==================================================================
BUG: KASAN: slab-use-after-free in perf_trace_lock_acquire+0x533/0x700
Read of size 8 at addr ffff88801628deb0 by task syz-executor.3/12252

CPU: 1 UID: 0 PID: 12252 Comm: syz-executor.3 Not tainted 6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xca/0x120
 print_report+0xcb/0x610
 kasan_report+0xca/0x100
 perf_trace_lock_acquire+0x533/0x700
 lock_acquire+0xc5/0x2d0
 _raw_spin_lock+0x2b/0x40
 mqueue_flush_file+0x47/0x110
 filp_flush+0x12c/0x1d0
 __x64_sys_close+0x85/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f80a24e172b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffdd2f42430 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f80a24e172b
RDX: 00007f80a2647750 RSI: ffffffff84c96431 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2fd25d5c
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003c24d
R13: 00000000000003e8 R14: 00007f80a2641f60 R15: 000000000003c21a
 </TASK>

Allocated by task 12261:
 kasan_save_stack+0x24/0x50
 kasan_save_track+0x14/0x30
 __kasan_slab_alloc+0x59/0x70
 kmem_cache_alloc_lru_noprof+0x217/0x720
 mqueue_alloc_inode+0x27/0x50
 alloc_inode+0x67/0x250
 new_inode+0x1e/0x160
 mqueue_get_inode+0x2e/0xdf0
 mqueue_create_attr+0x1df/0x460
 vfs_mkobj+0x3d5/0x620
 do_mq_open+0x7a3/0x980
 __x64_sys_mq_open+0x14f/0x1e0
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 845:
 kasan_save_stack+0x24/0x50
 kasan_save_track+0x14/0x30
 kasan_save_free_info+0x3a/0x60
 __kasan_slab_free+0x43/0x70
 kmem_cache_free+0x2cd/0x660
 i_callback+0x46/0x70
 rcu_core+0x73c/0x1ed0
 handle_softirqs+0x1b1/0x740
 __irq_exit_rcu+0xc4/0x100
 irq_exit_rcu+0x9/0x20
 sysvec_apic_timer_interrupt+0x70/0x80
 asm_sysvec_apic_timer_interrupt+0x1a/0x20

Last potentially related work creation:
 kasan_save_stack+0x24/0x50
 kasan_record_aux_stack+0x89/0xa0
 __call_rcu_common.constprop.0+0x70/0xad0
 destroy_inode+0x12b/0x1b0
 evict+0x4fe/0x9e0
 iput.part.0+0x7ea/0xeb0
 iput+0x35/0x40
 __do_sys_mq_unlink+0x2a3/0x3d0
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88801628de80
 which belongs to the cache mqueue_inode_cache of size 1568
The buggy address is located 48 bytes inside of
 freed 1568-byte region [ffff88801628de80, ffff88801628e4a0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888016288000 pfn:0x16288
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff8880584d0601
flags: 0x100000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0100000000000040 ffff88800a9aca00 dead000000000122 0000000000000000
raw: ffff888016288000 0000000080120010 00000000f5000000 ffff8880584d0601
head: 0100000000000040 ffff88800a9aca00 dead000000000122 0000000000000000
head: ffff888016288000 0000000080120010 00000000f5000000 ffff8880584d0601
head: 0100000000000003 ffffea000058a201 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88801628dd80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
 ffff88801628de00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801628de80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff88801628df00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88801628df80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 UID: 0 PID: 12252 Comm: syz-executor.3 Tainted: G    B               6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555571513400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdc5b9afe8 CR3: 000000005ac8c000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f80a24e172b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffdd2f42430 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f80a24e172b
RDX: 00007f80a2647750 RSI: ffffffff84c96431 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2fd25d5c
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003c24d
R13: 00000000000003e8 R14: 00007f80a2641f60 R15: 000000000003c21a
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555571513400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdc5b9afe8 CR3: 000000005ac8c000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#2] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 UID: 0 PID: 12302 Comm: syz-executor.4 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff888058b4fe08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628e580 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888016a1efc0 R08: 0000000000000001 R09: ffffed100b169fd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888016a1f000
R13: 0000000000000010 R14: ffff88801d3a4eb0 R15: 0000000000000000
FS:  0000555561b79400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3042d000 CR3: 000000005ad95000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f69af18972b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffd91186df0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f69af18972b
RDX: 00007f69af2ef750 RSI: 00007f69aef4e270 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b3042d3d8
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003ce6d
R13: 00000000000003e8 R14: 00007f69af2e9f60 R15: 000000000003ce32
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555561b79400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3042d000 CR3: 000000005ad95000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#3] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 UID: 0 PID: 12300 Comm: syz-executor.3 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88803b26fe08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888055d46580 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888016f3ce00 R08: 0000000000000001 R09: ffffed100764dfd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888016f3ce40
R13: 0000000000000010 R14: ffff88804fe5a5e0 R15: 0000000000000000
FS:  0000555571513400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe96fb72540 CR3: 000000005aff7000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f80a24e172b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffdd2f42430 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f80a24e172b
RDX: 00007f80a2647750 RSI: 00007f80a22a64a0 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2fd2de64
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003ceb1
R13: 00000000000003e8 R14: 00007f80a2641f60 R15: 000000000003ce2b
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555571513400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe96fb72540 CR3: 000000005aff7000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#4] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 1 UID: 0 PID: 12326 Comm: syz-executor.3 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff888057fcfe08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628f300 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888054e1a000 R08: 0000000000000001 R09: ffffed100aff9fd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888054e1a040
R13: 0000000000000010 R14: ffff8880406e2758 R15: 0000000000000000
FS:  0000555571513400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2fa2d000 CR3: 000000005a8c9000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f80a24e172b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffdd2f42430 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f80a24e172b
RDX: 00007f80a2647750 RSI: 00007f80a22a6270 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2fd2c028
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003da53
R13: 00000000000003e8 R14: 00007f80a2641f60 R15: 000000000003da38
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555571513400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2fa2d000 CR3: 000000005a8c9000 CR4: 0000000000350ef0
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#5] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 1 UID: 0 PID: 12321 Comm: syz-executor.0 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff888018ee7e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628ec40 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888054e1a380 R08: 0000000000000001 R09: ffffed10031dcfd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888054e1a3c0
R13: 0000000000000010 R14: ffff8880406e25e0 R15: 0000000000000000
FS:  0000555567468400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2fa2d000 CR3: 000000005a850000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe96faa572b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007fff8ceabf40 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007fe96faa572b
RDX: 00007fe96fc0b750 RSI: 00007fe96f86a270 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2fa2d430
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003da85
R13: 00000000000003e8 R14: 00007fe96fc05f60 R15: 000000000003da35
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555567468400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2fa2d000 CR3: 000000005a850000 CR4: 0000000000350ef0
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#6] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 UID: 0 PID: 12325 Comm: syz-executor.4 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801e437e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888055d46c40 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff88801699f6c0 R08: 0000000000000001 R09: ffffed1003c86fd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff88801699f700
R13: 0000000000000010 R14: ffff88804fe365e0 R15: 0000000000000000
FS:  0000555561b79400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555573ddcc58 CR3: 0000000059e03000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f69af18972b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffd91186df0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f69af18972b
RDX: 00007f69af2ef750 RSI: 00007f69aef4e4a0 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b3042d008
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003dab1
R13: 00000000000003e8 R14: 00007f69af2e9f60 R15: 000000000003da35
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555561b79400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555573ddcc58 CR3: 0000000059e03000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#7] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 1 UID: 0 PID: 12341 Comm: syz-executor.7 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff888058717e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888016288040 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888016d8d880 R08: 0000000000000001 R09: ffffed100b0e2fd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888016d8d8c0
R13: 0000000000000010 R14: ffff8880406cdd60 R15: 0000000000000000
FS:  000055557ddc6400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdc5b9afe8 CR3: 000000005af19000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5bd6cb872b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffe8634c7b0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f5bd6cb872b
RDX: 00007f5bd6e1e750 RSI: 00007f5bd6a7d270 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b3032d7ec
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003db74
R13: 00000000000003e8 R14: 00007f5bd6e18f60 R15: 000000000003db50
 </TASK>
Modules linked in:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#8] SMP KASAN NOPTI
---[ end trace 0000000000000000 ]---
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 UID: 0 PID: 12344 Comm: syz-executor.6 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff8880410b7e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888055d47300 RCX: ffffffff81b955d0
RDX: 0000000000000005 RSI: ffffffff81b955e2 RDI: 0000000000000028
RIP: 0010:__fput+0x1cc/0xb50
RBP: ffff888017be2e00 R08: 0000000000000001 R09: ffffed1008216fd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888017be2e40
R13: 0000000000000010 R14: ffff88804fd09490 R15: 0000000000000000
FS:  0000555573dd3400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3022d000 CR3: 000000005ae58000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
 do_syscall_64+0xbf/0x420
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7ff73f8f772b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffebc330de0 EFLAGS: 00000293
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007ff73f8f772b
RDX: 00007ff73fa5d750 RSI: 00007ff73f6bc4a0 RDI: 0000000000000008
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b3022d180
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003db93
R13: 00000000000003e8 R14: 00007ff73fa57f60 R15: 000000000003db84
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555573dd3400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3022d000 CR3: 000000005ae58000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  000055557ddc6400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdc5b9afe8 CR3: 000000005af19000 CR4: 0000000000350ef0
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#9] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 UID: 0 PID: 12340 Comm: syz-executor.1 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff8880548a7e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888055d43d00 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888016dac8c0 R08: 0000000000000001 R09: ffffed100a914fd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888016dac900
R13: 0000000000000010 R14: ffff88804fd09a70 R15: 0000000000000000
FS:  0000555562ef0400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ff2e000 CR3: 000000005a8d7000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc6381ab72b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffc0a677ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007fc6381ab72b
RDX: 00007fc638311750 RSI: 00007fc637f704a0 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2ff2e020
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003dbec
R13: 00000000000003e8 R14: 00007fc63830bf60 R15: 000000000003db68
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555562ef0400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ff2e000 CR3: 000000005a8d7000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#10] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 UID: 0 PID: 12348 Comm: syz-executor.2 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88805a397e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888016288700 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff88800f18afc0 R08: 0000000000000001 R09: ffffed100b472fd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff88800f18b000
R13: 0000000000000010 R14: ffff888009022468 R15: 0000000000000000
FS:  0000555585f31400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3012a000 CR3: 000000000f2ea000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f123d4fb72b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007fff429b6620 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f123d4fb72b
RDX: 00007f123d661750 RSI: 00007f123d2c04a0 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b3002ddbc
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003dc81
R13: 00000000000003e8 R14: 00007f123d65bf60 R15: 000000000003dc5d
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555585f31400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3012a000 CR3: 000000000f2ea000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#11] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 1 UID: 0 PID: 12350 Comm: syz-executor.5 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff888059c07e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888055d43640 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888016a34700 R08: 0000000000000001 R09: ffffed100b380fd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888016a34740
R13: 0000000000000010 R14: ffff8880406cbd60 R15: 0000000000000000
FS:  000055557d8b1400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2359909090 CR3: 000000005b1bb000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f72dbded72b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffdc5b9c160 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f72dbded72b
RDX: 00007f72dbf53750 RSI: 00007f72dbbb2270 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b3012cf2c
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003dcb0
R13: 00000000000003e8 R14: 00007f72dbf4df60 R15: 000000000003dc65
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  000055557d8b1400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2359909090 CR3: 000000005b1bb000 CR4: 0000000000350ef0
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#12] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 1 UID: 0 PID: 12357 Comm: syz-executor.0 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88805b4b7e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888040e90040 RCX: ffffffff81b955d0
RDX: 0000000000000005 RSI: ffffffff81b955e2 RDI: 0000000000000028
RBP: ffff888055c34700 R08: 0000000000000001 R09: ffffed100b696fd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055c34740
R13: 0000000000000010 R14: ffff8880406dd608 R15: 0000000000000000
FS:  0000555567468400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2fa2c000 CR3: 000000005b2fb000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe96faa572b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007fff8ceabf40 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007fe96faa572b
RDX: 00007fe96fc0b750 RSI: 00007fe96f86a270 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2fa2c144
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003e62f
R13: 00000000000003e8 R14: 00007fe96fc05f60 R15: 000000000003e619
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555567468400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2fa2c000 CR3: 000000005b2fb000 CR4: 0000000000350ef0
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#13] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 UID: 0 PID: 12358 Comm: syz-executor.3 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88805b4bfe08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888017a8f300 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888017b13180 R08: 0000000000000001 R09: ffffed100b697fd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888017b131c0
R13: 0000000000000010 R14: ffff88804fe40468 R15: 0000000000000000
FS:  0000555571513400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30424000 CR3: 000000005b30e000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f80a24e172b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffdd2f42430 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f80a24e172b
RDX: 00007f80a2647750 RSI: 00007f80a22a64a0 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2fd2dd8c
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003e637
R13: 00000000000003e8 R14: 00007f80a2641f60 R15: 000000000003e617
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555571513400(0000) GS:ffff8880e537a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30424000 CR3: 000000005b30e000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#14] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 1 UID: 0 PID: 12361 Comm: syz-executor.4 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88805b01fe08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888040e90700 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055c35880 R08: 0000000000000001 R09: ffffed100b603fd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055c358c0
R13: 0000000000000010 R14: ffff8880406dc000 R15: 0000000000000000
FS:  0000555561b79400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3042c000 CR3: 000000005afe2000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f69af18972b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffd91186df0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f69af18972b
RDX: 00007f69af2ef750 RSI: 00007f69aef4e270 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b3042c904
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003e6b8
R13: 00000000000003e8 R14: 00007f69af2e9f60 R15: 000000000003e655
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555561b79400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3042c000 CR3: 000000005afe2000 CR4: 0000000000350ef0
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#15] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 1 UID: 0 PID: 12365 Comm: syz-executor.7 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88805a65fe08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888040e90dc0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff88805590a380 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff88805590a3c0
R13: 0000000000000010 R14: ffff8880406bb8f8 R15: 0000000000000000
FS:  000055557ddc6400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3032d000 CR3: 0000000016fae000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5bd6cb872b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffe8634c7b0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f5bd6cb872b
RDX: 00007f5bd6e1e750 RSI: 00007f5bd6a7d270 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b3032d13c
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003e73a
R13: 00000000000003e8 R14: 00007f5bd6e18f60 R15: 000000000003e732
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  000055557ddc6400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3032d000 CR3: 0000000016fae000 CR4: 0000000000350ef0
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#16] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 1 UID: 0 PID: 12367 Comm: syz-executor.1 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff888054f4fe08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888040e91480 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff8880169a1500 R08: 0000000000000001 R09: ffffed100a9e9fd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff8880169a1540
R13: 0000000000000010 R14: ffff88804fcd31a0 R15: 0000000000000000
FS:  0000555562ef0400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30224000 CR3: 00000000593e8000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc6381ab72b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffc0a677ca0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007fc6381ab72b
RDX: 00007fc638311750 RSI: 00007fc637f70270 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2ff2d740
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003e7b3
R13: 00000000000003e8 R14: 00007fc63830bf60 R15: 000000000003e790
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555562ef0400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30224000 CR3: 00000000593e8000 CR4: 0000000000350ef0
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#17] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 1 UID: 0 PID: 12370 Comm: syz-executor.6 Tainted: G    B D             6.18.0-rc7-next-20251127 #1 PREEMPT(voluntary) 
Tainted: [B]=BAD_PAGE, [D]=DIE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff888059acfe08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888017a8d140 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff8880560ffa40 R08: 0000000000000001 R09: ffffed100b359fd4
R10: 0000000004000000 R11: 0000000000000000 R12: ffff8880560ffa80
R13: 0000000000000010 R14: ffff88804fe1f028 R15: 0000000000000000
FS:  0000555573dd3400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff429b4fc8 CR3: 000000005b16c000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 fput_close_sync+0x10f/0x230
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff73f8f772b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffebc330de0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007ff73f8f772b
RDX: 00007ff73fa5d750 RSI: 00007ff73f6bc270 RDI: 0000000000000008
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b3022cbc4
R10: 0000000000000c8e R11: 0000000000000293 R12: 000000000003e831
R13: 00000000000003e8 R14: 00007ff73fa57f60 R15: 000000000003e7a9
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__fput+0x1cc/0xb50
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7e 68 49 8d 7f 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 08 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffff88801cc87e08 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff88801628dec0 RCX: ffffffff81b95f1e
RDX: 0000000000000005 RSI: 0000000000000008 RDI: 0000000000000028
RBP: ffff888055561dc0 R08: 0000000000000000 R09: fffffbfff0cca14a
R10: 0000000004000000 R11: 0000000000000000 R12: ffff888055561e00
R13: 0000000000000010 R14: ffff8880190bc758 R15: 0000000000000000
FS:  0000555573dd3400(0000) GS:ffff8880e547a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff429b4fc8 CR3: 000000005b16c000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	48 89 fa             	mov    %rdi,%rdx
   3:	48 c1 ea 03          	shr    $0x3,%rdx
   7:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   b:	0f 85 f6 08 00 00    	jne    0x907
  11:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  18:	fc ff df
  1b:	4d 8b 7e 68          	mov    0x68(%r14),%r15
  1f:	49 8d 7f 28          	lea    0x28(%r15),%rdi
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 c9 08 00 00    	jne    0x8fd
  34:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  3b:	fc ff df
  3e:	49                   	rex.WB
  3f:	8b                   	.byte 0x8b