Warning: Permanently added '[localhost]:35666' (ECDSA) to the list of known hosts.
2025/09/01 08:36:00 fuzzer started
2025/09/01 08:36:00 dialing manager at localhost:35473
syzkaller login: [ 51.759406] cgroup: Unknown subsys name 'net'
[ 51.826913] cgroup: Unknown subsys name 'cpuset'
[ 51.834611] cgroup: Unknown subsys name 'rlimit'
2025/09/01 08:36:10 syscalls: 2214
2025/09/01 08:36:10 code coverage: enabled
2025/09/01 08:36:10 comparison tracing: enabled
2025/09/01 08:36:10 extra coverage: enabled
2025/09/01 08:36:10 setuid sandbox: enabled
2025/09/01 08:36:10 namespace sandbox: enabled
2025/09/01 08:36:10 Android sandbox: enabled
2025/09/01 08:36:10 fault injection: enabled
2025/09/01 08:36:10 leak checking: enabled
2025/09/01 08:36:10 net packet injection: enabled
2025/09/01 08:36:10 net device setup: enabled
2025/09/01 08:36:10 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2025/09/01 08:36:10 devlink PCI setup: PCI device 0000:00:10.0 is not available
2025/09/01 08:36:10 USB emulation: enabled
2025/09/01 08:36:10 hci packet injection: enabled
2025/09/01 08:36:10 wifi device emulation: enabled
2025/09/01 08:36:10 802.15.4 emulation: enabled
2025/09/01 08:36:10 fetching corpus: 0, signal 0/2000 (executing program)
2025/09/01 08:36:10 fetching corpus: 50, signal 25649/28791 (executing program)
2025/09/01 08:36:10 fetching corpus: 100, signal 32194/36603 (executing program)
2025/09/01 08:36:11 fetching corpus: 150, signal 45237/50223 (executing program)
2025/09/01 08:36:11 fetching corpus: 200, signal 50941/56765 (executing program)
2025/09/01 08:36:11 fetching corpus: 250, signal 54926/61529 (executing program)
2025/09/01 08:36:11 fetching corpus: 300, signal 58209/65516 (executing program)
2025/09/01 08:36:11 fetching corpus: 350, signal 64259/71772 (executing program)
2025/09/01 08:36:11 fetching corpus: 400, signal 67909/75833 (executing program)
2025/09/01 08:36:11 fetching corpus: 450, signal 73046/81001 (executing program)
2025/09/01 08:36:11 fetching corpus: 500, signal 75859/84067 (executing program)
2025/09/01 08:36:11 fetching corpus: 550, signal 80393/88440 (executing program)
2025/09/01 08:36:12 fetching corpus: 600, signal 82786/90959 (executing program)
2025/09/01 08:36:12 fetching corpus: 650, signal 85444/93612 (executing program)
2025/09/01 08:36:12 fetching corpus: 700, signal 86909/95268 (executing program)
2025/09/01 08:36:12 fetching corpus: 750, signal 90268/98320 (executing program)
2025/09/01 08:36:12 fetching corpus: 800, signal 91956/100026 (executing program)
2025/09/01 08:36:12 fetching corpus: 850, signal 94194/102063 (executing program)
2025/09/01 08:36:12 fetching corpus: 900, signal 96058/103746 (executing program)
2025/09/01 08:36:13 fetching corpus: 950, signal 98133/105558 (executing program)
2025/09/01 08:36:13 fetching corpus: 1000, signal 101393/108052 (executing program)
2025/09/01 08:36:13 fetching corpus: 1050, signal 103586/109742 (executing program)
2025/09/01 08:36:13 fetching corpus: 1100, signal 105392/111172 (executing program)
2025/09/01 08:36:13 fetching corpus: 1150, signal 106542/112110 (executing program)
2025/09/01 08:36:13 fetching corpus: 1200, signal 108606/113513 (executing program)
2025/09/01 08:36:14 fetching corpus: 1250, signal 110035/114496 (executing program)
2025/09/01 08:36:14 fetching corpus: 1300, signal 112251/115872 (executing program)
2025/09/01 08:36:14 fetching corpus: 1350, signal 113276/116577 (executing program)
2025/09/01 08:36:14 fetching corpus: 1400, signal 114201/117255 (executing program)
2025/09/01 08:36:14 fetching corpus: 1450, signal 115136/117855 (executing program)
2025/09/01 08:36:14 fetching corpus: 1500, signal 116581/118642 (executing program)
2025/09/01 08:36:14 fetching corpus: 1550, signal 117884/119325 (executing program)
2025/09/01 08:36:14 fetching corpus: 1568, signal 118139/119484 (executing program)
2025/09/01 08:36:14 fetching corpus: 1568, signal 118139/119521 (executing program)
2025/09/01 08:36:14 fetching corpus: 1568, signal 118139/119556 (executing program)
2025/09/01 08:36:14 fetching corpus: 1568, signal 118139/119596 (executing program)
2025/09/01 08:36:14 fetching corpus: 1568, signal 118139/119644 (executing program)
2025/09/01 08:36:14 fetching corpus: 1568, signal 118139/119677 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/119708 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/119758 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/119799 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/119833 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/119878 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/119911 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/119942 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/119982 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120027 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120064 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120102 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120140 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120195 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120234 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120272 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120326 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120356 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120389 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120427 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120459 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120498 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120516 (executing program)
2025/09/01 08:36:15 fetching corpus: 1568, signal 118139/120516 (executing program)
2025/09/01 08:36:17 starting 8 fuzzer processes
08:36:17 executing program 0:
msgrcv(0xffffffffffffffff, 0x0, 0xa6, 0x0, 0x0)
08:36:17 executing program 2:
r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0)
lseek(r0, 0x0, 0x4)
08:36:17 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
read(r0, 0x0, 0x0)
08:36:17 executing program 4:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@getspdinfo={0x14, 0x25, 0x1}, 0x14}}, 0x0)
08:36:17 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={[{@mpol={'mpol', 0x3d, {'prefer', '=relative', @val={0x3a, [0x32, 0x2d, 0x39, 0x2c, 0x34]}}}}]})
08:36:17 executing program 7:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1={0xff, 0x5}}, 0x1c)
[ 68.935381] audit: type=1400 audit(1756715777.866:7): avc: denied { execmem } for pid=271 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
08:36:17 executing program 5:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x30, &(0x7f00000001c0)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108)
08:36:17 executing program 6:
modify_ldt$write(0x1, &(0x7f0000000080), 0x10)
modify_ldt$write(0xffffc90000000000, 0x0, 0x0)
[ 70.201238] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 70.204920] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 70.206871] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 70.208864] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 70.209434] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 70.215450] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 70.217857] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 70.220024] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 70.229856] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 70.246497] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 70.261783] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 70.268503] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 70.279363] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 70.287224] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 70.295536] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 70.394574] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 70.409398] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 70.414832] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[ 70.418632] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[ 70.425310] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[ 70.429696] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[ 70.431363] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 70.433403] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[ 70.433563] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 70.439519] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 70.441582] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[ 70.441921] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 70.447485] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[ 70.452137] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[ 70.453984] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[ 70.456650] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[ 70.459603] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[ 70.461619] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 70.468006] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 70.468538] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 70.470490] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[ 70.476215] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[ 70.479198] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[ 70.490918] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 70.493234] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[ 72.291523] Bluetooth: hci0: command tx timeout
[ 72.292176] Bluetooth: hci1: command tx timeout
[ 72.357127] Bluetooth: hci2: command tx timeout
[ 72.547340] Bluetooth: hci6: command tx timeout
[ 72.548210] Bluetooth: hci7: command tx timeout
[ 72.548506] Bluetooth: hci4: command tx timeout
[ 72.549172] Bluetooth: hci3: command tx timeout
[ 72.611161] Bluetooth: hci5: command tx timeout
[ 74.339442] Bluetooth: hci0: command tx timeout
[ 74.341151] Bluetooth: hci1: command tx timeout
[ 74.404996] Bluetooth: hci2: command tx timeout
[ 74.595545] Bluetooth: hci4: command tx timeout
[ 74.596415] Bluetooth: hci3: command tx timeout
[ 74.597277] Bluetooth: hci6: command tx timeout
[ 74.597313] Bluetooth: hci7: command tx timeout
[ 74.660258] Bluetooth: hci5: command tx timeout
[ 76.388195] Bluetooth: hci0: command tx timeout
[ 76.388639] Bluetooth: hci1: command tx timeout
[ 76.452238] Bluetooth: hci2: command tx timeout
[ 76.644236] Bluetooth: hci7: command tx timeout
[ 76.644681] Bluetooth: hci4: command tx timeout
[ 76.645010] Bluetooth: hci3: command tx timeout
[ 76.645565] Bluetooth: hci6: command tx timeout
[ 76.708123] Bluetooth: hci5: command tx timeout
[ 78.435144] Bluetooth: hci1: command tx timeout
[ 78.435244] Bluetooth: hci0: command tx timeout
[ 78.500198] Bluetooth: hci2: command tx timeout
[ 78.691143] Bluetooth: hci6: command tx timeout
[ 78.692638] Bluetooth: hci4: command tx timeout
[ 78.693030] Bluetooth: hci3: command tx timeout
[ 78.693426] Bluetooth: hci7: command tx timeout
[ 78.756123] Bluetooth: hci5: command tx timeout
[ 108.360330] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.361021] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.390133] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.390762] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.409195] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.409834] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.453198] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.453816] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.474609] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.475322] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.527332] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.527921] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.573891] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.574525] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.584293] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.584920] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.614652] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.615243] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:36:57 executing program 6:
modify_ldt$write(0x1, &(0x7f0000000080), 0x10)
modify_ldt$write(0xffffc90000000000, 0x0, 0x0)
08:36:57 executing program 6:
modify_ldt$write(0x1, &(0x7f0000000080), 0x10)
modify_ldt$write(0xffffc90000000000, 0x0, 0x0)
[ 108.699239] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.699782] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.734465] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.735040] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:36:57 executing program 6:
modify_ldt$write(0x1, &(0x7f0000000080), 0x10)
modify_ldt$write(0xffffc90000000000, 0x0, 0x0)
[ 108.793142] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.793743] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:36:57 executing program 6:
syz_mount_image$iso9660(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, 0x0)
chroot(&(0x7f00000004c0)='./file0\x00')
umount2(&(0x7f0000000000)='./file0\x00', 0x0)
removexattr(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)=@random={'system.', 'unconfined_u'})
[ 108.856387] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.857008] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:36:57 executing program 6:
syz_mount_image$iso9660(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, 0x0)
chroot(&(0x7f00000004c0)='./file0\x00')
umount2(&(0x7f0000000000)='./file0\x00', 0x0)
removexattr(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)=@random={'system.', 'unconfined_u'})
[ 108.917429] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.918057] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:36:57 executing program 4:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@getspdinfo={0x14, 0x25, 0x1}, 0x14}}, 0x0)
[ 108.989371] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.990018] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:36:57 executing program 6:
syz_mount_image$iso9660(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, 0x0)
chroot(&(0x7f00000004c0)='./file0\x00')
umount2(&(0x7f0000000000)='./file0\x00', 0x0)
removexattr(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)=@random={'system.', 'unconfined_u'})
[ 109.018452] audit: type=1400 audit(1756715817.954:8): avc: denied { open } for pid=3890 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[ 109.020400] audit: type=1400 audit(1756715817.954:9): avc: denied { kernel } for pid=3890 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[ 109.022851] tmpfs: Bad value for 'mpol'
[ 109.029610] tmpfs: Bad value for 'mpol'
[ 109.096106] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.096802] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:36:58 executing program 0:
msgrcv(0xffffffffffffffff, 0x0, 0xa6, 0x0, 0x0)
08:36:58 executing program 7:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1={0xff, 0x5}}, 0x1c)
08:36:58 executing program 4:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@getspdinfo={0x14, 0x25, 0x1}, 0x14}}, 0x0)
08:36:58 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={[{@mpol={'mpol', 0x3d, {'prefer', '=relative', @val={0x3a, [0x32, 0x2d, 0x39, 0x2c, 0x34]}}}}]})
08:36:58 executing program 2:
r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0)
lseek(r0, 0x0, 0x4)
08:36:58 executing program 6:
syz_mount_image$iso9660(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, 0x0)
chroot(&(0x7f00000004c0)='./file0\x00')
umount2(&(0x7f0000000000)='./file0\x00', 0x0)
removexattr(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)=@random={'system.', 'unconfined_u'})
08:36:58 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
read(r0, 0x0, 0x0)
08:36:58 executing program 5:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x30, &(0x7f00000001c0)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108)
[ 109.314175] tmpfs: Bad value for 'mpol'
08:36:58 executing program 4:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@getspdinfo={0x14, 0x25, 0x1}, 0x14}}, 0x0)
08:36:58 executing program 0:
msgrcv(0xffffffffffffffff, 0x0, 0xa6, 0x0, 0x0)
[ 109.364278] kmemleak: Found object by alias at 0x607f1a63e83c
[ 109.364294] CPU: 0 UID: 0 PID: 3919 Comm: syz-executor.3 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 109.364313] Tainted: [W]=WARN
[ 109.364317] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 109.364324] Call Trace:
[ 109.364328]
[ 109.364333] dump_stack_lvl+0xca/0x120
[ 109.364364] __lookup_object+0x94/0xb0
[ 109.364383] delete_object_full+0x27/0x70
[ 109.364400] free_percpu+0x30/0x1160
[ 109.364417] ? arch_uprobe_clear_state+0x16/0x140
[ 109.364438] futex_hash_free+0x38/0xc0
[ 109.364453] mmput+0x2d3/0x390
[ 109.364472] do_exit+0x79d/0x2970
[ 109.364486] ? lock_release+0xc8/0x290
[ 109.364505] ? __pfx_do_exit+0x10/0x10
[ 109.364520] ? find_held_lock+0x2b/0x80
[ 109.364538] ? get_signal+0x835/0x2340
[ 109.364558] do_group_exit+0xd3/0x2a0
[ 109.364574] get_signal+0x2315/0x2340
[ 109.364592] ? __virt_addr_valid+0x2e8/0x5d0
[ 109.364615] ? __pfx_get_signal+0x10/0x10
[ 109.364631] ? do_futex+0x135/0x370
[ 109.364645] ? __pfx_do_futex+0x10/0x10
[ 109.364658] ? trace_irq_enable.constprop.0+0xc2/0x100
[ 109.364674] arch_do_signal_or_restart+0x80/0x790
[ 109.364693] ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 109.364709] ? __x64_sys_futex+0x1c9/0x4d0
[ 109.364722] ? __x64_sys_futex+0x1d2/0x4d0
[ 109.364738] ? __pfx___x64_sys_futex+0x10/0x10
[ 109.364752] ? xfd_validate_state+0x55/0x180
[ 109.364768] ? __pfx___x64_sys_mount+0x10/0x10
[ 109.364787] exit_to_user_mode_loop+0x8b/0x110
[ 109.364801] do_syscall_64+0x2f7/0x360
[ 109.364814] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.364827] RIP: 0033:0x7f3d34368b19
[ 109.364836] Code: Unable to access opcode bytes at 0x7f3d34368aef.
[ 109.364841] RSP: 002b:00007f3d318de218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 109.364853] RAX: fffffffffffffe00 RBX: 00007f3d3447bf68 RCX: 00007f3d34368b19
[ 109.364861] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3d3447bf68
[ 109.364868] RBP: 00007f3d3447bf60 R08: 0000000000000000 R09: 0000000000000000
[ 109.364876] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3d3447bf6c
[ 109.364883] R13: 00007fff20fea58f R14: 00007f3d318de300 R15: 0000000000022000
[ 109.364899]
[ 109.364903] kmemleak: Object (percpu) 0x607f1a63e838 (size 8):
[ 109.364910] kmemleak: comm "syz-executor.6", pid 3916, jiffies 4294776115
[ 109.364917] kmemleak: min_count = 1
[ 109.364921] kmemleak: count = 0
[ 109.364925] kmemleak: flags = 0x21
[ 109.364929] kmemleak: checksum = 0
[ 109.364933] kmemleak: backtrace:
[ 109.364937] pcpu_alloc_noprof+0x87a/0x1170
[ 109.364952] alloc_vfsmnt+0x135/0x6e0
[ 109.364967] vfs_create_mount.part.0+0x40/0x440
[ 109.364983] path_mount+0x1637/0x1dd0
[ 109.364994] __x64_sys_mount+0x27b/0x300
[ 109.365006] do_syscall_64+0xbf/0x360
[ 109.365015] entry_SYSCALL_64_after_hwframe+0x77/0x7f
08:36:58 executing program 7:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1={0xff, 0x5}}, 0x1c)
08:36:58 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
read(r0, 0x0, 0x0)
08:36:58 executing program 5:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x30, &(0x7f00000001c0)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108)
08:36:58 executing program 2:
r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0)
lseek(r0, 0x0, 0x4)
08:36:58 executing program 0:
msgrcv(0xffffffffffffffff, 0x0, 0xa6, 0x0, 0x0)
08:36:58 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={[{@mpol={'mpol', 0x3d, {'prefer', '=relative', @val={0x3a, [0x32, 0x2d, 0x39, 0x2c, 0x34]}}}}]})
08:36:58 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1={0xff, 0x5}}, 0x1c)
08:36:58 executing program 4:
syz_mount_image$iso9660(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, 0x0)
chroot(&(0x7f00000004c0)='./file0\x00')
umount2(&(0x7f0000000000)='./file0\x00', 0x0)
removexattr(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)=@random={'system.', 'unconfined_u'})
[ 109.473312] tmpfs: Bad value for 'mpol'
[ 109.500764] kmemleak: Found object by alias at 0x607f1a63e83c
[ 109.500777] CPU: 0 UID: 0 PID: 3928 Comm: syz-executor.3 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 109.500795] Tainted: [W]=WARN
[ 109.500799] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 109.500807] Call Trace:
[ 109.500811]
[ 109.500816] dump_stack_lvl+0xca/0x120
[ 109.500845] __lookup_object+0x94/0xb0
[ 109.500863] delete_object_full+0x27/0x70
[ 109.500880] free_percpu+0x30/0x1160
[ 109.500897] ? arch_uprobe_clear_state+0x16/0x140
[ 109.500926] futex_hash_free+0x38/0xc0
[ 109.500941] mmput+0x2d3/0x390
[ 109.500960] do_exit+0x79d/0x2970
[ 109.500974] ? signal_wake_up_state+0x85/0x120
[ 109.500991] ? zap_other_threads+0x2b9/0x3a0
[ 109.501007] ? __pfx_do_exit+0x10/0x10
[ 109.501020] ? do_group_exit+0x1c3/0x2a0
[ 109.501034] ? lock_release+0xc8/0x290
[ 109.501052] do_group_exit+0xd3/0x2a0
[ 109.501067] __x64_sys_exit_group+0x3e/0x50
[ 109.501082] x64_sys_call+0x18c5/0x18d0
[ 109.501098] do_syscall_64+0xbf/0x360
[ 109.501112] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.501124] RIP: 0033:0x7f3d34368b19
[ 109.501133] Code: Unable to access opcode bytes at 0x7f3d34368aef.
[ 109.501138] RSP: 002b:00007fff20fea7b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 109.501150] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f3d34368b19
[ 109.501157] RDX: 00007f3d3431b72b RSI: ffffffffffffffbc RDI: 0000000000000000
[ 109.501165] RBP: 0000000000000000 R08: 0000001b2d32001c R09: 0000000000000000
[ 109.501172] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 109.501179] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff20fea8a0
[ 109.501195]
[ 109.501199] kmemleak: Object (percpu) 0x607f1a63e838 (size 8):
[ 109.501206] kmemleak: comm "syz-executor.6", pid 3940, jiffies 4294776277
[ 109.501213] kmemleak: min_count = 1
[ 109.501217] kmemleak: count = 0
[ 109.501221] kmemleak: flags = 0x21
[ 109.501225] kmemleak: checksum = 0
[ 109.501229] kmemleak: backtrace:
[ 109.501232] pcpu_alloc_noprof+0x87a/0x1170
[ 109.501248] perf_trace_event_init+0x366/0xa10
[ 109.501262] perf_trace_init+0x1a4/0x2f0
[ 109.501275] perf_tp_event_init+0xa6/0x120
[ 109.501291] perf_try_init_event+0x140/0x9f0
[ 109.501305] perf_event_alloc.part.0+0x118e/0x45f0
[ 109.501323] __do_sys_perf_event_open+0x719/0x2c20
[ 109.501336] do_syscall_64+0xbf/0x360
[ 109.501346] entry_SYSCALL_64_after_hwframe+0x77/0x7f
08:36:58 executing program 2:
r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0)
lseek(r0, 0x0, 0x4)
08:36:58 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x0)
read(r0, 0x0, 0x0)
08:36:58 executing program 7:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1={0xff, 0x5}}, 0x1c)
08:36:58 executing program 4:
syz_mount_image$iso9660(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, 0x0)
chroot(&(0x7f00000004c0)='./file0\x00')
umount2(&(0x7f0000000000)='./file0\x00', 0x0)
removexattr(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)=@random={'system.', 'unconfined_u'})
08:36:58 executing program 3:
syz_mount_image$tmpfs(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={[{@mpol={'mpol', 0x3d, {'prefer', '=relative', @val={0x3a, [0x32, 0x2d, 0x39, 0x2c, 0x34]}}}}]})
08:36:58 executing program 5:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x30, &(0x7f00000001c0)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108)
08:36:58 executing program 2:
personality(0xd400001)
syz_io_uring_setup(0x2260, &(0x7f0000003a00), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000003a80), &(0x7f0000003ac0))
08:36:58 executing program 0:
syz_mount_image$iso9660(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, 0x0)
chroot(&(0x7f00000004c0)='./file0\x00')
umount2(&(0x7f0000000000)='./file0\x00', 0x0)
removexattr(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)=@random={'system.', 'unconfined_u'})
08:36:58 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1={0xff, 0x5}}, 0x1c)
08:36:58 executing program 1:
r0 = socket$inet(0x2, 0x80003, 0xff)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0xa7, 0x4)
sendto$inet(r0, &(0x7f0000000000)="60da7056a593ccc8bd2563073c967f6a9af19d7a", 0x14, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10)
recvmmsg(r0, &(0x7f0000000580)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}}], 0x2, 0x2102, 0x0)
08:36:58 executing program 7:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x800448d2, 0xfffffffffffffffe)
[ 109.708982] tmpfs: Bad value for 'mpol'
08:36:58 executing program 1:
r0 = socket$inet(0x2, 0x80003, 0xff)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0xa7, 0x4)
sendto$inet(r0, &(0x7f0000000000)="60da7056a593ccc8bd2563073c967f6a9af19d7a", 0x14, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10)
recvmmsg(r0, &(0x7f0000000580)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}}], 0x2, 0x2102, 0x0)
08:36:58 executing program 0:
syz_mount_image$iso9660(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, 0x0)
chroot(&(0x7f00000004c0)='./file0\x00')
umount2(&(0x7f0000000000)='./file0\x00', 0x0)
removexattr(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)=@random={'system.', 'unconfined_u'})
08:36:58 executing program 2:
personality(0xd400001)
syz_io_uring_setup(0x2260, &(0x7f0000003a00), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000003a80), &(0x7f0000003ac0))
08:36:58 executing program 7:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x800448d2, 0xfffffffffffffffe)
08:36:58 executing program 4:
syz_mount_image$iso9660(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, 0x0)
chroot(&(0x7f00000004c0)='./file0\x00')
umount2(&(0x7f0000000000)='./file0\x00', 0x0)
removexattr(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)=@random={'system.', 'unconfined_u'})
08:36:58 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1={0xff, 0x5}}, 0x1c)
08:36:58 executing program 3:
personality(0xd400001)
syz_io_uring_setup(0x2260, &(0x7f0000003a00), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000003a80), &(0x7f0000003ac0))
08:36:58 executing program 5:
r0 = socket$inet(0x2, 0x80003, 0xff)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0xa7, 0x4)
sendto$inet(r0, &(0x7f0000000000)="60da7056a593ccc8bd2563073c967f6a9af19d7a", 0x14, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10)
recvmmsg(r0, &(0x7f0000000580)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}}], 0x2, 0x2102, 0x0)
08:36:58 executing program 7:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x800448d2, 0xfffffffffffffffe)
08:36:58 executing program 1:
r0 = socket$inet(0x2, 0x80003, 0xff)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0xa7, 0x4)
sendto$inet(r0, &(0x7f0000000000)="60da7056a593ccc8bd2563073c967f6a9af19d7a", 0x14, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10)
recvmmsg(r0, &(0x7f0000000580)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}}], 0x2, 0x2102, 0x0)
08:36:58 executing program 2:
personality(0xd400001)
syz_io_uring_setup(0x2260, &(0x7f0000003a00), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000003a80), &(0x7f0000003ac0))
08:36:58 executing program 5:
r0 = socket$inet(0x2, 0x80003, 0xff)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0xa7, 0x4)
sendto$inet(r0, &(0x7f0000000000)="60da7056a593ccc8bd2563073c967f6a9af19d7a", 0x14, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10)
recvmmsg(r0, &(0x7f0000000580)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}}], 0x2, 0x2102, 0x0)
08:36:58 executing program 3:
personality(0xd400001)
syz_io_uring_setup(0x2260, &(0x7f0000003a00), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000003a80), &(0x7f0000003ac0))
08:36:58 executing program 0:
syz_mount_image$iso9660(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='devpts\x00', 0x0, 0x0)
chroot(&(0x7f00000004c0)='./file0\x00')
umount2(&(0x7f0000000000)='./file0\x00', 0x0)
removexattr(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)=@random={'system.', 'unconfined_u'})
08:36:58 executing program 1:
r0 = socket$inet(0x2, 0x80003, 0xff)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0xa7, 0x4)
sendto$inet(r0, &(0x7f0000000000)="60da7056a593ccc8bd2563073c967f6a9af19d7a", 0x14, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10)
recvmmsg(r0, &(0x7f0000000580)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}}], 0x2, 0x2102, 0x0)
08:36:58 executing program 2:
personality(0xd400001)
syz_io_uring_setup(0x2260, &(0x7f0000003a00), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000003a80), &(0x7f0000003ac0))
08:36:58 executing program 7:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x800448d2, 0xfffffffffffffffe)
08:36:58 executing program 6:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000001c0)={0x28, 0x21, 0x1, 0x0, 0x0, "", [@nested={0x2, 0x0, 0x0, 0x1, [@typed={0x14, 0x100, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}]}, 0x28}], 0x1}, 0x0)
08:36:58 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001a000100000000000000000002a50043e29664b3223e"], 0x1c}], 0x1}, 0x0)
[ 110.059260] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.6'.
08:36:59 executing program 6:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000001c0)={0x28, 0x21, 0x1, 0x0, 0x0, "", [@nested={0x2, 0x0, 0x0, 0x1, [@typed={0x14, 0x100, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}]}, 0x28}], 0x1}, 0x0)
[ 110.134923] kmemleak: Found object by alias at 0x607f1a63e83c
[ 110.134944] CPU: 0 UID: 0 PID: 3993 Comm: syz-executor.3 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 110.134963] Tainted: [W]=WARN
[ 110.134967] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 110.134974] Call Trace:
[ 110.134978]
[ 110.134983] dump_stack_lvl+0xca/0x120
[ 110.135010] __lookup_object+0x94/0xb0
[ 110.135028] delete_object_full+0x27/0x70
[ 110.135045] free_percpu+0x30/0x1160
[ 110.135062] ? arch_uprobe_clear_state+0x16/0x140
[ 110.135083] futex_hash_free+0x38/0xc0
[ 110.135097] mmput+0x2d3/0x390
[ 110.135116] do_exit+0x79d/0x2970
[ 110.135131] ? signal_wake_up_state+0x85/0x120
[ 110.135148] ? zap_other_threads+0x2b9/0x3a0
[ 110.135164] ? __pfx_do_exit+0x10/0x10
[ 110.135177] ? do_group_exit+0x1c3/0x2a0
[ 110.135191] ? lock_release+0xc8/0x290
[ 110.135208] do_group_exit+0xd3/0x2a0
[ 110.135224] __x64_sys_exit_group+0x3e/0x50
[ 110.135238] x64_sys_call+0x18c5/0x18d0
[ 110.135254] do_syscall_64+0xbf/0x360
[ 110.135268] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.135279] RIP: 0033:0x7f3d34368b19
[ 110.135289] Code: Unable to access opcode bytes at 0x7f3d34368aef.
[ 110.135294] RSP: 002b:00007fff20fea7b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 110.135306] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f3d34368b19
[ 110.135314] RDX: 00007f3d3431b72b RSI: ffffffffffffffbc RDI: 0000000000000000
[ 110.135321] RBP: 0000000000000000 R08: 0000001b2d320088 R09: 0000000000000000
[ 110.135328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 110.135335] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff20fea8a0
[ 110.135350]
[ 110.135354] kmemleak: Object (percpu) 0x607f1a63e838 (size 8):
[ 110.135361] kmemleak: comm "syz-executor.0", pid 4001, jiffies 4294776870
[ 110.135368] kmemleak: min_count = 1
[ 110.135372] kmemleak: count = 0
[ 110.135375] kmemleak: flags = 0x21
[ 110.135379] kmemleak: checksum = 0
[ 110.135383] kmemleak: backtrace:
[ 110.135387] pcpu_alloc_noprof+0x87a/0x1170
[ 110.135403] alloc_vfsmnt+0x135/0x6e0
[ 110.135417] vfs_create_mount.part.0+0x40/0x440
[ 110.135432] path_mount+0x1637/0x1dd0
[ 110.135444] __x64_sys_mount+0x27b/0x300
[ 110.135456] do_syscall_64+0xbf/0x360
[ 110.135465] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.164792] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.6'.
08:36:59 executing program 5:
r0 = socket$inet(0x2, 0x80003, 0xff)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0xa7, 0x4)
sendto$inet(r0, &(0x7f0000000000)="60da7056a593ccc8bd2563073c967f6a9af19d7a", 0x14, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10)
recvmmsg(r0, &(0x7f0000000580)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}}], 0x2, 0x2102, 0x0)
08:36:59 executing program 1:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x28, r1, 0xe8d1d2a726c149b9, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0)
08:36:59 executing program 7:
sched_rr_get_interval(0x0, &(0x7f0000000100))
08:36:59 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001a000100000000000000000002a50043e29664b3223e"], 0x1c}], 0x1}, 0x0)
08:36:59 executing program 3:
personality(0xd400001)
syz_io_uring_setup(0x2260, &(0x7f0000003a00), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000003a80), &(0x7f0000003ac0))
08:36:59 executing program 6:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000001c0)={0x28, 0x21, 0x1, 0x0, 0x0, "", [@nested={0x2, 0x0, 0x0, 0x1, [@typed={0x14, 0x100, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}]}, 0x28}], 0x1}, 0x0)
08:36:59 executing program 7:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
clone(0x0, 0x0, 0x0, 0x0, 0x0)
08:36:59 executing program 2:
prctl$PR_SET_IO_FLUSHER(0x4a, 0x0)
08:36:59 executing program 1:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x28, r1, 0xe8d1d2a726c149b9, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0)
[ 110.280590] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.6'.
08:36:59 executing program 6:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000001c0)={0x28, 0x21, 0x1, 0x0, 0x0, "", [@nested={0x2, 0x0, 0x0, 0x1, [@typed={0x14, 0x100, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}]}, 0x28}], 0x1}, 0x0)
08:36:59 executing program 0:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000140))
08:36:59 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001a000100000000000000000002a50043e29664b3223e"], 0x1c}], 0x1}, 0x0)
08:36:59 executing program 2:
prctl$PR_SET_IO_FLUSHER(0x4a, 0x0)
08:36:59 executing program 1:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x28, r1, 0xe8d1d2a726c149b9, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0)
08:36:59 executing program 7:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
clone(0x0, 0x0, 0x0, 0x0, 0x0)
08:36:59 executing program 3:
perf_event_open(&(0x7f0000000800)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
08:36:59 executing program 5:
syz_genetlink_get_family_id$nl802154(0xfffffffffffffffc, 0xffffffffffffffff)
[ 110.390298] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.6'.
08:36:59 executing program 1:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000006c0), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x28, r1, 0xe8d1d2a726c149b9, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0)
08:36:59 executing program 2:
prctl$PR_SET_IO_FLUSHER(0x4a, 0x0)
08:36:59 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001a000100000000000000000002a50043e29664b3223e"], 0x1c}], 0x1}, 0x0)
08:36:59 executing program 0:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000140))
08:36:59 executing program 3:
perf_event_open(&(0x7f0000000800)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
08:36:59 executing program 3:
perf_event_open(&(0x7f0000000800)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
08:36:59 executing program 4:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe)
keyctl$chown(0x7, r0, 0x0, 0x0)
08:36:59 executing program 1:
syz_mount_image$tmpfs(&(0x7f0000000000), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'wlan0\x00', &(0x7f0000000000)=@ethtool_rx_ntuple={0x2c, {0x0, @tcp_ip4_spec={@rand_addr, @private}, @esp_ip4_spec={@multicast1, @local}}}})
08:36:59 executing program 2:
prctl$PR_SET_IO_FLUSHER(0x4a, 0x0)
08:36:59 executing program 0:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000140))
08:36:59 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0)
fchmod(r0, 0x0)
08:36:59 executing program 7:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
clone(0x0, 0x0, 0x0, 0x0, 0x0)
08:36:59 executing program 5:
syz_genetlink_get_family_id$nl802154(0xfffffffffffffffc, 0xffffffffffffffff)
[ 110.629909] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#1] SMP KASAN NOPTI
[ 110.630890] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[ 110.631502] CPU: 1 UID: 0 PID: 4063 Comm: syz-executor.4 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 110.633672] Tainted: [W]=WARN
[ 110.634281] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 110.635898] RIP: 0010:perf_tp_event+0x175/0xe70
[ 110.636883] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 110.640984] RSP: 0018:ffff888044ff7800 EFLAGS: 00010212
[ 110.641831] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90005e18000
[ 110.642411] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 110.642983] RBP: ffff888044ff7a70 R08: ffff88806cf31340 R09: ffffe8ffffd16838
[ 110.643562] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 110.644125] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[ 110.644699] FS: 00007fb06d4eb700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000
[ 110.645328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 110.645788] CR2: 0000555557c85708 CR3: 000000000e241000 CR4: 0000000000350ef0
[ 110.646350] Call Trace:
[ 110.646559]
[ 110.646749] ? __pfx_perf_tp_event+0x10/0x10
[ 110.647106] ? lock_is_held_type+0x9e/0x120
[ 110.647457] ? lock_is_held_type+0x9e/0x120
[ 110.647808] ? perf_trace_lock+0xb5/0x5d0
[ 110.648145] ? perf_trace_lock+0xb5/0x5d0
[ 110.648488] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.648857] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.649228] ? find_held_lock+0x2b/0x80
[ 110.649556] ? find_held_lock+0x2b/0x80
[ 110.649879] ? __perf_install_in_context+0x503/0xb90
[ 110.650285] ? lock_release+0xc8/0x290
[ 110.650604] ? do_raw_spin_unlock+0x53/0x220
[ 110.650963] ? perf_trace_run_bpf_submit+0xef/0x180
[ 110.651365] perf_trace_run_bpf_submit+0xef/0x180
[ 110.651756] perf_trace_lock+0x337/0x5d0
[ 110.652086] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.652468] ? lock_acquire+0x15e/0x2f0
[ 110.652789] ? futex_ref_get+0x48/0x300
[ 110.653112] ? futex_ref_get+0x114/0x300
[ 110.653441] ? futex_hash+0x15c/0x390
[ 110.653747] lock_release+0x1ab/0x290
[ 110.654058] ? futex_hash+0x15c/0x390
[ 110.654363] futex_ref_get+0x119/0x300
[ 110.654677] ? futex_hash+0x15c/0x390
[ 110.654981] futex_hash+0x70/0x390
[ 110.655271] futex_wake+0x143/0x540
[ 110.655571] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.655941] ? __pfx_futex_wake+0x10/0x10
[ 110.656288] ? __do_sys_perf_event_open+0x44d/0x2c20
[ 110.656696] ? lock_release+0xc8/0x290
[ 110.657014] do_futex+0x26d/0x370
[ 110.657297] ? __pfx_do_futex+0x10/0x10
[ 110.657623] ? __pfx___do_sys_perf_event_open+0x10/0x10
[ 110.658051] ? find_held_lock+0x2b/0x80
[ 110.658378] __x64_sys_futex+0x1c9/0x4d0
[ 110.658708] ? __pfx___x64_sys_futex+0x10/0x10
[ 110.659078] ? xfd_validate_state+0x55/0x180
[ 110.659442] do_syscall_64+0xbf/0x360
[ 110.659749] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.660160] RIP: 0033:0x7fb06ff75b19
[ 110.660485] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 110.661904] RSP: 002b:00007fb06d4eb218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 110.662499] RAX: ffffffffffffffda RBX: 00007fb070088f68 RCX: 00007fb06ff75b19
[ 110.663065] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fb070088f6c
[ 110.663625] RBP: 00007fb070088f60 R08: 000000000000000e R09: 0000000000000000
[ 110.664186] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fb070088f6c
[ 110.664753] R13: 00007ffe88466a7f R14: 00007fb06d4eb300 R15: 0000000000022000
[ 110.665319]
[ 110.665510] Modules linked in:
[ 110.665794] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#2] SMP KASAN NOPTI
[ 110.666669] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[ 110.667258] CPU: 1 UID: 0 PID: 4063 Comm: syz-executor.4 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 110.668191] Tainted: [D]=DIE, [W]=WARN
[ 110.668503] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 110.669151] RIP: 0010:perf_tp_event+0x175/0xe70
[ 110.669529] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 110.670947] RSP: 0018:ffff88806cf08a80 EFLAGS: 00010012
[ 110.671367] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[ 110.671919] RDX: ffff888043653700 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 110.672488] RBP: ffff88806cf08cf0 R08: ffff88806cf31490 R09: ffffe8ffffd16838
[ 110.673050] R10: 0000000000000000 R11: 746e756f63716573 R12: dffffc0000000000
[ 110.673610] R13: 000000000000002c R14: ffff88806cf31490 R15: dffffc0000000000
[ 110.674169] FS: 00007fb06d4eb700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000
[ 110.674798] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 110.675258] CR2: 0000555557c85708 CR3: 000000000e241000 CR4: 0000000000350ef0
[ 110.675818] Call Trace:
[ 110.676025]
[ 110.676210] ? __pfx_perf_tp_event+0x10/0x10
[ 110.676573] ? __pfx_css_rstat_updated+0x10/0x10
[ 110.676955] ? lock_is_held_type+0x9e/0x120
[ 110.677303] ? trace_pelt_se_tp+0xdf/0x130
[ 110.677640] ? __update_load_avg_se+0x428/0xa40
[ 110.678018] ? lock_is_held_type+0x9e/0x120
[ 110.678369] ? update_load_avg+0x17d/0x1ef0
[ 110.678714] ? perf_trace_lock+0xb5/0x5d0
[ 110.679045] ? perf_trace_lock+0xb5/0x5d0
[ 110.679375] ? update_cfs_group+0x11d/0x260
[ 110.679719] ? kvm_sched_clock_read+0x16/0x30
[ 110.680083] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.680454] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.680821] ? lock_is_held_type+0x9e/0x120
[ 110.681174] ? perf_trace_run_bpf_submit+0xef/0x180
[ 110.681574] perf_trace_run_bpf_submit+0xef/0x180
[ 110.681965] perf_trace_lock+0x337/0x5d0
[ 110.682295] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.682666] ? find_held_lock+0x2b/0x80
[ 110.682988] ? hrtimer_interrupt+0x114/0x830
[ 110.683340] lock_release+0x1ab/0x290
[ 110.683652] ktime_get_update_offsets_now+0xab/0x3c0
[ 110.684055] ? hrtimer_interrupt+0x114/0x830
[ 110.684414] ? __pfx_lapic_next_deadline+0x10/0x10
[ 110.684810] hrtimer_interrupt+0x114/0x830
[ 110.685149] ? __pfx_flush_tlb_func+0x10/0x10
[ 110.685508] ? trace_csd_function_exit+0x134/0x190
[ 110.685901] ? __flush_smp_call_function_queue+0x28c/0x740
[ 110.686349] __sysvec_apic_timer_interrupt+0xbb/0x330
[ 110.686760] sysvec_apic_timer_interrupt+0x6b/0x80
[ 110.687151]
[ 110.687335]
[ 110.687516] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 110.687927] RIP: 0010:oops_exit+0x0/0x50
[ 110.688262] Code: 00 3a 00 be ff ff ff ff 48 c7 c7 50 b4 43 86 e8 c6 0f f9 ff 5b e9 50 00 3a 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 53 e8 36 00 3a 00 8b 1d c0 3d 4f 06 31 ff 89 de e8 57
[ 110.689680] RSP: 0018:ffff888044ff7690 EFLAGS: 00000202
[ 110.690102] RAX: 000000000002be2f RBX: 0000000000000216 RCX: ffffc90005e18000
[ 110.690663] RDX: 0000000000040000 RSI: ffffffff812a3dca RDI: 0000000000000007
[ 110.691225] RBP: 000000000000000b R08: 0000000000000001 R09: fffffbfff0f12690
[ 110.691788] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888044ff7758
[ 110.692356] R13: 0000000000000000 R14: dffffc0000000032 R15: 0000000000000000
[ 110.692920] ? oops_end+0x4a/0xe0
[ 110.693208] oops_end+0x65/0xe0
[ 110.693486] exc_general_protection+0x1a2/0x330
[ 110.693864] asm_exc_general_protection+0x26/0x30
[ 110.694248] RIP: 0010:perf_tp_event+0x175/0xe70
[ 110.694623] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 110.696061] RSP: 0018:ffff888044ff7800 EFLAGS: 00010212
[ 110.696492] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90005e18000
[ 110.697052] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 110.697609] RBP: ffff888044ff7a70 R08: ffff88806cf31340 R09: ffffe8ffffd16838
[ 110.698175] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 110.698740] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[ 110.699308] ? perf_tp_event+0x167/0xe70
[ 110.699643] ? __pfx_perf_tp_event+0x10/0x10
[ 110.700003] ? lock_is_held_type+0x9e/0x120
[ 110.700357] ? lock_is_held_type+0x9e/0x120
[ 110.700705] ? perf_trace_lock+0xb5/0x5d0
[ 110.701041] ? perf_trace_lock+0xb5/0x5d0
[ 110.701372] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.701741] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.702122] ? find_held_lock+0x2b/0x80
[ 110.702453] ? find_held_lock+0x2b/0x80
[ 110.702785] ? __perf_install_in_context+0x503/0xb90
[ 110.703199] ? lock_release+0xc8/0x290
[ 110.703521] ? do_raw_spin_unlock+0x53/0x220
[ 110.703889] ? perf_trace_run_bpf_submit+0xef/0x180
[ 110.704309] perf_trace_run_bpf_submit+0xef/0x180
[ 110.704716] perf_trace_lock+0x337/0x5d0
[ 110.705053] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.705429] ? lock_acquire+0x15e/0x2f0
[ 110.705762] ? futex_ref_get+0x48/0x300
[ 110.706090] ? futex_ref_get+0x114/0x300
[ 110.706425] ? futex_hash+0x15c/0x390
[ 110.706738] lock_release+0x1ab/0x290
[ 110.707054] ? futex_hash+0x15c/0x390
[ 110.707372] futex_ref_get+0x119/0x300
[ 110.707696] ? futex_hash+0x15c/0x390
[ 110.708010] futex_hash+0x70/0x390
[ 110.708312] futex_wake+0x143/0x540
[ 110.708613] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.708992] ? __pfx_futex_wake+0x10/0x10
[ 110.709340] ? __do_sys_perf_event_open+0x44d/0x2c20
[ 110.709757] ? lock_release+0xc8/0x290
[ 110.710081] do_futex+0x26d/0x370
[ 110.710370] ? __pfx_do_futex+0x10/0x10
[ 110.710701] ? __pfx___do_sys_perf_event_open+0x10/0x10
[ 110.711131] ? find_held_lock+0x2b/0x80
[ 110.711465] __x64_sys_futex+0x1c9/0x4d0
[ 110.711797] ? __pfx___x64_sys_futex+0x10/0x10
[ 110.712171] ? xfd_validate_state+0x55/0x180
[ 110.712543] do_syscall_64+0xbf/0x360
[ 110.712870] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.713299] RIP: 0033:0x7fb06ff75b19
[ 110.713602] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 110.715120] RSP: 002b:00007fb06d4eb218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 110.715735] RAX: ffffffffffffffda RBX: 00007fb070088f68 RCX: 00007fb06ff75b19
[ 110.716317] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fb070088f6c
[ 110.716916] RBP: 00007fb070088f60 R08: 000000000000000e R09: 0000000000000000
[ 110.717509] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fb070088f6c
[ 110.718105] R13: 00007ffe88466a7f R14: 00007fb06d4eb300 R15: 0000000000022000
[ 110.718690]
[ 110.718886] Modules linked in:
[ 110.719168] ---[ end trace 0000000000000000 ]---
[ 110.719174] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#3] SMP KASAN NOPTI
[ 110.719582] RIP: 0010:perf_tp_event+0x175/0xe70
[ 110.721496] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[ 110.721863] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 110.723324] CPU: 0 UID: 0 PID: 4070 Comm: syz-executor.3 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 110.724807] RSP: 0018:ffff888044ff7800 EFLAGS: 00010212
[ 110.724819] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90005e18000
[ 110.726809] Tainted: [D]=DIE, [W]=WARN
[ 110.727250] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 110.727259] RBP: ffff888044ff7a70 R08: ffff88806cf31340 R09: ffffe8ffffd16838
[ 110.728456] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 110.728771] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 110.728780] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[ 110.729973] RIP: 0010:perf_tp_event+0x175/0xe70
[ 110.730574] FS: 00007fb06d4eb700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000
[ 110.731959] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 110.732535] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 110.733735] RSP: 0018:ffff888044eaf600 EFLAGS: 00010212
[ 110.734120] CR2: 0000555557c85708 CR3: 000000000e241000 CR4: 0000000000350ef0
[ 110.735456]
[ 110.736974] Kernel panic - not syncing: Fatal exception in interrupt
[ 110.740132] Kernel Offset: disabled
[ 110.740445] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
VM DIAGNOSIS:
08:36:59 Registers:
info registers vcpu 0
RAX=000000493e45e5a0 RBX=0000000000000000 RCX=00000000000006e0 RDX=0000000000000049
RSI=ffff88806ce238c0 RDI=000000000004fc99 RBP=ffff88806ce238c0 RSP=ffff88806ce08ed8
R8 =ffffffff84ca6fe0 R9 =0000000000000000 R10=00000000000e4648 R11=ffff88806ce37018
R12=000000000004fc99 R13=0000000000000000 R14=0000000000000000 R15=ffff88806ce28080
RIP=ffffffff81327f55 RFL=00000012 [----A--] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000555557cfd400 00000000 00000000
GS =0000 ffff8880e55d8000 00000000 00000000
LDT=0000 ffff888000000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007fc499e79000 CR3=00000000416b5000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007f4b0491b7c000007f4b0491b7c8
XMM02=00007f4b0491b7e000007f4b0491b7c0 XMM03=00007f4b0491b7c800007f4b0491b7c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=dffffc0000000005 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9
RSI=ffffffff828e5070 RDI=ffffffff88729280 RBP=ffffffff88729240 RSP=ffff888044ff7178
R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000000 R11=313030203a505352
R12=000000000000003b R13=ffffffff88729290 R14=ffffffff88729240 R15=ffffffff88729500
RIP=ffffffff828e50c5 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007fb06d4eb700 00000000 00000000
GS =0000 ffff8880e56d8000 00000000 00000000
LDT=0000 fffffe5300000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=0000555557c85708 CR3=000000000e241000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007fb07005c7c000007fb07005c7c8
XMM02=00007fb07005c7e000007fb07005c7c0 XMM03=00007fb07005c7c800007fb07005c7c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000