Warning: Permanently added '[localhost]:21993' (ECDSA) to the list of known hosts.
2025/09/01 08:22:55 fuzzer started
2025/09/01 08:22:56 dialing manager at localhost:35473
syzkaller login: [ 51.190741] cgroup: Unknown subsys name 'net'
[ 51.262042] cgroup: Unknown subsys name 'cpuset'
[ 51.280015] cgroup: Unknown subsys name 'rlimit'
2025/09/01 08:23:07 syscalls: 2214
2025/09/01 08:23:07 code coverage: enabled
2025/09/01 08:23:07 comparison tracing: enabled
2025/09/01 08:23:07 extra coverage: enabled
2025/09/01 08:23:07 setuid sandbox: enabled
2025/09/01 08:23:07 namespace sandbox: enabled
2025/09/01 08:23:07 Android sandbox: enabled
2025/09/01 08:23:07 fault injection: enabled
2025/09/01 08:23:07 leak checking: enabled
2025/09/01 08:23:07 net packet injection: enabled
2025/09/01 08:23:07 net device setup: enabled
2025/09/01 08:23:07 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2025/09/01 08:23:07 devlink PCI setup: PCI device 0000:00:10.0 is not available
2025/09/01 08:23:07 USB emulation: enabled
2025/09/01 08:23:07 hci packet injection: enabled
2025/09/01 08:23:07 wifi device emulation: enabled
2025/09/01 08:23:07 802.15.4 emulation: enabled
2025/09/01 08:23:07 fetching corpus: 0, signal 0/2000 (executing program)
2025/09/01 08:23:07 fetching corpus: 36, signal 14940/18347 (executing program)
2025/09/01 08:23:07 fetching corpus: 86, signal 36624/40405 (executing program)
2025/09/01 08:23:07 fetching corpus: 136, signal 49089/53159 (executing program)
2025/09/01 08:23:07 fetching corpus: 186, signal 53629/58242 (executing program)
2025/09/01 08:23:07 fetching corpus: 236, signal 57702/62778 (executing program)
2025/09/01 08:23:08 fetching corpus: 286, signal 61686/67026 (executing program)
2025/09/01 08:23:08 fetching corpus: 336, signal 64209/69875 (executing program)
2025/09/01 08:23:08 fetching corpus: 386, signal 67325/73152 (executing program)
2025/09/01 08:23:08 fetching corpus: 436, signal 71061/76819 (executing program)
2025/09/01 08:23:08 fetching corpus: 486, signal 73751/79446 (executing program)
2025/09/01 08:23:08 fetching corpus: 536, signal 77008/82431 (executing program)
2025/09/01 08:23:08 fetching corpus: 586, signal 81275/86046 (executing program)
2025/09/01 08:23:09 fetching corpus: 636, signal 83930/88324 (executing program)
2025/09/01 08:23:09 fetching corpus: 686, signal 88013/91482 (executing program)
2025/09/01 08:23:09 fetching corpus: 736, signal 89390/92650 (executing program)
2025/09/01 08:23:09 fetching corpus: 786, signal 91301/94074 (executing program)
2025/09/01 08:23:09 fetching corpus: 836, signal 93157/95446 (executing program)
2025/09/01 08:23:09 fetching corpus: 886, signal 94879/96607 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/96920 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/97014 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/97092 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/97183 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/97270 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/97352 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/97424 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/97507 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/97593 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/97659 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/97735 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/97823 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/97909 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/97999 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/98071 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/98135 (executing program)
2025/09/01 08:23:09 fetching corpus: 898, signal 95216/98213 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/98291 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/98357 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/98451 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/98531 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/98634 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/98708 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/98777 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/98839 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/98910 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/98968 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/99055 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/99126 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/99219 (executing program)
2025/09/01 08:23:10 fetching corpus: 898, signal 95216/99219 (executing program)
2025/09/01 08:23:12 starting 8 fuzzer processes
08:23:12 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x105000, 0x0)
pkey_mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0xffffffffffffffff)
read(r0, &(0x7f0000000000), 0x2000)
08:23:12 executing program 7:
timer_create(0x2, 0x0, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
timer_delete(0x0)
08:23:12 executing program 1:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
r1 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
pwritev(r1, &(0x7f00000001c0)=[{&(0x7f0000000080)="5c36abe9", 0x4}], 0x1, 0x5, 0x0)
fallocate(r0, 0x10, 0x0, 0x9)
08:23:12 executing program 2:
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000700), 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000740)={{0x0, 0x1f}})
08:23:12 executing program 3:
syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000440)=[{&(0x7f0000010000)="014344303031", 0x6, 0x8000}], 0x0, &(0x7f0000000400))
08:23:12 executing program 4:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @broadcast}, {0x2, 0x0, @private}, 0x106})
08:23:12 executing program 5:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = shmget$private(0x0, 0x5000, 0x1800, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
[ 66.903389] audit: type=1400 audit(1756714992.411:7): avc: denied { execmem } for pid=273 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
08:23:12 executing program 6:
set_mempolicy(0x5, &(0x7f0000000040)=0x40205, 0x6)
fork()
[ 68.077930] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 68.080567] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 68.084437] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 68.090620] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 68.094032] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 68.151785] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 68.159174] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 68.162082] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 68.167286] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 68.168667] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 68.171754] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 68.173685] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 68.176392] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 68.179081] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 68.181267] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 68.199853] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 68.201583] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 68.205475] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 68.210701] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 68.219537] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 68.241363] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 68.248005] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[ 68.253369] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 68.253453] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[ 68.256824] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 68.259989] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 68.261820] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 68.275743] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[ 68.281682] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[ 68.283720] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[ 68.285830] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[ 68.287546] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[ 68.288904] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[ 68.290857] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[ 68.293516] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[ 68.294719] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[ 68.338768] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[ 68.339648] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[ 68.354438] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[ 68.354536] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[ 70.170256] Bluetooth: hci0: command tx timeout
[ 70.232364] Bluetooth: hci1: command tx timeout
[ 70.297341] Bluetooth: hci3: command tx timeout
[ 70.297563] Bluetooth: hci2: command tx timeout
[ 70.361170] Bluetooth: hci5: command tx timeout
[ 70.361209] Bluetooth: hci4: command tx timeout
[ 70.424383] Bluetooth: hci6: command tx timeout
[ 70.424787] Bluetooth: hci7: command tx timeout
[ 72.216229] Bluetooth: hci0: command tx timeout
[ 72.280169] Bluetooth: hci1: command tx timeout
[ 72.344221] Bluetooth: hci2: command tx timeout
[ 72.344484] Bluetooth: hci3: command tx timeout
[ 72.409192] Bluetooth: hci5: command tx timeout
[ 72.409212] Bluetooth: hci4: command tx timeout
[ 72.472165] Bluetooth: hci7: command tx timeout
[ 72.472315] Bluetooth: hci6: command tx timeout
[ 74.266235] Bluetooth: hci0: command tx timeout
[ 74.331141] Bluetooth: hci1: command tx timeout
[ 74.392183] Bluetooth: hci3: command tx timeout
[ 74.392221] Bluetooth: hci2: command tx timeout
[ 74.456294] Bluetooth: hci5: command tx timeout
[ 74.456751] Bluetooth: hci4: command tx timeout
[ 74.520198] Bluetooth: hci6: command tx timeout
[ 74.521180] Bluetooth: hci7: command tx timeout
[ 76.313258] Bluetooth: hci0: command tx timeout
[ 76.376307] Bluetooth: hci1: command tx timeout
[ 76.440187] Bluetooth: hci3: command tx timeout
[ 76.441196] Bluetooth: hci2: command tx timeout
[ 76.504289] Bluetooth: hci4: command tx timeout
[ 76.504315] Bluetooth: hci5: command tx timeout
[ 76.568189] Bluetooth: hci7: command tx timeout
[ 76.568198] Bluetooth: hci6: command tx timeout
[ 105.863536] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.864333] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.084442] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.085076] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.267051] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.267703] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.436671] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.437429] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:23:52 executing program 7:
timer_create(0x2, 0x0, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
timer_delete(0x0)
08:23:52 executing program 7:
timer_create(0x2, 0x0, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
timer_delete(0x0)
08:23:52 executing program 7:
timer_create(0x2, 0x0, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
timer_delete(0x0)
[ 106.751344] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.751952] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:23:52 executing program 7:
timer_create(0x2, 0x0, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
timer_delete(0x0)
[ 106.925807] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.926453] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.959822] loop3: detected capacity change from 0 to 128
[ 107.026733] isofs_fill_super: bread failed, dev=loop3, iso_blknum=32, block=64
08:23:52 executing program 7:
timer_create(0x2, 0x0, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
timer_delete(0x0)
[ 107.072015] loop3: detected capacity change from 0 to 128
[ 107.104507] isofs_fill_super: bread failed, dev=loop3, iso_blknum=32, block=64
[ 107.106854] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 107.107456] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 107.191690] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 107.192351] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:23:52 executing program 3:
syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000440)=[{&(0x7f0000010000)="014344303031", 0x6, 0x8000}], 0x0, &(0x7f0000000400))
08:23:52 executing program 7:
timer_create(0x2, 0x0, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
timer_delete(0x0)
[ 107.319621] loop3: detected capacity change from 0 to 128
[ 107.345912] isofs_fill_super: bread failed, dev=loop3, iso_blknum=32, block=64
08:23:52 executing program 7:
timer_create(0x2, 0x0, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
timer_delete(0x0)
[ 107.586240] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 107.586887] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 107.670593] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 107.671254] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 107.761789] audit: type=1400 audit(1756715033.270:8): avc: denied { open } for pid=3871 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[ 107.778952] audit: type=1400 audit(1756715033.271:9): avc: denied { kernel } for pid=3871 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[ 108.021410] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.022594] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.119194] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.120521] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.146386] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.147010] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.220024] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.221264] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.330287] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.330923] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.350008] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.350710] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:23:54 executing program 3:
syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000440)=[{&(0x7f0000010000)="014344303031", 0x6, 0x8000}], 0x0, &(0x7f0000000400))
08:23:54 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x105000, 0x0)
pkey_mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0xffffffffffffffff)
read(r0, &(0x7f0000000000), 0x2000)
08:23:54 executing program 5:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = shmget$private(0x0, 0x5000, 0x1800, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
08:23:54 executing program 1:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
r1 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
pwritev(r1, &(0x7f00000001c0)=[{&(0x7f0000000080)="5c36abe9", 0x4}], 0x1, 0x5, 0x0)
fallocate(r0, 0x10, 0x0, 0x9)
08:23:54 executing program 7:
timer_create(0x2, 0x0, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
timer_delete(0x0)
08:23:54 executing program 4:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @broadcast}, {0x2, 0x0, @private}, 0x106})
08:23:54 executing program 6:
set_mempolicy(0x5, &(0x7f0000000040)=0x40205, 0x6)
fork()
08:23:54 executing program 2:
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000700), 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000740)={{0x0, 0x1f}})
[ 108.661565] loop3: detected capacity change from 0 to 128
08:23:54 executing program 2:
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000700), 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000740)={{0x0, 0x1f}})
[ 108.698619] isofs_fill_super: bread failed, dev=loop3, iso_blknum=32, block=64
08:23:54 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x105000, 0x0)
pkey_mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0xffffffffffffffff)
read(r0, &(0x7f0000000000), 0x2000)
08:23:54 executing program 6:
set_mempolicy(0x5, &(0x7f0000000040)=0x40205, 0x6)
fork()
08:23:54 executing program 7:
timer_create(0x2, 0x0, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x3938700}, {0x77359400}}, 0x0)
timer_delete(0x0)
08:23:54 executing program 4:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @broadcast}, {0x2, 0x0, @private}, 0x106})
08:23:54 executing program 5:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = shmget$private(0x0, 0x5000, 0x1800, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
08:23:54 executing program 2:
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000700), 0x0)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000740)={{0x0, 0x1f}})
08:23:54 executing program 3:
syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000440)=[{&(0x7f0000010000)="014344303031", 0x6, 0x8000}], 0x0, &(0x7f0000000400))
08:23:54 executing program 1:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
r1 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
pwritev(r1, &(0x7f00000001c0)=[{&(0x7f0000000080)="5c36abe9", 0x4}], 0x1, 0x5, 0x0)
fallocate(r0, 0x10, 0x0, 0x9)
08:23:54 executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x105000, 0x0)
pkey_mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0xffffffffffffffff)
read(r0, &(0x7f0000000000), 0x2000)
08:23:54 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x105000, 0x0)
pkey_mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0xffffffffffffffff)
read(r0, &(0x7f0000000000), 0x2000)
08:23:54 executing program 6:
set_mempolicy(0x5, &(0x7f0000000040)=0x40205, 0x6)
fork()
08:23:54 executing program 5:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = shmget$private(0x0, 0x5000, 0x1800, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
08:23:54 executing program 4:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @broadcast}, {0x2, 0x0, @private}, 0x106})
08:23:54 executing program 7:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = shmget$private(0x0, 0x5000, 0x1800, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
08:23:54 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x105000, 0x0)
pkey_mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0xffffffffffffffff)
read(r0, &(0x7f0000000000), 0x2000)
[ 109.062568] loop3: detected capacity change from 0 to 128
[ 109.085299] isofs_fill_super: bread failed, dev=loop3, iso_blknum=32, block=64
[ 109.088114] kmemleak: Found object by alias at 0x607f1a63df5c
[ 109.088130] CPU: 1 UID: 0 PID: 3949 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 109.088150] Tainted: [W]=WARN
[ 109.088154] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 109.088163] Call Trace:
[ 109.088168]
[ 109.088173] dump_stack_lvl+0xca/0x120
[ 109.088206] __lookup_object+0x94/0xb0
[ 109.088224] delete_object_full+0x27/0x70
[ 109.088241] free_percpu+0x30/0x1160
[ 109.088262] futex_hash_free+0x38/0xc0
[ 109.088278] mmput+0x2d3/0x390
[ 109.088301] do_exit+0x79d/0x2970
[ 109.088317] ? lock_release+0xc8/0x290
[ 109.088334] ? __pfx_do_exit+0x10/0x10
[ 109.088349] ? find_held_lock+0x2b/0x80
[ 109.088366] ? get_signal+0x835/0x2340
[ 109.088387] do_group_exit+0xd3/0x2a0
[ 109.088402] get_signal+0x2315/0x2340
[ 109.088425] ? __pfx_get_signal+0x10/0x10
[ 109.088442] ? do_futex+0x135/0x370
[ 109.088456] ? __pfx_do_futex+0x10/0x10
[ 109.088471] arch_do_signal_or_restart+0x80/0x790
[ 109.088490] ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 109.088507] ? __x64_sys_futex+0x1c9/0x4d0
[ 109.088519] ? __x64_sys_futex+0x1d2/0x4d0
[ 109.088535] ? __pfx___x64_sys_futex+0x10/0x10
[ 109.088549] ? xfd_validate_state+0x55/0x180
[ 109.088570] exit_to_user_mode_loop+0x8b/0x110
[ 109.088584] do_syscall_64+0x2f7/0x360
[ 109.088598] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.088610] RIP: 0033:0x7fa958138b19
[ 109.088619] Code: Unable to access opcode bytes at 0x7fa958138aef.
[ 109.088625] RSP: 002b:00007fa9556ae218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 109.088637] RAX: fffffffffffffe00 RBX: 00007fa95824bf68 RCX: 00007fa958138b19
[ 109.088645] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa95824bf68
[ 109.088653] RBP: 00007fa95824bf60 R08: 0000000000000000 R09: 0000000000000000
[ 109.088660] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa95824bf6c
[ 109.088667] R13: 00007ffd0fec445f R14: 00007fa9556ae300 R15: 0000000000022000
[ 109.088683]
[ 109.088687] kmemleak: Object (percpu) 0x607f1a63df58 (size 8):
[ 109.088694] kmemleak: comm "syz-executor.1", pid 3954, jiffies 4294775657
[ 109.088701] kmemleak: min_count = 1
[ 109.088706] kmemleak: count = 0
[ 109.088709] kmemleak: flags = 0x21
[ 109.088713] kmemleak: checksum = 0
[ 109.088717] kmemleak: backtrace:
[ 109.088721] pcpu_alloc_noprof+0x87a/0x1170
[ 109.088737] perf_trace_event_init+0x366/0xa10
[ 109.088751] perf_trace_init+0x1a4/0x2f0
[ 109.088764] perf_tp_event_init+0xa6/0x120
[ 109.088780] perf_try_init_event+0x140/0x9f0
[ 109.088794] perf_event_alloc.part.0+0x118e/0x45f0
[ 109.088812] __do_sys_perf_event_open+0x719/0x2c20
[ 109.088825] do_syscall_64+0xbf/0x360
[ 109.088835] entry_SYSCALL_64_after_hwframe+0x77/0x7f
08:23:54 executing program 7:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = shmget$private(0x0, 0x5000, 0x1800, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
08:23:54 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x105000, 0x0)
pkey_mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0xffffffffffffffff)
read(r0, &(0x7f0000000000), 0x2000)
08:23:54 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = shmget$private(0x0, 0x5000, 0x1800, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
08:23:54 executing program 5:
syz_mount_image$ext4(&(0x7f0000002580)='ext2\x00', &(0x7f00000025c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={[{@journal_path={'journal_path', 0x2c, './file0'}}]})
08:23:54 executing program 0:
socketpair(0xa, 0x3, 0xff, &(0x7f0000000380))
08:23:54 executing program 4:
perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_io_uring_setup(0x3a2d, &(0x7f0000000480), &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000280), &(0x7f0000000340))
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000300), 0x500)
[ 109.265834] journal_path: not usable as path
[ 109.266314] EXT4-fs: error: could not find journal device path
[ 109.270978] journal_path: not usable as path
[ 109.271486] EXT4-fs: error: could not find journal device path
08:23:54 executing program 1:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
r1 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
pwritev(r1, &(0x7f00000001c0)=[{&(0x7f0000000080)="5c36abe9", 0x4}], 0x1, 0x5, 0x0)
fallocate(r0, 0x10, 0x0, 0x9)
08:23:54 executing program 0:
socketpair(0xa, 0x3, 0xff, &(0x7f0000000380))
08:23:54 executing program 5:
syz_mount_image$ext4(&(0x7f0000002580)='ext2\x00', &(0x7f00000025c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={[{@journal_path={'journal_path', 0x2c, './file0'}}]})
08:23:54 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = shmget$private(0x0, 0x5000, 0x1800, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
08:23:54 executing program 4:
perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_io_uring_setup(0x3a2d, &(0x7f0000000480), &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000280), &(0x7f0000000340))
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000300), 0x500)
08:23:54 executing program 7:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = shmget$private(0x0, 0x5000, 0x1800, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
08:23:54 executing program 3:
fsopen(&(0x7f0000000000)='tracefs\x00', 0x0)
[ 109.380349] journal_path: not usable as path
[ 109.380764] EXT4-fs: error: could not find journal device path
08:23:54 executing program 2:
perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_io_uring_setup(0x3a2d, &(0x7f0000000480), &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000280), &(0x7f0000000340))
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000300), 0x500)
08:23:55 executing program 5:
syz_mount_image$ext4(&(0x7f0000002580)='ext2\x00', &(0x7f00000025c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={[{@journal_path={'journal_path', 0x2c, './file0'}}]})
08:23:55 executing program 4:
perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_io_uring_setup(0x3a2d, &(0x7f0000000480), &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000280), &(0x7f0000000340))
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000300), 0x500)
08:23:55 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = shmget$private(0x0, 0x5000, 0x1800, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
shmat(r0, &(0x7f0000400000/0xc00000)=nil, 0x5000)
08:23:55 executing program 2:
perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_io_uring_setup(0x3a2d, &(0x7f0000000480), &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000280), &(0x7f0000000340))
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000300), 0x500)
08:23:55 executing program 3:
fsopen(&(0x7f0000000000)='tracefs\x00', 0x0)
08:23:55 executing program 0:
socketpair(0xa, 0x3, 0xff, &(0x7f0000000380))
08:23:55 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x6, 0x5, 0x0, &(0x7f00000018c0))
08:23:55 executing program 4:
perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_io_uring_setup(0x3a2d, &(0x7f0000000480), &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000280), &(0x7f0000000340))
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000300), 0x500)
[ 109.618857] journal_path: not usable as path
[ 109.619407] EXT4-fs: error: could not find journal device path
08:23:55 executing program 0:
socketpair(0xa, 0x3, 0xff, &(0x7f0000000380))
08:23:55 executing program 7:
r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000300)={{r0}})
08:23:55 executing program 6:
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f00000000c0)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x0, 0x2a, 0x0, "6c7abb3e9a9a691096b5eb47d00faa3f87c4977f0e265c767bc4efcf846530ace2b9d3f684a50d0b1e7c136a28dfcd2b470e6904d7208e05d688f255b9df442a8090a173937522cbeb7c2948aede5252"}, 0xd8)
setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080), 0x4)
08:23:55 executing program 5:
syz_mount_image$ext4(&(0x7f0000002580)='ext2\x00', &(0x7f00000025c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={[{@journal_path={'journal_path', 0x2c, './file0'}}]})
08:23:55 executing program 2:
perf_event_open(&(0x7f0000000340)={0x0, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_io_uring_setup(0x3a2d, &(0x7f0000000480), &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000280), &(0x7f0000000340))
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000300), 0x500)
08:23:55 executing program 3:
fsopen(&(0x7f0000000000)='tracefs\x00', 0x0)
08:23:55 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x6, 0x5, 0x0, &(0x7f00000018c0))
[ 109.751980] journal_path: not usable as path
[ 109.752469] EXT4-fs: error: could not find journal device path
08:23:55 executing program 0:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$sock_int(r0, 0x1, 0x8, 0x0, &(0x7f0000000180))
08:23:55 executing program 7:
r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000300)={{r0}})
08:23:55 executing program 4:
perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0xf1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
creat(0x0, 0x0)
creat(&(0x7f0000000040)='./file0\x00', 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/block/loop2', 0x200000, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={@private2, @mcast1, @loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000a})
read(r0, &(0x7f00000001c0)=""/82, 0x52)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000080)={@private1, @mcast1, @loopback, 0x0, 0x4, 0x0, 0x0, 0x2, 0x10020a})
pwrite64(r1, &(0x7f0000000080)="76a33869282b70c9625915000bbce941335179c2192b6511e3893b73612ddbdb6d444766ef6a7b4ff0c612b6c5b34c625f496a6a6146bec9a2263034c991d39d1bf82190b584", 0x46, 0x8)
readahead(0xffffffffffffffff, 0x0, 0x0)
readahead(0xffffffffffffffff, 0x0, 0x3ff)
r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000002200), 0x0, 0x0)
r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3)
[ 109.822029] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#1] SMP KASAN NOPTI
[ 109.823293] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[ 109.824250] CPU: 0 UID: 0 PID: 4017 Comm: syz-executor.3 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 109.829278] Tainted: [W]=WARN
[ 109.829635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 109.830521] RIP: 0010:perf_tp_event+0x175/0xe70
[ 109.831047] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 109.833014] RSP: 0018:ffff8880453f7780 EFLAGS: 00010012
[ 109.833602] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc900019fa000
[ 109.834376] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000100000190
[ 109.835145] RBP: ffff8880453f79f0 R08: ffff88806ce31340 R09: ffffe8ffffc15f40
[ 109.835920] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 109.836689] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000
[ 109.837472] FS: 00007fb4f4afd700(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[ 109.838338] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 109.838973] CR2: 00007ffe83542e58 CR3: 0000000043513000 CR4: 0000000000350ef0
[ 109.839747] Call Trace:
[ 109.840034]
[ 109.840284] ? lock_acquire+0x15e/0x2f0
[ 109.840722] ? __is_insn_slot_addr+0x2e/0x290
[ 109.841223] ? __pfx_perf_tp_event+0x10/0x10
[ 109.841717] ? __is_insn_slot_addr+0x140/0x290
[ 109.842227] ? kernel_text_address+0x5b/0xc0
[ 109.842715] ? __kernel_text_address+0xd/0x40
[ 109.843211] ? unwind_get_return_address+0x59/0xa0
[ 109.843762] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 109.844358] ? arch_stack_walk+0x9c/0xf0
[ 109.844811] ? __lock_acquire+0x694/0x1b70
[ 109.845273] ? css_rstat_updated+0x1b8/0x4d0
[ 109.845783] ? __pfx_css_rstat_updated+0x10/0x10
[ 109.846304] ? lock_is_held_type+0x9e/0x120
[ 109.846783] ? perf_trace_run_bpf_submit+0xef/0x180
[ 109.847329] ? lock_is_held_type+0x9e/0x120
[ 109.847803] perf_trace_run_bpf_submit+0xef/0x180
[ 109.848335] perf_trace_preemptirq_template+0x259/0x430
[ 109.848911] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 109.849557] ? check_preempt_wakeup_fair+0x406/0x950
[ 109.850111] ? find_held_lock+0x2b/0x80
[ 109.850551] ? try_to_wake_up+0x8ae/0x11d0
[ 109.851034] ? _raw_spin_unlock_irqrestore+0x2c/0x50
[ 109.851596] trace_irq_enable.constprop.0+0xa6/0x100
[ 109.852144] trace_hardirqs_on+0x26/0x40
[ 109.852584] _raw_spin_unlock_irqrestore+0x2c/0x50
[ 109.853121] try_to_wake_up+0x8ae/0x11d0
[ 109.853576] ? __pfx_try_to_wake_up+0x10/0x10
[ 109.854068] ? plist_del+0x122/0x270
[ 109.854475] ? find_held_lock+0x2b/0x80
[ 109.854912] ? futex_wake+0x474/0x540
[ 109.855330] wake_up_q+0xa1/0x130
[ 109.855717] futex_wake+0x47e/0x540
[ 109.856118] ? __pfx_futex_wake+0x10/0x10
[ 109.856572] do_futex+0x26d/0x370
[ 109.856957] ? __pfx_do_futex+0x10/0x10
[ 109.857399] ? lock_acquire+0x15e/0x2f0
[ 109.857841] __x64_sys_futex+0x1c9/0x4d0
[ 109.858285] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 109.858909] ? __pfx___x64_sys_futex+0x10/0x10
[ 109.859405] ? fd_install+0x1f0/0x660
[ 109.859820] ? xfd_validate_state+0x55/0x180
[ 109.860310] do_syscall_64+0xbf/0x360
[ 109.860721] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.861271] RIP: 0033:0x7fb4f7587b19
[ 109.861678] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 109.863607] RSP: 002b:00007fb4f4afd218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 109.864416] RAX: ffffffffffffffda RBX: 00007fb4f769af68 RCX: 00007fb4f7587b19
[ 109.865178] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fb4f769af6c
[ 109.865972] RBP: 00007fb4f769af60 R08: 000000000000000e R09: 0000000000000000
[ 109.866730] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fb4f769af6c
[ 109.867499] R13: 00007ffc1178baaf R14: 00007fb4f4afd300 R15: 0000000000022000
[ 109.868268]
[ 109.868527] Modules linked in:
[ 109.868882] ---[ end trace 0000000000000000 ]---
[ 109.868884] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#2] SMP KASAN NOPTI
[ 109.869398] RIP: 0010:perf_tp_event+0x175/0xe70
[ 109.870272] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[ 109.870761] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 109.871330] CPU: 1 UID: 0 PID: 4019 Comm: syz-executor.0 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 109.873212] RSP: 0018:ffff8880453f7780 EFLAGS: 00010012
[ 109.874089] Tainted: [D]=DIE, [W]=WARN
[ 109.874096] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 109.874638] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc900019fa000
[ 109.874923] RIP: 0010:perf_tp_event+0x175/0xe70
[ 109.875780] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000100000190
[ 109.876301] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 109.876783] RBP: ffff8880453f79f0 R08: ffff88806ce31340 R09: ffffe8ffffc15f40
[ 109.877301] RSP: 0018:ffff88801891f780 EFLAGS: 00010012
[ 109.879200] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 109.879721]
[ 109.879727] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90001ffd000
[ 109.880263] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000
[ 109.880783] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 109.880968] FS: 00007fb4f4afd700(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[ 109.881491] RBP: ffff88801891f9f0 R08: ffff88806cf31340 R09: ffffe8ffffd15f40
[ 109.882227] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 109.882745] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
[ 109.883567] CR2: 00007ffe83542e58 CR3: 0000000043513000 CR4: 0000000000350ef0
[ 109.884083] R13: 0000000000000014 R14: ffff88806cf31340 R15: dffffc0000000000
[ 109.884682] note: syz-executor.3[4017] exited with irqs disabled
[ 109.885197] FS: 00007f4289e51700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000
[ 109.887466] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 109.887895] CR2: 00007f428c9ef018 CR3: 000000001ed1c000 CR4: 0000000000350ef0
[ 109.888419] Call Trace:
[ 109.888614]
[ 109.888787] ? lock_release+0x1c7/0x290
[ 109.889092] ? __pfx_perf_tp_event+0x10/0x10
[ 109.889432] ? unwind_get_return_address+0x59/0xa0
[ 109.889806] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 109.890211] ? arch_stack_walk+0x9c/0xf0
[ 109.890520] ? stack_trace_save+0x8e/0xc0
[ 109.890833] ? stack_depot_save_flags+0x2c/0xa20
[ 109.891190] ? lock_acquire+0x18c/0x2f0
[ 109.891489] ? lock_release+0x1c7/0x290
[ 109.891788] ? lock_acquire+0x18c/0x2f0
[ 109.892089] ? lock_acquire+0x18c/0x2f0
[ 109.892388] ? perf_trace_run_bpf_submit+0xef/0x180
[ 109.892764] ? __is_insn_slot_addr+0x140/0x290
[ 109.893114] perf_trace_run_bpf_submit+0xef/0x180
[ 109.893485] perf_trace_preemptirq_template+0x259/0x430
[ 109.893881] ? trace_sched_set_need_resched_tp+0xd4/0x110
[ 109.894296] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 109.894731] ? __pfx___resched_curr+0x10/0x10
[ 109.895075] ? check_preempt_wakeup_fair+0x406/0x950
[ 109.895454] ? _raw_spin_unlock_irqrestore+0x2c/0x50
[ 109.895836] trace_irq_enable.constprop.0+0xa6/0x100
[ 109.896213] trace_hardirqs_on+0x26/0x40
[ 109.896515] _raw_spin_unlock_irqrestore+0x2c/0x50
[ 109.896884] try_to_wake_up+0x8ae/0x11d0
[ 109.897195] ? __pfx_try_to_wake_up+0x10/0x10
[ 109.897541] ? plist_del+0x122/0x270
[ 109.897828] ? __futex_unqueue+0xda/0x1c0
[ 109.898140] wake_up_q+0xa1/0x130
[ 109.898408] futex_wake+0x47e/0x540
[ 109.898689] ? __pfx_futex_wake+0x10/0x10
[ 109.899004] ? errseq_sample+0x5a/0x70
[ 109.899299] ? file_init_path+0x506/0x770
[ 109.899618] do_futex+0x26d/0x370
[ 109.899882] ? __pfx_do_futex+0x10/0x10
[ 109.900182] ? lock_release+0x1c7/0x290
[ 109.900481] __x64_sys_futex+0x1c9/0x4d0
[ 109.900786] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 109.901218] ? __pfx___x64_sys_futex+0x10/0x10
[ 109.901570] do_syscall_64+0xbf/0x360
[ 109.901856] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.902240] RIP: 0033:0x7f428c8dbb19
[ 109.902515] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 109.903898] RSP: 002b:00007f4289e51218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 109.904487] RAX: ffffffffffffffda RBX: 00007f428c9eef68 RCX: 00007f428c8dbb19
[ 109.905036] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f428c9eef6c
[ 109.905597] RBP: 00007f428c9eef60 R08: 000000000000000e R09: 0000000000000000
[ 109.906146] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f428c9eef6c
[ 109.906695] R13: 00007ffc0ef64aef R14: 00007f4289e51300 R15: 0000000000022000
[ 109.907250]
[ 109.907438] Modules linked in:
[ 109.907694] ---[ end trace 0000000000000000 ]---
[ 109.907696] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#3] SMP KASAN NOPTI
[ 109.908060] RIP: 0010:perf_tp_event+0x175/0xe70
[ 109.909189] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[ 109.909550] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 109.910428] CPU: 0 UID: 0 PID: 4017 Comm: syz-executor.3 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 109.911805] RSP: 0018:ffff8880453f7780 EFLAGS: 00010012
[ 109.913002] Tainted: [D]=DIE, [W]=WARN
[ 109.913409] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc900019fa000
[ 109.913800] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 109.914342] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000100000190
[ 109.915180] RIP: 0010:perf_tp_event+0x175/0xe70
[ 109.915726] RBP: ffff8880453f79f0 R08: ffff88806ce31340 R09: ffffe8ffffc15f40
[ 109.916194] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 109.916735] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 109.918588] RSP: 0018:ffff88806ce08b80 EFLAGS: 00010012
[ 109.919130] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000
[ 109.919132]
[ 109.919143] FS: 00007f4289e51700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000
[ 109.919671] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002
[ 109.920214] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 109.920390] RDX: ffff888015785280 RSI: ffffffff8189a4e7 RDI: 0000000100000190
[ 109.920999] CR2: 00007f428c9ef018 CR3: 000000001ed1c000 CR4: 0000000000350ef0
[ 109.921720] RBP: ffff88806ce08df0 R08: ffff88806ce313e8 R09: ffffe8ffffc15f40
[ 109.922166] note: syz-executor.0[4019] exited with irqs disabled
[ 109.922872] R10: 0000000000000000 R11: ffff88800f31fc98 R12: dffffc0000000000
[ 109.925450] R13: 0000000000000014 R14: ffff88806ce313e8 R15: dffffc0000000000
[ 109.926182] FS: 00007fb4f4afd700(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[ 109.927001] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 109.927590] CR2: 00007ffe83542e58 CR3: 0000000043513000 CR4: 0000000000350ef0
[ 109.928316] Call Trace:
[ 109.928586]
[ 109.928819] ? __pfx_perf_tp_event+0x10/0x10
[ 109.929283] ? enqueue_task_fair+0xded/0x1e00
[ 109.929767] ? do_raw_spin_lock+0x123/0x260
[ 109.930218] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 109.930705] ? lock_acquire+0x18c/0x2f0
[ 109.931126] ? lock_release+0x1c7/0x290
[ 109.931541] ? do_raw_spin_unlock+0x53/0x220
[ 109.932010] ? _raw_spin_unlock_irqrestore+0x22/0x50
[ 109.932540] ? try_to_wake_up+0x128/0x11d0
[ 109.932986] ? do_raw_spin_lock+0x123/0x260
[ 109.933444] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 109.933932] ? perf_trace_run_bpf_submit+0xef/0x180
[ 109.934449] perf_trace_run_bpf_submit+0xef/0x180
[ 109.934957] perf_trace_preemptirq_template+0x259/0x430
[ 109.935505] ? read_tsc+0x9/0x20
[ 109.935861] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 109.936456] ? clockevents_program_event+0x135/0x360
[ 109.936978] ? tick_program_event+0xac/0x140
[ 109.937436] ? handle_softirqs+0x16e/0x770
[ 109.937879] trace_irq_enable.constprop.0+0xa6/0x100
[ 109.938399] trace_hardirqs_on+0x26/0x40
[ 109.938812] handle_softirqs+0x16e/0x770
[ 109.939239] __irq_exit_rcu+0xc4/0x100
[ 109.939647] irq_exit_rcu+0x9/0x20
[ 109.940016] sysvec_apic_timer_interrupt+0x70/0x80
[ 109.940525]
[ 109.940759]
[ 109.941001] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 109.941545] RIP: 0010:make_task_dead+0xa2/0x3b0
[ 109.942024] Code: 38 00 85 db 0f 84 21 01 00 00 e8 09 a6 38 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 57 a1 38 00 48 85 db 0f 84 17 01 00 00 e9 a5 38 00 31 ff 65 8b 1d 60 2f 49 06 81 e3 ff ff ff 7f 89 de
[ 109.943843] RSP: 0018:ffff8880453f7f28 EFLAGS: 00000246
[ 109.944380] RAX: 0000000000000001 RBX: ffff888015785280 RCX: ffffffff817c3ab6
[ 109.945096] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff813b5234
[ 109.945818] RBP: 000000000000000b R08: 0000000000000000 R09: 0000000000000000
[ 109.946532] R10: ffffffff8643b457 R11: 3030303030302043 R12: ffff888015785280
[ 109.947250] R13: 0000000000000000 R14: dffffc0020000032 R15: 0000000000000000
[ 109.947974] ? trace_irq_enable.constprop.0+0x26/0x100
[ 109.948507] ? make_task_dead+0x214/0x3b0
[ 109.948930] ? make_task_dead+0x214/0x3b0
[ 109.949365] ? do_syscall_64+0xbf/0x360
[ 109.949773] rewind_stack_and_make_dead+0x16/0x20
[ 109.950276] RIP: 0033:0x7fb4f7587b19
[ 109.950661] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 109.952465] RSP: 002b:00007fb4f4afd218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 109.953229] RAX: ffffffffffffffda RBX: 00007fb4f769af68 RCX: 00007fb4f7587b19
[ 109.953947] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fb4f769af6c
[ 109.954664] RBP: 00007fb4f769af60 R08: 000000000000000e R09: 0000000000000000
[ 109.955374] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fb4f769af6c
[ 109.956081] R13: 00007ffc1178baaf R14: 00007fb4f4afd300 R15: 0000000000022000
[ 109.956793]
[ 109.957036] Modules linked in:
[ 109.957372] ---[ end trace 0000000000000000 ]---
[ 109.957373] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#4] SMP KASAN NOPTI
[ 109.957840] RIP: 0010:perf_tp_event+0x175/0xe70
[ 109.958685] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[ 109.959138] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 109.959714] CPU: 1 UID: 0 PID: 4019 Comm: syz-executor.0 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 109.961503] RSP: 0018:ffff8880453f7780 EFLAGS: 00010012
[ 109.962407] Tainted: [D]=DIE, [W]=WARN
[ 109.962414] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 109.962920] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc900019fa000
[ 109.963218] RIP: 0010:perf_tp_event+0x175/0xe70
[ 109.964020] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000100000190
[ 109.964563] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 109.965021] RBP: ffff8880453f79f0 R08: ffff88806ce31340 R09: ffffe8ffffc15f40
[ 109.965569] RSP: 0018:ffff88806cf08b80 EFLAGS: 00010012
[ 109.967340] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 109.967884]
[ 109.968398] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000
[ 109.968941] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[ 109.969112] FS: 00007fb4f4afd700(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[ 109.969663] RDX: ffff888016838000 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 109.970365] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 109.970972] RBP: ffff88806cf08df0 R08: ffff88806cf313e8 R09: ffffe8ffffd15f40
[ 109.971679] CR2: 00007ffe83542e58 CR3: 0000000043513000 CR4: 0000000000350ef0
[ 109.972120] R10: 0000000000000000 R11: 000000000001f89d R12: dffffc0000000000
[ 109.972817] Kernel panic - not syncing: Fatal exception in interrupt
[ 111.021510] Shutting down cpus with NMI
[ 111.023117] Kernel Offset: disabled
[ 111.023408] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
VM DIAGNOSIS:
08:23:55 Registers:
info registers vcpu 0
RAX=0000000000000047 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff828e5105 RDI=ffffffff88729280 RBP=ffffffff88729240 RSP=ffff8880453f70e0
R8 =0000000000000000 R9 =ffffed10016ce046 R10=0000000000000047 R11=552030203a555043
R12=0000000000000047 R13=0000000000000010 R14=ffffffff88729240 R15=ffffffff828e50f0
RIP=ffffffff828e515d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007fb4f4afd700 00000000 00000000
GS =0000 ffff8880e55d8000 00000000 00000000
LDT=0000 fffffe0600000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007ffe83542e58 CR3=0000000043513000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007fb4f766e7c000007fb4f766e7c8
XMM02=00007fb4f766e7e000007fb4f766e7c0 XMM03=00007fb4f766e7c800007fb4f766e7c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=0000000000000001 RBX=0000000000000001 RCX=ffffffff84be3c0e RDX=fffffbfff0f0f609
RSI=0000000000000004 RDI=ffffffff8787b044 RBP=ffffffff8787b044 RSP=ffff88801891f530
R8 =0000000000000000 R9 =fffffbfff0f0f608 R10=ffffffff8787b047 R11=202c746c75616620
R12=1ffff11003123ea7 R13=0000000000000007 R14=fffffbfff0f0f608 R15=ffff88801891f568
RIP=ffffffff84be3da0 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f4289e51700 00000000 00000000
GS =0000 ffff8880e56d8000 00000000 00000000
LDT=0000 fffffe1600000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f428c9ef018 CR3=000000001ed1c000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007f428c9c27c000007f428c9c27c8
XMM02=00007f428c9c27e000007f428c9c27c0 XMM03=00007f428c9c27c800007f428c9c27c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000