13-Apr-2026 09:34:38: starting attempt #0
13-Apr-2026 09:36:06: attempt failed: "general protection fault in fuse_dev_alloc_install"
13-Apr-2026 09:36:06: starting attempt #1
13-Apr-2026 09:37:35: attempt failed: "general protection fault in fuse_dev_alloc_install"
13-Apr-2026 09:37:35: starting attempt #2
13-Apr-2026 09:39:02: attempt failed: "general protection fault in fuse_dev_alloc_install"
13-Apr-2026 09:39:02: report:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000046: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000230-0x0000000000000237]
CPU: 1 UID: 0 PID: 5887 Comm: syz.1.40 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:fuse_dev_alloc_install+0x39/0x80
Code: e8 bc f8 ff ff 48 89 c3 48 85 c0 74 47 e8 8f 2a 7f fe 49 8d be 30 02 00 00 48 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 05 e8 3c 75 e9 fe 49 8b 96 30 02 00 00 49 c7 86 30
RSP: 0018:ffffc90004b5f710 EFLAGS: 00010202
RAX: 0000000000000046 RBX: ffff88816f333900 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffffffff8dfd4824 RDI: 0000000000000230
RBP: ffff88816fd33590 R08: ffffffff90333df7 R09: 1ffffffff20667be
R10: dffffc0000000000 R11: fffffbfff20667bf R12: ffff8881768fb840
R13: ffff8881768fb810 R14: 0000000000000000 R15: ffff8881768fb800
FS: 000055556f92b500(0000) GS:ffff8882a9221000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f47d252ba40 CR3: 000000011266a000 CR4: 00000000000006f0
Call Trace:
cuse_channel_open+0x107/0x7c0
misc_open+0x2d5/0x350
chrdev_open+0x4cd/0x5e0
do_dentry_open+0x785/0x14e0
vfs_open+0x3b/0x340
path_openat+0x2e08/0x3860
do_file_open+0x23e/0x4a0
do_sys_openat2+0x113/0x200
__x64_sys_openat+0x138/0x170
do_syscall_64+0x15f/0xf80
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f47d259c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff033e1c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f47d2815fa0 RCX: 00007f47d259c819
RDX: 0000000000000002 RSI: 0000200000000040 RDI: ffffffffffffff9c
RBP: 00007f47d2632c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f47d2815fac R14: 00007f47d2815fa0 R15: 00007f47d2815fa0
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:fuse_dev_alloc_install+0x39/0x80
Code: e8 bc f8 ff ff 48 89 c3 48 85 c0 74 47 e8 8f 2a 7f fe 49 8d be 30 02 00 00 48 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 05 e8 3c 75 e9 fe 49 8b 96 30 02 00 00 49 c7 86 30
RSP: 0018:ffffc90004b5f710 EFLAGS: 00010202
RAX: 0000000000000046 RBX: ffff88816f333900 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffffffff8dfd4824 RDI: 0000000000000230
RBP: ffff88816fd33590 R08: ffffffff90333df7 R09: 1ffffffff20667be
R10: dffffc0000000000 R11: fffffbfff20667bf R12: ffff8881768fb840
R13: ffff8881768fb810 R14: 0000000000000000 R15: ffff8881768fb800
FS: 000055556f92b500(0000) GS:ffff8882a9221000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561fc2312388 CR3: 000000011266a000 CR4: 00000000000006f0
13-Apr-2026 09:39:02: output:
last executing test programs:
310.882054ms ago: executing program 2 (id=3):
memfd_create(&(0x7f0000000000), 0x0)
73.172883ms ago: executing program 1 (id=19):
setpriority(0x0, 0x0, 0x0)
73.058254ms ago: executing program 2 (id=20):
getpeername(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000))
72.721149ms ago: executing program 0 (id=21):
mmap(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
72.599459ms ago: executing program 1 (id=22):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/keychord', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/keychord', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/keychord', 0x800, 0x0)
72.396343ms ago: executing program 2 (id=23):
getsockname(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000))
70.955437ms ago: executing program 0 (id=24):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video0', 0x2, 0x0)
68.309034ms ago: executing program 1 (id=25):
recvfrom(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0)
68.16398ms ago: executing program 2 (id=26):
clone(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000))
exit(0x0)
4.564926ms ago: executing program 0 (id=27):
seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000000))
4.221515ms ago: executing program 2 (id=28):
getrlimit(0x0, &(0x7f0000000000))
4.120117ms ago: executing program 1 (id=29):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/damon/init_regions', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/damon/init_regions', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/damon/init_regions', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/damon/init_regions', 0x800, 0x0)
4.037554ms ago: executing program 0 (id=30):
semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000000))
3.813909ms ago: executing program 1 (id=31):
socket$inet(0x2, 0x1, 0x0)
3.61357ms ago: executing program 0 (id=32):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/raw-gadget', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/raw-gadget', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/raw-gadget', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/raw-gadget', 0x800, 0x0)
268.696µs ago: executing program 0 (id=33):
syslog(0x0, 0x0, 0x0)
107.669µs ago: executing program 1 (id=34):
rt_sigaction(0x0, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000))
0s ago: executing program 2 (id=35):
socket$packet(0x11, 0x2, 0x300)
0s ago: executing program 1 (id=40):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse', 0x2, 0x0)
kernel console output (not intermixed with test programs):
Warning: Permanently added '[localhost]:9178' (ED25519) to the list of known hosts.
syzkaller login: [ 63.297728][ T5826] cgroup: Unknown subsys name 'net'
[ 63.399486][ T5826] cgroup: Unknown subsys name 'cpuset'
[ 63.403747][ T5826] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 65.431697][ T5826] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 70.958173][ T5887] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000046: 0000 [#1] SMP KASAN PTI
[ 70.961578][ T5887] KASAN: null-ptr-deref in range [0x0000000000000230-0x0000000000000237]
[ 70.964189][ T5887] CPU: 1 UID: 0 PID: 5887 Comm: syz.1.40 Not tainted syzkaller #0 PREEMPT(full)
[ 70.966829][ T5887] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 70.969791][ T5887] RIP: 0010:fuse_dev_alloc_install+0x39/0x80
[ 70.971528][ T5887] Code: e8 bc f8 ff ff 48 89 c3 48 85 c0 74 47 e8 8f 2a 7f fe 49 8d be 30 02 00 00 48 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 05 e8 3c 75 e9 fe 49 8b 96 30 02 00 00 49 c7 86 30
[ 70.977420][ T5887] RSP: 0018:ffffc90004b5f710 EFLAGS: 00010202
[ 70.979648][ T5887] RAX: 0000000000000046 RBX: ffff88816f333900 RCX: dffffc0000000000
[ 70.982439][ T5887] RDX: 0000000000000000 RSI: ffffffff8dfd4824 RDI: 0000000000000230
[ 70.984689][ T5887] RBP: ffff88816fd33590 R08: ffffffff90333df7 R09: 1ffffffff20667be
[ 70.986992][ T5887] R10: dffffc0000000000 R11: fffffbfff20667bf R12: ffff8881768fb840
[ 70.989807][ T5887] R13: ffff8881768fb810 R14: 0000000000000000 R15: ffff8881768fb800
[ 70.992713][ T5887] FS: 000055556f92b500(0000) GS:ffff8882a9221000(0000) knlGS:0000000000000000
[ 70.995747][ T5887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 70.998125][ T5887] CR2: 00007f47d252ba40 CR3: 000000011266a000 CR4: 00000000000006f0
[ 71.000788][ T5887] Call Trace:
[ 71.001962][ T5887]
[ 71.002865][ T5887] cuse_channel_open+0x107/0x7c0
[ 71.004416][ T5887] ? __pfx_cuse_channel_open+0x10/0x10
[ 71.006411][ T5887] misc_open+0x2d5/0x350
[ 71.007938][ T5887] chrdev_open+0x4cd/0x5e0
[ 71.009558][ T5887] ? __pfx_chrdev_open+0x10/0x10
[ 71.011438][ T5887] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0
[ 71.013895][ T5887] ? __pfx_chrdev_open+0x10/0x10
[ 71.015612][ T5887] do_dentry_open+0x785/0x14e0
[ 71.017110][ T5887] vfs_open+0x3b/0x340
[ 71.018298][ T5887] ? path_openat+0x2df0/0x3860
[ 71.019941][ T5887] path_openat+0x2e08/0x3860
[ 71.021655][ T5887] ? __pfx_stack_trace_save+0x10/0x10
[ 71.023303][ T5887] ? stack_depot_save_flags+0x33/0x810
[ 71.024881][ T5887] ? __pfx_path_openat+0x10/0x10
[ 71.026361][ T5887] ? __x64_sys_openat+0x138/0x170
[ 71.027907][ T5887] ? __lock_acquire+0x6b5/0x2cf0
[ 71.029368][ T5887] do_file_open+0x23e/0x4a0
[ 71.030705][ T5887] ? __pfx_do_file_open+0x10/0x10
[ 71.032176][ T5887] ? _raw_spin_unlock+0x28/0x50
[ 71.033676][ T5887] ? alloc_fd+0x64b/0x6c0
[ 71.035294][ T5887] do_sys_openat2+0x113/0x200
[ 71.037011][ T5887] ? __pfx_do_sys_openat2+0x10/0x10
[ 71.038515][ T5887] ? exc_page_fault+0x6a/0xc0
[ 71.039892][ T5887] ? do_user_addr_fault+0xc6f/0x1340
[ 71.041420][ T5887] __x64_sys_openat+0x138/0x170
[ 71.042961][ T5887] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.044972][ T5887] do_syscall_64+0x15f/0xf80
[ 71.046503][ T5887] ? trace_irq_disable+0x3b/0x140
[ 71.048320][ T5887] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 71.050609][ T5887] RIP: 0033:0x7f47d259c819
[ 71.052291][ T5887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 71.058918][ T5887] RSP: 002b:00007fff033e1c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 71.061682][ T5887] RAX: ffffffffffffffda RBX: 00007f47d2815fa0 RCX: 00007f47d259c819
[ 71.064555][ T5887] RDX: 0000000000000002 RSI: 0000200000000040 RDI: ffffffffffffff9c
[ 71.067509][ T5887] RBP: 00007f47d2632c91 R08: 0000000000000000 R09: 0000000000000000
[ 71.070303][ T5887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 71.073184][ T5887] R13: 00007f47d2815fac R14: 00007f47d2815fa0 R15: 00007f47d2815fa0
[ 71.075439][ T5887]
[ 71.076327][ T5887] Modules linked in:
[ 71.077691][ T5887] ---[ end trace 0000000000000000 ]---
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 71.118816][ T5887] RIP: 0010:fuse_dev_alloc_install+0x39/0x80
[ 71.121132][ T5887] Code: e8 bc f8 ff ff 48 89 c3 48 85 c0 74 47 e8 8f 2a 7f fe 49 8d be 30 02 00 00 48 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 05 e8 3c 75 e9 fe 49 8b 96 30 02 00 00 49 c7 86 30
[ 71.128351][ T5887] RSP: 0018:ffffc90004b5f710 EFLAGS: 00010202
[ 71.130567][ T5887] RAX: 0000000000000046 RBX: ffff88816f333900 RCX: dffffc0000000000
[ 71.133523][ T5887] RDX: 0000000000000000 RSI: ffffffff8dfd4824 RDI: 0000000000000230
[ 71.136143][ T5887] RBP: ffff88816fd33590 R08: ffffffff90333df7 R09: 1ffffffff20667be
[ 71.147104][ T5887] R10: dffffc0000000000 R11: fffffbfff20667bf R12: ffff8881768fb840
[ 71.149997][ T5887] R13: ffff8881768fb810 R14: 0000000000000000 R15: ffff8881768fb800
[ 71.152915][ T5887] FS: 000055556f92b500(0000) GS:ffff8882a9221000(0000) knlGS:0000000000000000
[ 71.156307][ T5887] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 71.159065][ T5887] CR2: 0000561fc2312388 CR3: 000000011266a000 CR4: 00000000000006f0
[ 71.161728][ T5887] Kernel panic - not syncing: Fatal exception
[ 71.164203][ T5887] Kernel Offset: disabled
[ 71.165856][ T5887] Rebooting in 86400 seconds..