[syzbot] kernel BUG in create_default_group...

[syzbot <syzbot+4fae162886e497f72228@syzkaller.appspotmail.com>]

Hello,

syzbot found the following issue on:

HEAD commit:    58161ead29e5 Merge tag 'drm-fixes-2026-10-17' of https://g..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=103272e1580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4ccb65e03706547e
dashboard link: https://syzkaller.appspot.com/bug?extid=4fae162886e497f72228
compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=173b8121580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4fae162886e497f72228@syzkaller.appspotmail.com

Warning: Permanently added '[localhost]:19552' (ED25519) to the list of known hosts.
[*] Starting reproducer for kernel BUG in create_default_group...
[+] mkdir /sys/kernel/config successful or directory already exists.
[+] configfs mounted or already mounted.
[+] mkdir /sys/kernel/debug successful or directory already exists.
[+] debugfs mounted or already mounted.
[+] Successfully wrote 'N
' to /sys/kernel/debug/failslab/ignore-gfp-wait
[+] Successfully wrote 'N
' to /sys/kernel/debug/failslab/cache-filter
[+] Successfully wrote '-1
' to /sys/kernel/debug/failslab/times
[+] Pre-clean of /sys/kernel/config/nvmet/ports/1 successful.
[+] Online CPU count: 1
[+] Started 6 background racing helper threads.
[*] Iterating fault injection points (fail-nth 1..80 with concurrent race)...
[*] Testing fail-nth = 1 (1 attempts)...
[*] Testing fail-nth = 2 (1 attempts)...
[*] Testing fail-nth = 3 (1 attempts)...
[*] Testing fail-nth = 4 (1 attempts)...
[*] Testing fail-nth = 5 (1 attempts)...
[*] Testing fail-nth = 6 (1 attempts)...
[*] Testing fail-nth = 7 (1 attempts)...
[*] Testing fail-nth = 8 (1 attempts)...
[*] Testing fail-nth = 9 (1 attempts)...
[*] Testing fail-nth = 10 (1 attempts)...
[*] Testing fail-nth = 11 (1 attempts)...
[*] Testing fail-nth = 12 (1 attempts)...
[*] Testing fail-nth = 13 (1 attempts)...
[*] Testing fail-nth = 14 (1 attempts)...
[*] Testing fail-nth = 15 (1 attempts)...
[*] Testing fail-nth = 16 (1 attempts)...
[*] Testing fail-nth = 17 (1 attempts)...
[*] Testing fail-nth = 18 (1 attempts)...
[*] Testing fail-nth = 19 (1 attempts)...
[*] Testing fail-nth = 20 (1 attempts)...
[*] Testing fail-nth = 21 (1 attempts)...
[*] Testing fail-nth = 22 (1 attempts)...
[*] Testing fail-nth = 23 (1 attempts)...
[*] Testing fail-nth = 24 (1 attempts)...
[*] Testing fail-nth = 25 (1 attempts)...
[*] Testing fail-nth = 26 (1 attempts)...
[*] Testing fail-nth = 27 (1 attempts)...
[*] Testing fail-nth = 28 (1 attempts)...
[*] Testing fail-nth = 29 (1 attempts)...
[*] Testing fail-nth = 30 (1 attempts)...
[*] Testing fail-nth = 31 (1 attempts)...
[*] Testing fail-nth = 32 (1 attempts)...
[*] Testing fail-nth = 33 (1 attempts)...
[*] Testing fail-nth = 34 (1 attempts)...


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup