Warning: Permanently added '[localhost]:32107' (ECDSA) to the list of known hosts. 2025/09/01 08:29:02 fuzzer started 2025/09/01 08:29:02 dialing manager at localhost:35473 syzkaller login: [ 51.717274] cgroup: Unknown subsys name 'net' [ 51.789520] cgroup: Unknown subsys name 'cpuset' [ 51.811729] cgroup: Unknown subsys name 'rlimit' 2025/09/01 08:29:13 syscalls: 2214 2025/09/01 08:29:13 code coverage: enabled 2025/09/01 08:29:13 comparison tracing: enabled 2025/09/01 08:29:13 extra coverage: enabled 2025/09/01 08:29:13 setuid sandbox: enabled 2025/09/01 08:29:13 namespace sandbox: enabled 2025/09/01 08:29:13 Android sandbox: enabled 2025/09/01 08:29:13 fault injection: enabled 2025/09/01 08:29:13 leak checking: enabled 2025/09/01 08:29:13 net packet injection: enabled 2025/09/01 08:29:13 net device setup: enabled 2025/09/01 08:29:13 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/09/01 08:29:13 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/09/01 08:29:13 USB emulation: enabled 2025/09/01 08:29:13 hci packet injection: enabled 2025/09/01 08:29:13 wifi device emulation: enabled 2025/09/01 08:29:13 802.15.4 emulation: enabled 2025/09/01 08:29:13 fetching corpus: 0, signal 0/2000 (executing program) 2025/09/01 08:29:14 fetching corpus: 50, signal 17638/20974 (executing program) 2025/09/01 08:29:14 fetching corpus: 100, signal 34828/38932 (executing program) 2025/09/01 08:29:14 fetching corpus: 150, signal 41559/46584 (executing program) 2025/09/01 08:29:14 fetching corpus: 200, signal 48720/54322 (executing program) 2025/09/01 08:29:14 fetching corpus: 250, signal 58303/64014 (executing program) 2025/09/01 08:29:14 fetching corpus: 300, signal 63179/69207 (executing program) 2025/09/01 08:29:14 fetching corpus: 350, signal 68681/74707 (executing program) 2025/09/01 08:29:15 fetching corpus: 400, signal 72873/78926 (executing program) 2025/09/01 08:29:15 fetching corpus: 450, signal 76278/82378 (executing program) 2025/09/01 08:29:15 fetching corpus: 500, signal 78747/84943 (executing program) 2025/09/01 08:29:15 fetching corpus: 550, signal 83188/88977 (executing program) 2025/09/01 08:29:15 fetching corpus: 600, signal 85033/90877 (executing program) 2025/09/01 08:29:15 fetching corpus: 650, signal 87289/93036 (executing program) 2025/09/01 08:29:15 fetching corpus: 700, signal 89340/94929 (executing program) 2025/09/01 08:29:15 fetching corpus: 750, signal 91866/97095 (executing program) 2025/09/01 08:29:16 fetching corpus: 800, signal 93943/98875 (executing program) 2025/09/01 08:29:16 fetching corpus: 850, signal 96181/100653 (executing program) 2025/09/01 08:29:16 fetching corpus: 900, signal 99107/102774 (executing program) 2025/09/01 08:29:16 fetching corpus: 950, signal 100195/103670 (executing program) 2025/09/01 08:29:16 fetching corpus: 1000, signal 102168/105079 (executing program) 2025/09/01 08:29:16 fetching corpus: 1050, signal 103529/106034 (executing program) 2025/09/01 08:29:16 fetching corpus: 1100, signal 105103/107047 (executing program) 2025/09/01 08:29:17 fetching corpus: 1150, signal 106261/107801 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108423 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108465 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108503 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108549 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108586 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108633 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108672 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108714 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108758 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108803 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108840 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108876 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108918 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/108963 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109010 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109056 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109092 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109134 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109177 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109227 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109259 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109309 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109353 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109393 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109431 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109465 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109502 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109546 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109595 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109644 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109649 (executing program) 2025/09/01 08:29:17 fetching corpus: 1180, signal 107294/109649 (executing program) 2025/09/01 08:29:19 starting 8 fuzzer processes 08:29:19 executing program 0: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) 08:29:19 executing program 2: creat(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6002, 0x0) fallocate(r0, 0x0, 0x0, 0x7fff) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendfile(r1, r0, 0x0, 0x80) 08:29:19 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x5c000, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="01434430303101004c494e55582020202020202020202020202020202020202020202020202020204344524f4d2020202020202020202020202020202020202020202020202020200000000000000000b8000000000000b80000000000000000000000000000000000000000000000000000000000000000010000010100000100080800180000000000001813000000000000000000001500000000220017", 0x9f, 0x8000}, {&(0x7f0000010900)="8800170000000000001700080000000008007809140b2a3a0802", 0x1a, 0xb800}], 0x0, &(0x7f0000000400)={[{@map_off}]}) 08:29:19 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) newfstatat(0xffffffffffffff9c, 0x0, &(0x7f0000002640)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1100) setresuid(r1, 0x0, 0x0) sendmmsg$unix(r0, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000009c0)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xee01}}}], 0x20}}], 0x2, 0x0) 08:29:20 executing program 7: r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_normal', 0x40581, 0x0) pwrite64(r0, &(0x7f0000000080)='0', 0x1, 0x0) [ 68.906911] audit: type=1400 audit(1756715360.081:7): avc: denied { execmem } for pid=271 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 08:29:20 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)={0x1c, 0x69, 0x1, 0x0, 0x0, "", [@typed={0xa, 0x0, 0x0, 0x0, @str='wlan1\x00'}]}, 0x1c}], 0x1}, 0x0) 08:29:20 executing program 5: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f0000000000)=0x7) 08:29:20 executing program 6: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000280)={0x20, r1, 0x1, 0x0, 0x0, {0x1a}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0x20}}, 0x0) [ 70.225262] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 70.228060] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 70.230461] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 70.232433] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 70.234077] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 70.236555] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 70.239923] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 70.241830] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 70.244360] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 70.248160] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 70.344988] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 70.352928] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 70.354412] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 70.358205] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 70.359827] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 70.362328] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 70.366121] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 70.390206] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 70.398050] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 70.400024] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 70.417350] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 70.431002] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 70.432665] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 70.450474] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 70.451723] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 70.453161] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 70.460235] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 70.462975] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 70.469602] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 70.474639] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 70.475995] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 70.477842] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 70.480000] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 70.483263] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 70.500897] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 70.512192] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 70.541908] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 70.544272] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 70.548604] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 70.554031] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 72.315253] Bluetooth: hci1: command tx timeout [ 72.315264] Bluetooth: hci0: command tx timeout [ 72.380796] Bluetooth: hci2: command tx timeout [ 72.443054] Bluetooth: hci3: command tx timeout [ 72.571900] Bluetooth: hci4: command tx timeout [ 72.571935] Bluetooth: hci6: command tx timeout [ 72.635149] Bluetooth: hci7: command tx timeout [ 72.637051] Bluetooth: hci5: command tx timeout [ 74.362966] Bluetooth: hci0: command tx timeout [ 74.363573] Bluetooth: hci1: command tx timeout [ 74.427871] Bluetooth: hci2: command tx timeout [ 74.490831] Bluetooth: hci3: command tx timeout [ 74.618835] Bluetooth: hci6: command tx timeout [ 74.618986] Bluetooth: hci4: command tx timeout [ 74.683857] Bluetooth: hci7: command tx timeout [ 74.684318] Bluetooth: hci5: command tx timeout [ 76.411113] Bluetooth: hci1: command tx timeout [ 76.412913] Bluetooth: hci0: command tx timeout [ 76.474994] Bluetooth: hci2: command tx timeout [ 76.538961] Bluetooth: hci3: command tx timeout [ 76.666843] Bluetooth: hci4: command tx timeout [ 76.667016] Bluetooth: hci6: command tx timeout [ 76.732045] Bluetooth: hci5: command tx timeout [ 76.732220] Bluetooth: hci7: command tx timeout [ 78.458974] Bluetooth: hci1: command tx timeout [ 78.459120] Bluetooth: hci0: command tx timeout [ 78.522929] Bluetooth: hci2: command tx timeout [ 78.586814] Bluetooth: hci3: command tx timeout [ 78.714926] Bluetooth: hci4: command tx timeout [ 78.715092] Bluetooth: hci6: command tx timeout [ 78.780834] Bluetooth: hci5: command tx timeout [ 78.781295] Bluetooth: hci7: command tx timeout [ 110.023242] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.024009] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.185368] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.186255] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.350939] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.351553] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.504019] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.504635] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:30:01 executing program 2: creat(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6002, 0x0) fallocate(r0, 0x0, 0x0, 0x7fff) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendfile(r1, r0, 0x0, 0x80) [ 110.651767] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.652392] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:30:01 executing program 2: creat(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6002, 0x0) fallocate(r0, 0x0, 0x0, 0x7fff) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendfile(r1, r0, 0x0, 0x80) 08:30:01 executing program 2: creat(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6002, 0x0) fallocate(r0, 0x0, 0x0, 0x7fff) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendfile(r1, r0, 0x0, 0x80) [ 110.773194] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.773995] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.827495] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.828086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:30:02 executing program 2: modify_ldt$write2(0x11, &(0x7f0000000180)={0x3, 0x100000, 0x1000, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1}, 0x10) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_OPENQRY(r0, 0x5600, &(0x7f0000000000)) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000000)={0x0, @adiantum, 0x0, @desc3}) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semget$private(0x0, 0x3, 0x0) r1 = semget(0x2, 0x1, 0x80) r2 = semget$private(0x0, 0x1, 0x0) semctl$IPC_SET(r2, 0x0, 0x1, &(0x7f00000001c0)={{0x3, 0xffffffffffffffff}}) semctl$SEM_STAT_ANY(r2, 0x4, 0x14, &(0x7f0000000100)=""/66) semtimedop(r1, &(0x7f0000000040)=[{0x0, 0x1f}, {0x0, 0x81}], 0x2, 0x0) semctl$IPC_RMID(r1, 0x0, 0x0) creat(0x0, 0x0) [ 110.866708] audit: type=1400 audit(1756715402.038:8): avc: denied { open } for pid=3832 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 110.871839] audit: type=1400 audit(1756715402.038:9): avc: denied { kernel } for pid=3832 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 110.988838] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.989482] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.033097] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.033701] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.114778] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.115391] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.409422] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.410811] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.480301] loop3: detected capacity change from 0 to 736 [ 111.503447] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.504119] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.541054] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.541684] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.617275] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.618097] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.784423] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 111.789225] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 111.843616] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.844405] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.874582] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.875236] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:30:03 executing program 0: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000280)={0x20, r1, 0x1, 0x0, 0x0, {0x1a}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0x20}}, 0x0) 08:30:03 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)={0x1c, 0x69, 0x1, 0x0, 0x0, "", [@typed={0xa, 0x0, 0x0, 0x0, @str='wlan1\x00'}]}, 0x1c}], 0x1}, 0x0) 08:30:03 executing program 2: modify_ldt$write2(0x11, &(0x7f0000000180)={0x3, 0x100000, 0x1000, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1}, 0x10) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_OPENQRY(r0, 0x5600, &(0x7f0000000000)) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000000)={0x0, @adiantum, 0x0, @desc3}) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semget$private(0x0, 0x3, 0x0) r1 = semget(0x2, 0x1, 0x80) r2 = semget$private(0x0, 0x1, 0x0) semctl$IPC_SET(r2, 0x0, 0x1, &(0x7f00000001c0)={{0x3, 0xffffffffffffffff}}) semctl$SEM_STAT_ANY(r2, 0x4, 0x14, &(0x7f0000000100)=""/66) semtimedop(r1, &(0x7f0000000040)=[{0x0, 0x1f}, {0x0, 0x81}], 0x2, 0x0) semctl$IPC_RMID(r1, 0x0, 0x0) creat(0x0, 0x0) 08:30:03 executing program 7: r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_normal', 0x40581, 0x0) pwrite64(r0, &(0x7f0000000080)='0', 0x1, 0x0) 08:30:03 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) newfstatat(0xffffffffffffff9c, 0x0, &(0x7f0000002640)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1100) setresuid(r1, 0x0, 0x0) sendmmsg$unix(r0, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000009c0)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xee01}}}], 0x20}}], 0x2, 0x0) 08:30:03 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x5c000, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="01434430303101004c494e55582020202020202020202020202020202020202020202020202020204344524f4d2020202020202020202020202020202020202020202020202020200000000000000000b8000000000000b80000000000000000000000000000000000000000000000000000000000000000010000010100000100080800180000000000001813000000000000000000001500000000220017", 0x9f, 0x8000}, {&(0x7f0000010900)="8800170000000000001700080000000008007809140b2a3a0802", 0x1a, 0xb800}], 0x0, &(0x7f0000000400)={[{@map_off}]}) 08:30:03 executing program 6: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000280)={0x20, r1, 0x1, 0x0, 0x0, {0x1a}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0x20}}, 0x0) 08:30:03 executing program 5: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f0000000000)=0x7) [ 112.025907] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 112.036119] loop3: detected capacity change from 0 to 736 08:30:03 executing program 7: r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_normal', 0x40581, 0x0) pwrite64(r0, &(0x7f0000000080)='0', 0x1, 0x0) 08:30:03 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)={0x1c, 0x69, 0x1, 0x0, 0x0, "", [@typed={0xa, 0x0, 0x0, 0x0, @str='wlan1\x00'}]}, 0x1c}], 0x1}, 0x0) [ 112.154284] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 08:30:03 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) newfstatat(0xffffffffffffff9c, 0x0, &(0x7f0000002640)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1100) setresuid(r1, 0x0, 0x0) sendmmsg$unix(r0, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000009c0)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xee01}}}], 0x20}}], 0x2, 0x0) 08:30:03 executing program 0: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000280)={0x20, r1, 0x1, 0x0, 0x0, {0x1a}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0x20}}, 0x0) 08:30:03 executing program 6: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000280)={0x20, r1, 0x1, 0x0, 0x0, {0x1a}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0x20}}, 0x0) 08:30:03 executing program 7: r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_normal', 0x40581, 0x0) pwrite64(r0, &(0x7f0000000080)='0', 0x1, 0x0) 08:30:03 executing program 2: modify_ldt$write2(0x11, &(0x7f0000000180)={0x3, 0x100000, 0x1000, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1}, 0x10) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_OPENQRY(r0, 0x5600, &(0x7f0000000000)) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000000)={0x0, @adiantum, 0x0, @desc3}) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semget$private(0x0, 0x3, 0x0) r1 = semget(0x2, 0x1, 0x80) r2 = semget$private(0x0, 0x1, 0x0) semctl$IPC_SET(r2, 0x0, 0x1, &(0x7f00000001c0)={{0x3, 0xffffffffffffffff}}) semctl$SEM_STAT_ANY(r2, 0x4, 0x14, &(0x7f0000000100)=""/66) semtimedop(r1, &(0x7f0000000040)=[{0x0, 0x1f}, {0x0, 0x81}], 0x2, 0x0) semctl$IPC_RMID(r1, 0x0, 0x0) creat(0x0, 0x0) 08:30:03 executing program 5: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f0000000000)=0x7) 08:30:03 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)={0x1c, 0x69, 0x1, 0x0, 0x0, "", [@typed={0xa, 0x0, 0x0, 0x0, @str='wlan1\x00'}]}, 0x1c}], 0x1}, 0x0) 08:30:03 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x5c000, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="01434430303101004c494e55582020202020202020202020202020202020202020202020202020204344524f4d2020202020202020202020202020202020202020202020202020200000000000000000b8000000000000b80000000000000000000000000000000000000000000000000000000000000000010000010100000100080800180000000000001813000000000000000000001500000000220017", 0x9f, 0x8000}, {&(0x7f0000010900)="8800170000000000001700080000000008007809140b2a3a0802", 0x1a, 0xb800}], 0x0, &(0x7f0000000400)={[{@map_off}]}) [ 112.232600] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 112.241910] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#1] SMP KASAN NOPTI [ 112.242787] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] [ 112.243383] CPU: 0 UID: 0 PID: 3930 Comm: syz-executor.5 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 112.244884] Tainted: [W]=WARN [ 112.245748] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 112.247512] RIP: 0010:perf_tp_event+0x175/0xe70 [ 112.249000] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 112.252611] RSP: 0018:ffff8880462c77c0 EFLAGS: 00010212 [ 112.253040] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002 [ 112.253593] RDX: ffff888016c71b80 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 112.254150] RBP: ffff8880462c7a30 R08: ffff88806ce31340 R09: ffffe8ffffc15e38 [ 112.254703] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000 [ 112.255256] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000 [ 112.255809] FS: 0000555583b2d400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000 [ 112.256435] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 112.256893] CR2: 0000001b2d223000 CR3: 0000000043839000 CR4: 0000000000350ef0 [ 112.257454] Call Trace: [ 112.257660] [ 112.257850] ? __pfx_perf_tp_event+0x10/0x10 [ 112.258208] ? cpu_util.constprop.0+0x17d/0x340 [ 112.258584] ? __asan_memset+0x24/0x50 [ 112.258895] ? sched_balance_find_dst_group+0xa9a/0x1c00 [ 112.259323] ? lock_release+0xc8/0x290 [ 112.259642] ? __pfx_sched_balance_find_dst_group+0x10/0x10 [ 112.260084] ? __lock_acquire+0x694/0x1b70 [ 112.260423] ? perf_trace_run_bpf_submit+0xef/0x180 [ 112.260821] perf_trace_run_bpf_submit+0xef/0x180 [ 112.261219] perf_trace_lock_acquire+0x3c2/0x700 [ 112.261604] ? __pfx_perf_trace_lock_acquire+0x10/0x10 [ 112.262022] ? lock_acquire+0x15e/0x2f0 [ 112.262339] lock_acquire+0xc5/0x2f0 [ 112.262640] ? futex_private_hash_put+0x4c/0x2d0 [ 112.263017] ? futex_hash+0x2d8/0x390 [ 112.263324] ? lock_release+0xc8/0x290 [ 112.263635] futex_private_hash_put+0x5d/0x2d0 [ 112.263995] ? futex_private_hash_put+0x4c/0x2d0 [ 112.264368] futex_hash_put+0x3f/0x50 [ 112.264671] futex_wake+0x1bb/0x540 [ 112.264970] ? kernel_clone+0x204/0x7f0 [ 112.265295] ? __pfx_futex_wake+0x10/0x10 [ 112.265631] ? __pfx_kernel_clone+0x10/0x10 [ 112.265972] ? perf_trace_lock+0xb5/0x5d0 [ 112.266304] do_futex+0x26d/0x370 [ 112.266585] ? __pfx_do_futex+0x10/0x10 [ 112.266902] ? __pfx___do_sys_clone+0x10/0x10 [ 112.267259] ? find_held_lock+0x2b/0x80 [ 112.267584] __x64_sys_futex+0x1c9/0x4d0 [ 112.267911] ? __pfx___x64_sys_futex+0x10/0x10 [ 112.268278] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 112.268705] do_syscall_64+0xbf/0x360 [ 112.269018] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.269425] RIP: 0033:0x7f725a522b19 [ 112.269717] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 112.271120] RSP: 002b:00007ffcd284d2b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 112.271714] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f725a522b19 [ 112.272267] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f725a635f68 [ 112.272819] RBP: 00007f725a635f60 R08: 00007f7257a98700 R09: 0000000000000000 [ 112.273378] R10: 00007f7257a98700 R11: 0000000000000246 R12: 00007f725a63a070 [ 112.273929] R13: 00007ffcd284d3c0 R14: 00007f725a635f60 R15: 000000000001b605 [ 112.274494] [ 112.274683] Modules linked in: [ 112.274943] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#2] SMP KASAN NOPTI [ 112.275845] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197] [ 112.276524] CPU: 1 UID: 0 PID: 3928 Comm: syz-executor.7 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 112.277463] Tainted: [D]=DIE, [W]=WARN [ 112.277749] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 112.278352] RIP: 0010:perf_tp_event+0x175/0xe70 [ 112.278714] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 112.280031] RSP: 0018:ffff8880462af7c0 EFLAGS: 00010212 [ 112.280423] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002 [ 112.280943] RDX: ffff8880448e0000 RSI: ffffffff8189a4e7 RDI: 0000000100000190 [ 112.281476] RBP: ffff8880462afa30 R08: ffff88806cf31340 R09: ffffe8ffffd15e38 [ 112.281997] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000 [ 112.282518] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000 [ 112.283040] FS: 000055557d581400(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000 [ 112.283625] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 112.284051] CR2: 00007fba9db0a543 CR3: 00000000439ae000 CR4: 0000000000350ef0 [ 112.284572] Call Trace: [ 112.284766] [ 112.284944] ? __pfx_perf_tp_event+0x10/0x10 [ 112.285292] ? cpu_util.constprop.0+0x17d/0x340 [ 112.285650] ? __asan_memset+0x24/0x50 [ 112.285947] ? sched_balance_find_dst_group+0xa9a/0x1c00 [ 112.286349] ? lock_release+0x1c7/0x290 [ 112.286655] ? __pfx_sched_balance_find_dst_group+0x10/0x10 [ 112.287073] ? trace_sched_set_need_resched_tp+0xd4/0x110 [ 112.287495] ? perf_trace_run_bpf_submit+0xef/0x180 [ 112.287870] perf_trace_run_bpf_submit+0xef/0x180 [ 112.288239] perf_trace_lock_acquire+0x3c2/0x700 [ 112.288602] ? __pfx_perf_trace_lock_acquire+0x10/0x10 [ 112.288994] ? __pfx_perf_trace_lock_acquire+0x10/0x10 [ 112.289394] lock_acquire+0xc5/0x2f0 [ 112.289677] ? futex_private_hash_put+0x4c/0x2d0 [ 112.290033] ? lock_release+0x1c7/0x290 [ 112.290334] futex_private_hash_put+0x5d/0x2d0 [ 112.290679] ? futex_private_hash_put+0x4c/0x2d0 [ 112.291032] futex_hash_put+0x3f/0x50 [ 112.291318] futex_wake+0x1bb/0x540 [ 112.291599] ? lock_acquire+0xc5/0x2f0 [ 112.291896] ? __pfx_futex_wake+0x10/0x10 [ 112.292212] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 112.292604] ? finish_task_switch.isra.0+0x206/0x840 [ 112.292990] do_futex+0x26d/0x370 [ 112.293265] ? __pfx_do_futex+0x10/0x10 [ 112.293566] ? __pfx___schedule+0x10/0x10 [ 112.293884] __x64_sys_futex+0x1c9/0x4d0 [ 112.294194] ? __pfx___x64_sys_futex+0x10/0x10 [ 112.294545] ? xfd_validate_state+0x55/0x180 [ 112.294892] do_syscall_64+0xbf/0x360 [ 112.295183] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.295566] RIP: 0033:0x7f5004b37b19 [ 112.295844] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 112.297169] RSP: 002b:00007ffe92cde868 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 112.297730] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5004b37b19 [ 112.298251] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5004c4af68 [ 112.298772] RBP: 00007f5004c4af60 R08: 00007f50020ad700 R09: 0000000000000000 [ 112.299292] R10: 00007f50020ad700 R11: 0000000000000246 R12: 00007f5004c4f0b0 [ 112.299814] R13: 00007ffe92cde970 R14: 00007f5004c4af60 R15: 000000000001b60c [ 112.300342] [ 112.300525] Modules linked in: [ 112.300770] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#3] SMP KASAN NOPTI [ 112.301653] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] [ 112.302248] CPU: 0 UID: 0 PID: 3930 Comm: syz-executor.5 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 112.303185] Tainted: [D]=DIE, [W]=WARN [ 112.303489] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 112.304134] RIP: 0010:perf_tp_event+0x175/0xe70 [ 112.304516] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 112.305987] RSP: 0018:ffff88806ce08a80 EFLAGS: 00010012 [ 112.306419] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002 [ 112.306996] RDX: ffff888016c71b80 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 112.307572] RBP: ffff88806ce08cf0 R08: ffff88806ce31490 R09: ffffe8ffffc15e38 [ 112.308146] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000 [ 112.308721] R13: 000000000000002c R14: ffff88806ce31490 R15: dffffc0000000000 [ 112.309303] FS: 0000555583b2d400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000 [ 112.309950] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 112.310423] CR2: 0000001b2d223000 CR3: 0000000043839000 CR4: 0000000000350ef0 [ 112.311004] Call Trace: [ 112.311219] [ 112.311406] ? __pfx_perf_tp_event+0x10/0x10 [ 112.311778] ? __pfx_css_rstat_updated+0x10/0x10 [ 112.312174] ? lock_is_held_type+0x9e/0x120 [ 112.312544] ? trace_pelt_se_tp+0xdf/0x130 [ 112.312894] ? __update_load_avg_se+0x428/0xa40 [ 112.313292] ? lock_is_held_type+0x9e/0x120 [ 112.313657] ? update_load_avg+0x17d/0x1ef0 [ 112.314010] ? update_cfs_group+0x11d/0x260 [ 112.314365] ? kvm_sched_clock_read+0x16/0x30 [ 112.314742] ? enqueue_task_fair+0xded/0x1e00 [ 112.315121] ? perf_trace_lock_acquire+0xc9/0x700 [ 112.315525] ? perf_trace_run_bpf_submit+0xef/0x180 [ 112.315938] perf_trace_run_bpf_submit+0xef/0x180 [ 112.316346] perf_trace_lock_acquire+0x3c2/0x700 [ 112.316737] ? update_curr+0x71/0x500 [ 112.317065] ? __pfx_perf_trace_lock_acquire+0x10/0x10 [ 112.317506] ? find_held_lock+0x2b/0x80 [ 112.317840] ? sched_ttwu_pending+0x2e0/0x4a0 [ 112.318218] lock_acquire+0xc5/0x2f0 [ 112.318526] ? hrtimer_interrupt+0xd6/0x830 [ 112.318868] ? _raw_spin_unlock+0x1e/0x40 [ 112.319205] ? sched_ttwu_pending+0x2e0/0x4a0 [ 112.319577] _raw_spin_lock_irqsave+0x3a/0x60 [ 112.319942] ? hrtimer_interrupt+0xd6/0x830 [ 112.320287] hrtimer_interrupt+0xd6/0x830 [ 112.320621] ? __pfx_sched_ttwu_pending+0x10/0x10 [ 112.321019] ? trace_csd_function_exit+0x134/0x190 [ 112.321420] ? __flush_smp_call_function_queue+0x443/0x740 [ 112.321867] __sysvec_apic_timer_interrupt+0xbb/0x330 [ 112.322289] sysvec_apic_timer_interrupt+0x6b/0x80 [ 112.322683] [ 112.322864] [ 112.323049] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 112.323465] RIP: 0010:oops_exit+0x0/0x50 [ 112.323791] Code: 00 3a 00 be ff ff ff ff 48 c7 c7 50 b4 43 86 e8 c6 0f f9 ff 5b e9 50 00 3a 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 53 e8 36 00 3a 00 8b 1d c0 3d 4f 06 31 ff 89 de e8 57 [ 112.325226] RSP: 0018:ffff8880462c7650 EFLAGS: 00000202 [ 112.325651] RAX: 0000000000000000 RBX: 0000000000000293 RCX: ffffffff8139f06f [ 112.326210] RDX: ffff888016c71b80 RSI: ffffffff812a3dca RDI: 0000000000000007 [ 112.326773] RBP: 000000000000000b R08: 0000000000000001 R09: fffffbfff0f12690 [ 112.327332] R10: 0000000000000000 R11: 000000000000002c R12: ffff8880462c7718 [ 112.327890] R13: 0000000000000000 R14: dffffc0000000032 R15: 0000000000000000 [ 112.328453] ? add_taint+0x5f/0xd0 [ 112.328743] ? oops_end+0x4a/0xe0 [ 112.329042] oops_end+0x65/0xe0 [ 112.329317] exc_general_protection+0x1a2/0x330 [ 112.329697] asm_exc_general_protection+0x26/0x30 [ 112.330082] RIP: 0010:perf_tp_event+0x175/0xe70 [ 112.330459] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 112.331878] RSP: 0018:ffff8880462c77c0 EFLAGS: 00010212 [ 112.332298] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002 [ 112.332857] RDX: ffff888016c71b80 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 112.333422] RBP: ffff8880462c7a30 R08: ffff88806ce31340 R09: ffffe8ffffc15e38 [ 112.333982] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000 [ 112.334546] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000 [ 112.335112] ? perf_tp_event+0x167/0xe70 [ 112.335449] ? __pfx_perf_tp_event+0x10/0x10 [ 112.335806] ? cpu_util.constprop.0+0x17d/0x340 [ 112.336183] ? __asan_memset+0x24/0x50 [ 112.336496] ? sched_balance_find_dst_group+0xa9a/0x1c00 [ 112.336931] ? lock_release+0xc8/0x290 [ 112.337257] ? __pfx_sched_balance_find_dst_group+0x10/0x10 [ 112.337702] ? __lock_acquire+0x694/0x1b70 [ 112.338045] ? perf_trace_run_bpf_submit+0xef/0x180 [ 112.338445] perf_trace_run_bpf_submit+0xef/0x180 [ 112.338841] perf_trace_lock_acquire+0x3c2/0x700 [ 112.339224] ? __pfx_perf_trace_lock_acquire+0x10/0x10 [ 112.339645] ? lock_acquire+0x15e/0x2f0 [ 112.339966] lock_acquire+0xc5/0x2f0 [ 112.340269] ? futex_private_hash_put+0x4c/0x2d0 [ 112.340651] ? futex_hash+0x2d8/0x390 [ 112.340956] ? lock_release+0xc8/0x290 [ 112.341277] futex_private_hash_put+0x5d/0x2d0 [ 112.341641] ? futex_private_hash_put+0x4c/0x2d0 [ 112.342018] futex_hash_put+0x3f/0x50 [ 112.342324] futex_wake+0x1bb/0x540 [ 112.342621] ? kernel_clone+0x204/0x7f0 [ 112.342939] ? __pfx_futex_wake+0x10/0x10 [ 112.343275] ? __pfx_kernel_clone+0x10/0x10 [ 112.343620] ? perf_trace_lock+0xb5/0x5d0 [ 112.343955] do_futex+0x26d/0x370 [ 112.344239] ? __pfx_do_futex+0x10/0x10 [ 112.344559] ? __pfx___do_sys_clone+0x10/0x10 [ 112.344916] ? find_held_lock+0x2b/0x80 [ 112.345248] __x64_sys_futex+0x1c9/0x4d0 [ 112.345578] ? __pfx___x64_sys_futex+0x10/0x10 [ 112.345948] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 112.346365] do_syscall_64+0xbf/0x360 [ 112.346670] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.347078] RIP: 0033:0x7f725a522b19 [ 112.347371] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 112.348789] RSP: 002b:00007ffcd284d2b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 112.349387] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f725a522b19 [ 112.349943] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f725a635f68 [ 112.350499] RBP: 00007f725a635f60 R08: 00007f7257a98700 R09: 0000000000000000 [ 112.351055] R10: 00007f7257a98700 R11: 0000000000000246 R12: 00007f725a63a070 [ 112.351609] R13: 00007ffcd284d3c0 R14: 00007f725a635f60 R15: 000000000001b605 [ 112.352171] [ 112.352360] Modules linked in: [ 112.352620] ---[ end trace 0000000000000000 ]--- [ 112.352621] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#4] SMP KASAN NOPTI [ 112.352986] RIP: 0010:perf_tp_event+0x175/0xe70 [ 112.353855] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197] [ 112.354215] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 112.354894] CPU: 1 UID: 0 PID: 3928 Comm: syz-executor.7 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 112.356295] RSP: 0018:ffff8880462c77c0 EFLAGS: 00010212 [ 112.357229] Tainted: [D]=DIE, [W]=WARN [ 112.357643] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002 [ 112.357945] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 112.358494] RDX: ffff888016c71b80 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 112.359142] RIP: 0010:perf_tp_event+0x175/0xe70 [ 112.359691] RBP: ffff8880462c7a30 R08: ffff88806ce31340 R09: ffffe8ffffc15e38 [ 112.360054] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 112.360604] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000 [ 112.362022] RSP: 0018:ffff88806cf08a80 EFLAGS: 00010012 [ 112.362571] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000 [ 112.362574] [ 112.362993] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002 [ 112.363543] FS: 0000555583b2d400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000 [ 112.363679] RDX: ffff8880448e0000 RSI: ffffffff8189a4e7 RDI: 0000000100000190 [ 112.364229] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 112.364851] RBP: ffff88806cf08cf0 R08: ffff88806cf31490 R09: ffffe8ffffd15e38 [ 112.365406] CR2: 0000001b2d223000 CR3: 0000000043839000 CR4: 0000000000350ef0 [ 112.365855] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000 [ 112.366403] Kernel panic - not syncing: Fatal exception in interrupt [ 113.408335] Shutting down cpus with NMI [ 113.420244] Kernel Offset: disabled [ 113.420532] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- VM DIAGNOSIS: 08:30:03 Registers: info registers vcpu 0 RAX=0000000000000078 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff828e5105 RDI=ffffffff88729280 RBP=ffffffff88729240 RSP=ffff8880462c7118 R8 =0000000000000000 R9 =ffffed10015a2046 R10=0000000000000078 R11=000000000000002c R12=0000000000000078 R13=0000000000000010 R14=ffffffff88729240 R15=ffffffff828e50f0 RIP=ffffffff828e515d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000555583b2d400 00000000 00000000 GS =0000 ffff8880e55d8000 00000000 00000000 LDT=0000 fffffe3b00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000001b2d223000 CR3=0000000043839000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f725a6097c000007f725a6097c8 XMM02=00007f725a6097e000007f725a6097c0 XMM03=00007f725a6097c800007f725a6097c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000001 RBX=0000000000000001 RCX=ffffffff84be3c0e RDX=fffffbfff0f0f609 RSI=0000000000000004 RDI=ffffffff8787b044 RBP=ffffffff8787b044 RSP=ffff8880462af570 R8 =0000000000000000 R9 =fffffbfff0f0f608 R10=ffffffff8787b047 R11=202c746c75616620 R12=1ffff11008c55eaf R13=0000000000000007 R14=fffffbfff0f0f608 R15=ffff8880462af5a8 RIP=ffffffff84be3da0 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 000055557d581400 00000000 00000000 GS =0000 ffff8880e56d8000 00000000 00000000 LDT=0000 ffff888000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fba9db0a543 CR3=00000000439ae000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f5004c1e7c000007f5004c1e7c8 XMM02=00007f5004c1e7e000007f5004c1e7c0 XMM03=00007f5004c1e7c800007f5004c1e7c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000