/vZX62lax5f0WTfqreW17Lf/u5OTpqckD+WsyGN2bsvrIEn1899Kvn7ba13j+l21Z/8W5YB7H9a5NC58zMTY7di85N7pxJWJPV7P8k9srAUlE7I6IPavs4/QzX+5rte/u+S+hDetM6RcRT9fXNi/HovwLSav1yYMjR4+MHh7eHFOTB4aLo+JOP/1y9fVW/S8r/zVcK8zGf2s0H/9cf9K4Xjuz8j6u/v5Jy2ua1R7/PcmbtXJP/tj7Y7Oz50ciepJX60E3Pj46/9yiXrTP8h/c33z+74z5V2JvRGQH8SMR8WhEPJbH/nhEPBER+5fI/4cXn3xn9fnP+7pviU5WKct/Yjnjn5Vq43/7QLjQE2OLHmleqJ75/psFnfavJP9s/A/VSoO1n5uX9f63nLhWdzQDAADAf08lIrZFUhm6Xa5Uhobqfy+/K7ZWpqZnZp89Of3euYn6ZwT6o7tS3Onqa7gfOpJf1hf10UX1g/l948+qW2r1ofHpqYmyk4cO19ti/mf+qJYdHbDmfF4LOpf5D53L/IfOZf5D52oy/7eUEQew/pr9/v+whDiA9dc4/18oMQ5g/bn+h85l/kPnMv+hI81sibt/SL70QvEGdQ//zz8lZ5Gmd3x/QtsL3S2++ODKvb10zQtR2RjHRvmFTRsjjDYXSn5jAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaJN/AwAA///KK+CH") (async) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x800, &(0x7f0000000780), 0x2, 0x471, &(0x7f0000000100)="$eJzs3M1rHGUYAPBndpP0I20Ta/3ohxqtYvAjadLPoxUFDwqCHuoxJmmpTRtpIthStBWpRyl4F4+C/gOe9CIqCIJXvUuhSC6t4mFkdmeaTbqbJukmE93fDyZ93513+z7PvvNuZubNbgAdayD7kURsi4jfIqKvXl3YYKD+z625S+N/zV0aTyJN3/gzqbW7OXdpvGhaPK83rwxWIiofJ7G3Sb8zFy6eGZuamjyf14dnz747PHPh4vOnz46dmjw1eW702LFDO34+emT0cFvyzGK6ueeD6X27X3nr2mvjJ669/eNXSZH/ojzaZGCpnU+laZu7K9f2hnLSVWIgrEg1IrLh6q7N/76oxvzg9cXLH5UaHLCm0jRNe1vvvpwC/2NJlB0BUI7iF312/Vts63TqsSHcOF6/AMryvjW3IyKK/LuikrfpXnR9204DEXHi8t+fZ1uszX0IAIAFvj0eafW5Zud/lXiwod2OfG2oPyLui4idEXF/ROyKiAciam0fioiHV9j/4kWSO89/KtdXldgyZed/vZX62lax5f0WTfqreW17Lf/u5OTpqckD+WsyGN2bsvrIEn1899Kvn7ba13j+l21Z/8W5YB7H9a5NC58zMTY7di85N7pxJWJPV7P8k9srAUlE7I6IPavs4/QzX+5rte/u+S+hDetM6RcRT9fXNi/HovwLSav1yYMjR4+MHh7eHFOTB4aLo+JOP/1y9fVW/S8r/zVcK8zGf2s0H/9cf9K4Xjuz8j6u/v5Jy2ua1R7/PcmbtXJP/tj7Y7Oz50ciepJX60E3Pj46/9yiXrTP8h/c33z+74z5V2JvRGQH8SMR8WhEPJbH/nhEPBER+5fI/4cXn3xn9fnP+7pviU5WKct/Yjnjn5Vq43/7QLjQE2OLHmleqJ75/psFnfavJP9s/A/VSoO1n5uX9f63nLhWdzQDAADAf08lIrZFUhm6Xa5Uhobqfy+/K7ZWpqZnZp89Of3euYn6ZwT6o7tS3Onqa7gfOpJf1hf10UX1g/l948+qW2r1ofHpqYmyk4cO19ti/mf+qJYdHbDmfF4LOpf5D53L/IfOZf5D52oy/7eUEQew/pr9/v+whDiA9dc4/18oMQ5g/bn+h85l/kPnMv+hI81sibt/SL70QvEGdQ//zz8lZ5Gmd3x/QtsL3S2++ODKvb10zQtR2RjHRvmFTRsjjDYXSn5jAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaJN/AwAA///KK+CH") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0x0) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close-umount2-userfaultfd-userfaultfd-mount$9p_fd-mount$9p_fd-mkdirat$cgroup-getsockopt$IP_SET_OP_GET_BYINDEX-syz_mount_image$ext4-syz_mount_image$ext4-openat$cgroup_ro-openat$cgroup_ro detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r4, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r5 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r5, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) getdents(r6, 0x0, 0x0) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r3, 0x0, r5, 0x0, 0x8000, 0x0) vmsplice(r5, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r2) umount2(&(0x7f00000005c0)='./file0\x00', 0x9) userfaultfd(0x80001) (async) userfaultfd(0x80001) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) mkdirat$cgroup(r4, &(0x7f0000000580)='syz1\x00', 0x1ff) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x3e, 0x0, &(0x7f00000000c0)) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x800, &(0x7f0000000780), 0x2, 0x471, &(0x7f0000000100)="$eJzs3M1rHGUYAPBndpP0I20Ta/3ohxqtYvAjadLPoxUFDwqCHuoxJmmpTRtpIthStBWpRyl4F4+C/gOe9CIqCIJXvUuhSC6t4mFkdmeaTbqbJukmE93fDyZ93513+z7PvvNuZubNbgAdayD7kURsi4jfIqKvXl3YYKD+z625S+N/zV0aTyJN3/gzqbW7OXdpvGhaPK83rwxWIiofJ7G3Sb8zFy6eGZuamjyf14dnz747PHPh4vOnz46dmjw1eW702LFDO34+emT0cFvyzGK6ueeD6X27X3nr2mvjJ669/eNXSZH/ojzaZGCpnU+laZu7K9f2hnLSVWIgrEg1IrLh6q7N/76oxvzg9cXLH5UaHLCm0jRNe1vvvpwC/2NJlB0BUI7iF312/Vts63TqsSHcOF6/AMryvjW3IyKK/LuikrfpXnR9204DEXHi8t+fZ1uszX0IAIAFvj0eafW5Zud/lXiwod2OfG2oPyLui4idEXF/ROyKiAciam0fioiHV9j/4kWSO89/KtdXldgyZed/vZX62lax5f0WTfqreW17Lf/u5OTpqckD+WsyGN2bsvrIEn1899Kvn7ba13j+l21Z/8W5YB7H9a5NC58zMTY7di85N7pxJWJPV7P8k9srAUlE7I6IPavs4/QzX+5rte/u+S+hDetM6RcRT9fXNi/HovwLSav1yYMjR4+MHh7eHFOTB4aLo+JOP/1y9fVW/S8r/zVcK8zGf2s0H/9cf9K4Xjuz8j6u/v5Jy2ua1R7/PcmbtXJP/tj7Y7Oz50ciepJX60E3Pj46/9yiXrTP8h/c33z+74z5V2JvRGQH8SMR8WhEPJbH/nhEPBER+5fI/4cXn3xn9fnP+7pviU5WKct/Yjnjn5Vq43/7QLjQE2OLHmleqJ75/psFnfavJP9s/A/VSoO1n5uX9f63nLhWdzQDAADAf08lIrZFUhm6Xa5Uhobqfy+/K7ZWpqZnZp89Of3euYn6ZwT6o7tS3Onqa7gfOpJf1hf10UX1g/l948+qW2r1ofHpqYmyk4cO19ti/mf+qJYdHbDmfF4LOpf5D53L/IfOZf5D52oy/7eUEQew/pr9/v+whDiA9dc4/18oMQ5g/bn+h85l/kPnMv+hI81sibt/SL70QvEGdQ//zz8lZ5Gmd3x/QtsL3S2++ODKvb10zQtR2RjHRvmFTRsjjDYXSn5jAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaJN/AwAA///KK+CH") (async) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x800, &(0x7f0000000780), 0x2, 0x471, &(0x7f0000000100)="$eJzs3M1rHGUYAPBndpP0I20Ta/3ohxqtYvAjadLPoxUFDwqCHuoxJmmpTRtpIthStBWpRyl4F4+C/gOe9CIqCIJXvUuhSC6t4mFkdmeaTbqbJukmE93fDyZ93513+z7PvvNuZubNbgAdayD7kURsi4jfIqKvXl3YYKD+z625S+N/zV0aTyJN3/gzqbW7OXdpvGhaPK83rwxWIiofJ7G3Sb8zFy6eGZuamjyf14dnz747PHPh4vOnz46dmjw1eW702LFDO34+emT0cFvyzGK6ueeD6X27X3nr2mvjJ669/eNXSZH/ojzaZGCpnU+laZu7K9f2hnLSVWIgrEg1IrLh6q7N/76oxvzg9cXLH5UaHLCm0jRNe1vvvpwC/2NJlB0BUI7iF312/Vts63TqsSHcOF6/AMryvjW3IyKK/LuikrfpXnR9204DEXHi8t+fZ1uszX0IAIAFvj0eafW5Zud/lXiwod2OfG2oPyLui4idEXF/ROyKiAciam0fioiHV9j/4kWSO89/KtdXldgyZed/vZX62lax5f0WTfqreW17Lf/u5OTpqckD+WsyGN2bsvrIEn1899Kvn7ba13j+l21Z/8W5YB7H9a5NC58zMTY7di85N7pxJWJPV7P8k9srAUlE7I6IPavs4/QzX+5rte/u+S+hDetM6RcRT9fXNi/HovwLSav1yYMjR4+MHh7eHFOTB4aLo+JOP/1y9fVW/S8r/zVcK8zGf2s0H/9cf9K4Xjuz8j6u/v5Jy2ua1R7/PcmbtXJP/tj7Y7Oz50ciepJX60E3Pj46/9yiXrTP8h/c33z+74z5V2JvRGQH8SMR8WhEPJbH/nhEPBER+5fI/4cXn3xn9fnP+7pviU5WKct/Yjnjn5Vq43/7QLjQE2OLHmleqJ75/psFnfavJP9s/A/VSoO1n5uX9f63nLhWdzQDAADAf08lIrZFUhm6Xa5Uhobqfy+/K7ZWpqZnZp89Of3euYn6ZwT6o7tS3Onqa7gfOpJf1hf10UX1g/l948+qW2r1ofHpqYmyk4cO19ti/mf+qJYdHbDmfF4LOpf5D53L/IfOZf5D52oy/7eUEQew/pr9/v+whDiA9dc4/18oMQ5g/bn+h85l/kPnMv+hI81sibt/SL70QvEGdQ//zz8lZ5Gmd3x/QtsL3S2++ODKvb10zQtR2RjHRvmFTRsjjDYXSn5jAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaJN/AwAA///KK+CH") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close-umount2-userfaultfd-userfaultfd-mount$9p_fd-mount$9p_fd-mkdirat$cgroup-getsockopt$IP_SET_OP_GET_BYINDEX-syz_mount_image$ext4-syz_mount_image$ext4-openat$cgroup_ro detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r4, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r5 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r5, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) getdents(r6, 0x0, 0x0) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r3, 0x0, r5, 0x0, 0x8000, 0x0) vmsplice(r5, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r2) umount2(&(0x7f00000005c0)='./file0\x00', 0x9) userfaultfd(0x80001) (async) userfaultfd(0x80001) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) mkdirat$cgroup(r4, &(0x7f0000000580)='syz1\x00', 0x1ff) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x3e, 0x0, &(0x7f00000000c0)) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x800, &(0x7f0000000780), 0x2, 0x471, &(0x7f0000000100)="$eJzs3M1rHGUYAPBndpP0I20Ta/3ohxqtYvAjadLPoxUFDwqCHuoxJmmpTRtpIthStBWpRyl4F4+C/gOe9CIqCIJXvUuhSC6t4mFkdmeaTbqbJukmE93fDyZ93513+z7PvvNuZubNbgAdayD7kURsi4jfIqKvXl3YYKD+z625S+N/zV0aTyJN3/gzqbW7OXdpvGhaPK83rwxWIiofJ7G3Sb8zFy6eGZuamjyf14dnz747PHPh4vOnz46dmjw1eW702LFDO34+emT0cFvyzGK6ueeD6X27X3nr2mvjJ669/eNXSZH/ojzaZGCpnU+laZu7K9f2hnLSVWIgrEg1IrLh6q7N/76oxvzg9cXLH5UaHLCm0jRNe1vvvpwC/2NJlB0BUI7iF312/Vts63TqsSHcOF6/AMryvjW3IyKK/LuikrfpXnR9204DEXHi8t+fZ1uszX0IAIAFvj0eafW5Zud/lXiwod2OfG2oPyLui4idEXF/ROyKiAciam0fioiHV9j/4kWSO89/KtdXldgyZed/vZX62lax5f0WTfqreW17Lf/u5OTpqckD+WsyGN2bsvrIEn1899Kvn7ba13j+l21Z/8W5YB7H9a5NC58zMTY7di85N7pxJWJPV7P8k9srAUlE7I6IPavs4/QzX+5rte/u+S+hDetM6RcRT9fXNi/HovwLSav1yYMjR4+MHh7eHFOTB4aLo+JOP/1y9fVW/S8r/zVcK8zGf2s0H/9cf9K4Xjuz8j6u/v5Jy2ua1R7/PcmbtXJP/tj7Y7Oz50ciepJX60E3Pj46/9yiXrTP8h/c33z+74z5V2JvRGQH8SMR8WhEPJbH/nhEPBER+5fI/4cXn3xn9fnP+7pviU5WKct/Yjnjn5Vq43/7QLjQE2OLHmleqJ75/psFnfavJP9s/A/VSoO1n5uX9f63nLhWdzQDAADAf08lIrZFUhm6Xa5Uhobqfy+/K7ZWpqZnZp89Of3euYn6ZwT6o7tS3Onqa7gfOpJf1hf10UX1g/l948+qW2r1ofHpqYmyk4cO19ti/mf+qJYdHbDmfF4LOpf5D53L/IfOZf5D52oy/7eUEQew/pr9/v+whDiA9dc4/18oMQ5g/bn+h85l/kPnMv+hI81sibt/SL70QvEGdQ//zz8lZ5Gmd3x/QtsL3S2++ODKvb10zQtR2RjHRvmFTRsjjDYXSn5jAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaJN/AwAA///KK+CH") (async) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x800, &(0x7f0000000780), 0x2, 0x471, &(0x7f0000000100)="$eJzs3M1rHGUYAPBndpP0I20Ta/3ohxqtYvAjadLPoxUFDwqCHuoxJmmpTRtpIthStBWpRyl4F4+C/gOe9CIqCIJXvUuhSC6t4mFkdmeaTbqbJukmE93fDyZ93513+z7PvvNuZubNbgAdayD7kURsi4jfIqKvXl3YYKD+z625S+N/zV0aTyJN3/gzqbW7OXdpvGhaPK83rwxWIiofJ7G3Sb8zFy6eGZuamjyf14dnz747PHPh4vOnz46dmjw1eW702LFDO34+emT0cFvyzGK6ueeD6X27X3nr2mvjJ669/eNXSZH/ojzaZGCpnU+laZu7K9f2hnLSVWIgrEg1IrLh6q7N/76oxvzg9cXLH5UaHLCm0jRNe1vvvpwC/2NJlB0BUI7iF312/Vts63TqsSHcOF6/AMryvjW3IyKK/LuikrfpXnR9204DEXHi8t+fZ1uszX0IAIAFvj0eafW5Zud/lXiwod2OfG2oPyLui4idEXF/ROyKiAciam0fioiHV9j/4kWSO89/KtdXldgyZed/vZX62lax5f0WTfqreW17Lf/u5OTpqckD+WsyGN2bsvrIEn1899Kvn7ba13j+l21Z/8W5YB7H9a5NC58zMTY7di85N7pxJWJPV7P8k9srAUlE7I6IPavs4/QzX+5rte/u+S+hDetM6RcRT9fXNi/HovwLSav1yYMjR4+MHh7eHFOTB4aLo+JOP/1y9fVW/S8r/zVcK8zGf2s0H/9cf9K4Xjuz8j6u/v5Jy2ua1R7/PcmbtXJP/tj7Y7Oz50ciepJX60E3Pj46/9yiXrTP8h/c33z+74z5V2JvRGQH8SMR8WhEPJbH/nhEPBER+5fI/4cXn3xn9fnP+7pviU5WKct/Yjnjn5Vq43/7QLjQE2OLHmleqJ75/psFnfavJP9s/A/VSoO1n5uX9f63nLhWdzQDAADAf08lIrZFUhm6Xa5Uhobqfy+/K7ZWpqZnZp89Of3euYn6ZwT6o7tS3Onqa7gfOpJf1hf10UX1g/l948+qW2r1ofHpqYmyk4cO19ti/mf+qJYdHbDmfF4LOpf5D53L/IfOZf5D52oy/7eUEQew/pr9/v+whDiA9dc4/18oMQ5g/bn+h85l/kPnMv+hI81sibt/SL70QvEGdQ//zz8lZ5Gmd3x/QtsL3S2++ODKvb10zQtR2RjHRvmFTRsjjDYXSn5jAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaJN/AwAA///KK+CH") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close-umount2-userfaultfd-userfaultfd-mount$9p_fd-mount$9p_fd-mkdirat$cgroup-getsockopt$IP_SET_OP_GET_BYINDEX-syz_mount_image$ext4-syz_mount_image$ext4 detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r4, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r5 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r5, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) getdents(r6, 0x0, 0x0) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r3, 0x0, r5, 0x0, 0x8000, 0x0) vmsplice(r5, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r2) umount2(&(0x7f00000005c0)='./file0\x00', 0x9) userfaultfd(0x80001) (async) userfaultfd(0x80001) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) mkdirat$cgroup(r4, &(0x7f0000000580)='syz1\x00', 0x1ff) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x3e, 0x0, &(0x7f00000000c0)) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x800, &(0x7f0000000780), 0x2, 0x471, &(0x7f0000000100)="$eJzs3M1rHGUYAPBndpP0I20Ta/3ohxqtYvAjadLPoxUFDwqCHuoxJmmpTRtpIthStBWpRyl4F4+C/gOe9CIqCIJXvUuhSC6t4mFkdmeaTbqbJukmE93fDyZ93513+z7PvvNuZubNbgAdayD7kURsi4jfIqKvXl3YYKD+z625S+N/zV0aTyJN3/gzqbW7OXdpvGhaPK83rwxWIiofJ7G3Sb8zFy6eGZuamjyf14dnz747PHPh4vOnz46dmjw1eW702LFDO34+emT0cFvyzGK6ueeD6X27X3nr2mvjJ669/eNXSZH/ojzaZGCpnU+laZu7K9f2hnLSVWIgrEg1IrLh6q7N/76oxvzg9cXLH5UaHLCm0jRNe1vvvpwC/2NJlB0BUI7iF312/Vts63TqsSHcOF6/AMryvjW3IyKK/LuikrfpXnR9204DEXHi8t+fZ1uszX0IAIAFvj0eafW5Zud/lXiwod2OfG2oPyLui4idEXF/ROyKiAciam0fioiHV9j/4kWSO89/KtdXldgyZed/vZX62lax5f0WTfqreW17Lf/u5OTpqckD+WsyGN2bsvrIEn1899Kvn7ba13j+l21Z/8W5YB7H9a5NC58zMTY7di85N7pxJWJPV7P8k9srAUlE7I6IPavs4/QzX+5rte/u+S+hDetM6RcRT9fXNi/HovwLSav1yYMjR4+MHh7eHFOTB4aLo+JOP/1y9fVW/S8r/zVcK8zGf2s0H/9cf9K4Xjuz8j6u/v5Jy2ua1R7/PcmbtXJP/tj7Y7Oz50ciepJX60E3Pj46/9yiXrTP8h/c33z+74z5V2JvRGQH8SMR8WhEPJbH/nhEPBER+5fI/4cXn3xn9fnP+7pviU5WKct/Yjnjn5Vq43/7QLjQE2OLHmleqJ75/psFnfavJP9s/A/VSoO1n5uX9f63nLhWdzQDAADAf08lIrZFUhm6Xa5Uhobqfy+/K7ZWpqZnZp89Of3euYn6ZwT6o7tS3Onqa7gfOpJf1hf10UX1g/l948+qW2r1ofHpqYmyk4cO19ti/mf+qJYdHbDmfF4LOpf5D53L/IfOZf5D52oy/7eUEQew/pr9/v+whDiA9dc4/18oMQ5g/bn+h85l/kPnMv+hI81sibt/SL70QvEGdQ//zz8lZ5Gmd3x/QtsL3S2++ODKvb10zQtR2RjHRvmFTRsjjDYXSn5jAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaJN/AwAA///KK+CH") (async) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x800, &(0x7f0000000780), 0x2, 0x471, &(0x7f0000000100)="$eJzs3M1rHGUYAPBndpP0I20Ta/3ohxqtYvAjadLPoxUFDwqCHuoxJmmpTRtpIthStBWpRyl4F4+C/gOe9CIqCIJXvUuhSC6t4mFkdmeaTbqbJukmE93fDyZ93513+z7PvvNuZubNbgAdayD7kURsi4jfIqKvXl3YYKD+z625S+N/zV0aTyJN3/gzqbW7OXdpvGhaPK83rwxWIiofJ7G3Sb8zFy6eGZuamjyf14dnz747PHPh4vOnz46dmjw1eW702LFDO34+emT0cFvyzGK6ueeD6X27X3nr2mvjJ669/eNXSZH/ojzaZGCpnU+laZu7K9f2hnLSVWIgrEg1IrLh6q7N/76oxvzg9cXLH5UaHLCm0jRNe1vvvpwC/2NJlB0BUI7iF312/Vts63TqsSHcOF6/AMryvjW3IyKK/LuikrfpXnR9204DEXHi8t+fZ1uszX0IAIAFvj0eafW5Zud/lXiwod2OfG2oPyLui4idEXF/ROyKiAciam0fioiHV9j/4kWSO89/KtdXldgyZed/vZX62lax5f0WTfqreW17Lf/u5OTpqckD+WsyGN2bsvrIEn1899Kvn7ba13j+l21Z/8W5YB7H9a5NC58zMTY7di85N7pxJWJPV7P8k9srAUlE7I6IPavs4/QzX+5rte/u+S+hDetM6RcRT9fXNi/HovwLSav1yYMjR4+MHh7eHFOTB4aLo+JOP/1y9fVW/S8r/zVcK8zGf2s0H/9cf9K4Xjuz8j6u/v5Jy2ua1R7/PcmbtXJP/tj7Y7Oz50ciepJX60E3Pj46/9yiXrTP8h/c33z+74z5V2JvRGQH8SMR8WhEPJbH/nhEPBER+5fI/4cXn3xn9fnP+7pviU5WKct/Yjnjn5Vq43/7QLjQE2OLHmleqJ75/psFnfavJP9s/A/VSoO1n5uX9f63nLhWdzQDAADAf08lIrZFUhm6Xa5Uhobqfy+/K7ZWpqZnZp89Of3euYn6ZwT6o7tS3Onqa7gfOpJf1hf10UX1g/l948+qW2r1ofHpqYmyk4cO19ti/mf+qJYdHbDmfF4LOpf5D53L/IfOZf5D52oy/7eUEQew/pr9/v+whDiA9dc4/18oMQ5g/bn+h85l/kPnMv+hI81sibt/SL70QvEGdQ//zz8lZ5Gmd3x/QtsL3S2++ODKvb10zQtR2RjHRvmFTRsjjDYXSn5jAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaJN/AwAA///KK+CH") program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close-umount2-userfaultfd-userfaultfd-mount$9p_fd-mount$9p_fd-mkdirat$cgroup-getsockopt$IP_SET_OP_GET_BYINDEX-syz_mount_image$ext4 detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r4, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r5 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r5, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) getdents(r6, 0x0, 0x0) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r3, 0x0, r5, 0x0, 0x8000, 0x0) vmsplice(r5, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r2) umount2(&(0x7f00000005c0)='./file0\x00', 0x9) userfaultfd(0x80001) (async) userfaultfd(0x80001) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) mkdirat$cgroup(r4, &(0x7f0000000580)='syz1\x00', 0x1ff) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x3e, 0x0, &(0x7f00000000c0)) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x800, &(0x7f0000000780), 0x2, 0x471, &(0x7f0000000100)="$eJzs3M1rHGUYAPBndpP0I20Ta/3ohxqtYvAjadLPoxUFDwqCHuoxJmmpTRtpIthStBWpRyl4F4+C/gOe9CIqCIJXvUuhSC6t4mFkdmeaTbqbJukmE93fDyZ93513+z7PvvNuZubNbgAdayD7kURsi4jfIqKvXl3YYKD+z625S+N/zV0aTyJN3/gzqbW7OXdpvGhaPK83rwxWIiofJ7G3Sb8zFy6eGZuamjyf14dnz747PHPh4vOnz46dmjw1eW702LFDO34+emT0cFvyzGK6ueeD6X27X3nr2mvjJ669/eNXSZH/ojzaZGCpnU+laZu7K9f2hnLSVWIgrEg1IrLh6q7N/76oxvzg9cXLH5UaHLCm0jRNe1vvvpwC/2NJlB0BUI7iF312/Vts63TqsSHcOF6/AMryvjW3IyKK/LuikrfpXnR9204DEXHi8t+fZ1uszX0IAIAFvj0eafW5Zud/lXiwod2OfG2oPyLui4idEXF/ROyKiAciam0fioiHV9j/4kWSO89/KtdXldgyZed/vZX62lax5f0WTfqreW17Lf/u5OTpqckD+WsyGN2bsvrIEn1899Kvn7ba13j+l21Z/8W5YB7H9a5NC58zMTY7di85N7pxJWJPV7P8k9srAUlE7I6IPavs4/QzX+5rte/u+S+hDetM6RcRT9fXNi/HovwLSav1yYMjR4+MHh7eHFOTB4aLo+JOP/1y9fVW/S8r/zVcK8zGf2s0H/9cf9K4Xjuz8j6u/v5Jy2ua1R7/PcmbtXJP/tj7Y7Oz50ciepJX60E3Pj46/9yiXrTP8h/c33z+74z5V2JvRGQH8SMR8WhEPJbH/nhEPBER+5fI/4cXn3xn9fnP+7pviU5WKct/Yjnjn5Vq43/7QLjQE2OLHmleqJ75/psFnfavJP9s/A/VSoO1n5uX9f63nLhWdzQDAADAf08lIrZFUhm6Xa5Uhobqfy+/K7ZWpqZnZp89Of3euYn6ZwT6o7tS3Onqa7gfOpJf1hf10UX1g/l948+qW2r1ofHpqYmyk4cO19ti/mf+qJYdHbDmfF4LOpf5D53L/IfOZf5D52oy/7eUEQew/pr9/v+whDiA9dc4/18oMQ5g/bn+h85l/kPnMv+hI81sibt/SL70QvEGdQ//zz8lZ5Gmd3x/QtsL3S2++ODKvb10zQtR2RjHRvmFTRsjjDYXSn5jAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaJN/AwAA///KK+CH") (async) program crashed: KASAN: use-after-free Read in incfs_free_mount_info testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close-umount2-userfaultfd-userfaultfd-mount$9p_fd-mount$9p_fd-mkdirat$cgroup-getsockopt$IP_SET_OP_GET_BYINDEX detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r4, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r4, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r5 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r5, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r6) getdents(r6, 0x0, 0x0) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r5, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r3, 0x0, r5, 0x0, 0x8000, 0x0) vmsplice(r5, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r2) umount2(&(0x7f00000005c0)='./file0\x00', 0x9) userfaultfd(0x80001) (async) userfaultfd(0x80001) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) mkdirat$cgroup(r4, &(0x7f0000000580)='syz1\x00', 0x1ff) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x3e, 0x0, &(0x7f00000000c0)) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close-umount2-userfaultfd-userfaultfd-mount$9p_fd-mount$9p_fd-mkdirat$cgroup detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r3, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r3, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r3, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r4 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r4, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r5) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r5) getdents(r5, 0x0, 0x0) connect$inet(r4, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r4, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r2, 0x0, r4, 0x0, 0x8000, 0x0) vmsplice(r4, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r1) umount2(&(0x7f00000005c0)='./file0\x00', 0x9) userfaultfd(0x80001) (async) userfaultfd(0x80001) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) mkdirat$cgroup(r3, &(0x7f0000000580)='syz1\x00', 0x1ff) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close-umount2-userfaultfd-userfaultfd-mount$9p_fd-mount$9p_fd detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r3, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r3, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r3, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r4 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r4, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r5) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r5) getdents(r5, 0x0, 0x0) connect$inet(r4, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r4, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r2, 0x0, r4, 0x0, 0x8000, 0x0) vmsplice(r4, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r1) umount2(&(0x7f00000005c0)='./file0\x00', 0x9) userfaultfd(0x80001) (async) userfaultfd(0x80001) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close-umount2-userfaultfd-userfaultfd-mount$9p_fd detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0)=0xffffffffffffffff, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r3, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r3, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r3, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r4 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r4, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r5) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r5) getdents(r5, 0x0, 0x0) connect$inet(r4, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r4, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r2, 0x0, r4, 0x0, 0x8000, 0x0) vmsplice(r4, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r1) umount2(&(0x7f00000005c0)='./file0\x00', 0x9) userfaultfd(0x80001) (async) userfaultfd(0x80001) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x84, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close-umount2-userfaultfd-userfaultfd detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r2, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r2, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r2, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r3 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r4) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r4) getdents(r4, 0x0, 0x0) connect$inet(r3, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r3, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r1, 0x0, r3, 0x0, 0x8000, 0x0) vmsplice(r3, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r0) umount2(&(0x7f00000005c0)='./file0\x00', 0x9) userfaultfd(0x80001) (async) userfaultfd(0x80001) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close-umount2-userfaultfd detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r2, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r2, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r2, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r3 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r4) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r4) getdents(r4, 0x0, 0x0) connect$inet(r3, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r3, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r1, 0x0, r3, 0x0, 0x8000, 0x0) vmsplice(r3, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r0) umount2(&(0x7f00000005c0)='./file0\x00', 0x9) userfaultfd(0x80001) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close-umount2 detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r2, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r2, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r2, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r3 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r4) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r4) getdents(r4, 0x0, 0x0) connect$inet(r3, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r3, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r1, 0x0, r3, 0x0, 0x8000, 0x0) vmsplice(r3, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r0) umount2(&(0x7f00000005c0)='./file0\x00', 0x9) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice-close detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r2, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r2, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r2, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r3 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r4) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r4) getdents(r4, 0x0, 0x0) connect$inet(r3, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r3, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r1, 0x0, r3, 0x0, 0x8000, 0x0) vmsplice(r3, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) close(r0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice-vmsplice detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r1, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r2 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r3) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r3) getdents(r3, 0x0, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r2, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r0, 0x0, r2, 0x0, 0x8000, 0x0) vmsplice(r2, &(0x7f0000000a40)=[{&(0x7f0000000600)="5e195065727ca7f8b282ab1abc16c1852ae5fc33aa08b11c3326dee62ecbb816fa7aa7bbff303aee7d086d52a4ca1e8fe9b8b83fd36e65e6b49585ced9651af72edeb76989c919e357396c5319dba912692569915b15cba2d96b933014153e28a9f274dcb9f13728be45fa9edec36414cdf1597fdce974771ee425566e5e7e5a90404b86dd83", 0x86}, {&(0x7f00000006c0)="c76dc2b62152d8c5e1ca63c3ed7e8543f645586a54d2b57e437bbc3aa496615dd6", 0x21}, {&(0x7f0000000700)="13c41d27329f46a42d0331715b6b649e376a7a60935733cd714d72e8fd1897e867de85a5a27745cfdcf48dff3a961a38c90e98d8aa5a5cdb62ebd527dde522a28643f1546fa75b18b0e4fca33b87446c3a35c4ebb4c1ba9887ef", 0x5a}, {&(0x7f0000000880)="e090498bb32329248cd9b82660fff89de9e34a231d0a2fa92859f7c781022c58e9249e4fbc344765819ab8fec551f5b3da86519377664cf2d632d9ba1ffc18aba476ef", 0x43}, {&(0x7f0000000900)="2e0c6c2777ff7c49034758bb70ff456f6a46", 0x12}, {&(0x7f0000000940)="4aedad1a2f79acbbd9aabbd22bd34423e8b0771da916d278a28424f9e423eae9cce0c0b767ed191638c7b77e6a50843f122c789ae6873a3e1cc3e3b5facbbc2dfc17db7f5aa9de02685d04b48fd8f36e085027743ca592d4355e29e3031a383326776a8ce108660bead2a3e4066455e9b8c11cfeb7335677f15cf3b3ce75", 0x7e}, {&(0x7f00000009c0)="6ae1ae84013774b71218a9622a8b340f902972a631d1c4f8055576a9bd894d205af06f8d0b4f9d08bd4ca79a72f950e2934549ede5df797b6f21dae4f231abefafaa012aa9c2ac8dbc871685b5507c6dd39099a91af8516240d5f1fbb47f8996fb8cfe7c7a5d7071100672f579a8c3169316d6a8094fed0ff2cd", 0x7a}], 0x7, 0xd) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet-splice detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r1, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r2 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r3) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r3) getdents(r3, 0x0, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r2, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) splice(r0, 0x0, r2, 0x0, 0x8000, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet-connect$inet detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r2) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r2) getdents(r2, 0x0, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) connect$inet(r1, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents-connect$inet detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r2) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r2) getdents(r2, 0x0, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x20, @remote}, 0x10) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-getdents detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r2) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r2) getdents(r2, 0x0, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r2) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r2) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro-syz_genetlink_get_family_id$ethtool detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r2) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro-openat$cgroup_ro detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open-openat$cgroup_ro detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir-open detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs-chdir detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mkdir detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) program did not crash testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mkdir-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-setsockopt$inet_int-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) r1 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program did not crash testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-socket$inet-mkdir-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) socket$inet(0x2, 0x3, 0x7f) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-vmsplice-mkdir-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-vmsplice-mkdir-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000280)="afc356bf9b09d4372dada82178d12dd14c1ac862", 0x14}], 0x1, 0x0) (async) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-write$P9_RSYMLINK-mkdir-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RSYMLINK(r0, &(0x7f00000000c0)={0x3, 0x11, 0x1, {0x40, 0x4, 0x3}}, 0x14) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-pipe-mkdir-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) pipe(&(0x7f00000045c0)) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-openat-mkdir-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-syz_clone3-mkdir-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000100)={0x801400, &(0x7f00000000c0), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-socket$nl_route-mkdir-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-openat$fuse-mkdir-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mkdir-mount$incfs detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) (async) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) (async) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(0x0, 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(0x0, &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', 0x0, &(0x7f0000000840), 0x1004002, 0x0) program did not crash testing program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', 0x0, 0x1004002, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=33.745560792s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir simplifying C reproducer testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program did not crash testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing compiled C program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs program crashed: KASAN: null-ptr-deref Write in vfs_rmdir testing program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true testing program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true testing program (duration=33.745560792s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdir-mount$incfs detailed listing: executing program 0: mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$incfs(&(0x7f00000007c0)='.\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000840), 0x1004002, 0x0) program crashed: KASAN: null-ptr-deref Write in vfs_rmdir validation run: crashed=true reproducing took 51m49.151473966s repro crashed as (corrupted=false): R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffeaf958b00 R13: 00007f3138bcf1ca R14: 0000000000005879 R15: 00007ffeaf958b40 ---[ end trace ff97812f23d0d7af ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:423 Write of size 4 at addr 0000000000000170 by task syz-executor/365 CPU: 0 PID: 365 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:439 [inline] kasan_report+0xd8/0x130 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] ihold+0x20/0x60 fs/inode.c:423 d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x247/0x3e0 fs/namei.c:3873 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x45b/0x510 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f3138b3b097 Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffeaf9579b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f3138b3b097 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffeaf957a70 RBP: 00007ffeaf957a70 R08: 00007ffeaf958a70 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffeaf958b00 R13: 00007f3138bcf1ca R14: 0000000000005879 R15: 00007ffeaf958b40 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000170 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 110c2d067 P4D 110c2d067 PUD 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 0 PID: 365 Comm: syz-executor Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 01 61 b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 e9 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 81 RSP: 0018:ffffc90000c17d10 EFLAGS: 00010246 RAX: ffff88810c4f2700 RBX: 0000000000000000 RCX: 0000000000000286 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90000c17d20 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcfa48 R12: 1ffff11021a5026c R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055555a268500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000010d500000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x247/0x3e0 fs/namei.c:3873 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x45b/0x510 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f3138b3b097 Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffeaf9579b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f3138b3b097 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffeaf957a70 RBP: 00007ffeaf957a70 R08: 00007ffeaf958a70 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffeaf958b00 R13: 00007f3138bcf1ca R14: 0000000000005879 R15: 00007ffeaf958b40 Modules linked in: CR2: 0000000000000170 ---[ end trace ff97812f23d0d7b0 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 01 61 b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 e9 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 81 RSP: 0018:ffffc90000c17d10 EFLAGS: 00010246 RAX: ffff88810c4f2700 RBX: 0000000000000000 RCX: 0000000000000286 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90000c17d20 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcfa48 R12: 1ffff11021a5026c R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055555a268500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000010d500000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 01 61 b7 ff call 0xffb76114 13: 48 8d bb 70 01 00 00 lea 0x170(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 00 e9 f1 ff call 0xfff1e924 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 70 01 lock xadd %r14d,0x170(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 81 .byte 0x81 final repro crashed as (corrupted=false): R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffeaf958b00 R13: 00007f3138bcf1ca R14: 0000000000005879 R15: 00007ffeaf958b40 ---[ end trace ff97812f23d0d7af ]--- ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: null-ptr-deref in atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 fs/inode.c:423 Write of size 4 at addr 0000000000000170 by task syz-executor/365 CPU: 0 PID: 365 Comm: syz-executor Tainted: G W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 __kasan_report mm/kasan/report.c:439 [inline] kasan_report+0xd8/0x130 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_inc_return include/asm-generic/atomic-instrumented.h:250 [inline] ihold+0x20/0x60 fs/inode.c:423 d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x247/0x3e0 fs/namei.c:3873 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x45b/0x510 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f3138b3b097 Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffeaf9579b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f3138b3b097 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffeaf957a70 RBP: 00007ffeaf957a70 R08: 00007ffeaf958a70 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffeaf958b00 R13: 00007f3138bcf1ca R14: 0000000000005879 R15: 00007ffeaf958b40 ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000170 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 110c2d067 P4D 110c2d067 PUD 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 0 PID: 365 Comm: syz-executor Tainted: G B W syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 01 61 b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 e9 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 81 RSP: 0018:ffffc90000c17d10 EFLAGS: 00010246 RAX: ffff88810c4f2700 RBX: 0000000000000000 RCX: 0000000000000286 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90000c17d20 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcfa48 R12: 1ffff11021a5026c R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055555a268500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000010d500000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: d_delete_notify include/linux/fsnotify.h:264 [inline] vfs_rmdir+0x247/0x3e0 fs/namei.c:3873 incfs_kill_sb+0xfe/0x210 fs/incfs/vfs.c:1973 deactivate_locked_super+0xa0/0x100 fs/super.c:335 deactivate_super+0xaf/0xe0 fs/super.c:366 cleanup_mnt+0x45b/0x510 fs/namespace.c:1123 __cleanup_mnt+0x19/0x20 fs/namespace.c:1130 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f3138b3b097 Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffeaf9579b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f3138b3b097 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffeaf957a70 RBP: 00007ffeaf957a70 R08: 00007ffeaf958a70 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffeaf958b00 R13: 00007f3138bcf1ca R14: 0000000000005879 R15: 00007ffeaf958b40 Modules linked in: CR2: 0000000000000170 ---[ end trace ff97812f23d0d7b0 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline] RIP: 0010:arch_atomic_inc_return include/linux/atomic-arch-fallback.h:286 [inline] RIP: 0010:atomic_inc_return include/asm-generic/atomic-instrumented.h:251 [inline] RIP: 0010:ihold+0x26/0x60 fs/inode.c:423 Code: 00 00 00 00 55 48 89 e5 41 56 53 48 89 fb e8 01 61 b7 ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 00 e9 f1 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 81 RSP: 0018:ffffc90000c17d10 EFLAGS: 00010246 RAX: ffff88810c4f2700 RBX: 0000000000000000 RCX: 0000000000000286 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000ffffffff RBP: ffffc90000c17d20 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcfa48 R12: 1ffff11021a5026c R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 FS: 000055555a268500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 000000010d500000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 55 push %rbp 5: 48 89 e5 mov %rsp,%rbp 8: 41 56 push %r14 a: 53 push %rbx b: 48 89 fb mov %rdi,%rbx e: e8 01 61 b7 ff call 0xffb76114 13: 48 8d bb 70 01 00 00 lea 0x170(%rbx),%rdi 1a: be 04 00 00 00 mov $0x4,%esi 1f: e8 00 e9 f1 ff call 0xfff1e924 24: 41 be 01 00 00 00 mov $0x1,%r14d * 2a: f0 44 0f c1 b3 70 01 lock xadd %r14d,0x170(%rbx) <-- trapping instruction 31: 00 00 33: 41 ff c6 inc %r14d 36: bf 02 00 00 00 mov $0x2,%edi 3b: 44 89 f6 mov %r14d,%esi 3e: e8 .byte 0xe8 3f: 81 .byte 0x81