Warning: Permanently added '[localhost]:2017' (ECDSA) to the list of known hosts.
2025/09/01 09:27:19 fuzzer started
2025/09/01 09:27:20 dialing manager at localhost:35473
syzkaller login: [ 52.064701] cgroup: Unknown subsys name 'net'
[ 52.135001] cgroup: Unknown subsys name 'cpuset'
[ 52.160094] cgroup: Unknown subsys name 'rlimit'
2025/09/01 09:27:30 syscalls: 2214
2025/09/01 09:27:30 code coverage: enabled
2025/09/01 09:27:30 comparison tracing: enabled
2025/09/01 09:27:30 extra coverage: enabled
2025/09/01 09:27:30 setuid sandbox: enabled
2025/09/01 09:27:30 namespace sandbox: enabled
2025/09/01 09:27:30 Android sandbox: enabled
2025/09/01 09:27:30 fault injection: enabled
2025/09/01 09:27:30 leak checking: enabled
2025/09/01 09:27:30 net packet injection: enabled
2025/09/01 09:27:30 net device setup: enabled
2025/09/01 09:27:30 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2025/09/01 09:27:30 devlink PCI setup: PCI device 0000:00:10.0 is not available
2025/09/01 09:27:30 USB emulation: enabled
2025/09/01 09:27:30 hci packet injection: enabled
2025/09/01 09:27:30 wifi device emulation: enabled
2025/09/01 09:27:30 802.15.4 emulation: enabled
2025/09/01 09:27:30 fetching corpus: 0, signal 0/2000 (executing program)
2025/09/01 09:27:30 fetching corpus: 50, signal 25094/28433 (executing program)
2025/09/01 09:27:30 fetching corpus: 100, signal 36177/40729 (executing program)
2025/09/01 09:27:30 fetching corpus: 150, signal 43875/49506 (executing program)
2025/09/01 09:27:30 fetching corpus: 200, signal 49159/55874 (executing program)
2025/09/01 09:27:31 fetching corpus: 250, signal 56022/63589 (executing program)
2025/09/01 09:27:31 fetching corpus: 300, signal 62686/70850 (executing program)
2025/09/01 09:27:31 fetching corpus: 350, signal 65394/74433 (executing program)
2025/09/01 09:27:31 fetching corpus: 400, signal 67912/77801 (executing program)
2025/09/01 09:27:31 fetching corpus: 450, signal 70302/80964 (executing program)
2025/09/01 09:27:31 fetching corpus: 500, signal 73615/84886 (executing program)
2025/09/01 09:27:31 fetching corpus: 550, signal 76246/88139 (executing program)
2025/09/01 09:27:31 fetching corpus: 600, signal 78721/91148 (executing program)
2025/09/01 09:27:31 fetching corpus: 650, signal 80799/93830 (executing program)
2025/09/01 09:27:32 fetching corpus: 700, signal 83167/96672 (executing program)
2025/09/01 09:27:32 fetching corpus: 750, signal 86280/99984 (executing program)
2025/09/01 09:27:32 fetching corpus: 800, signal 88715/102677 (executing program)
2025/09/01 09:27:32 fetching corpus: 850, signal 90033/104482 (executing program)
2025/09/01 09:27:32 fetching corpus: 900, signal 91640/106420 (executing program)
2025/09/01 09:27:32 fetching corpus: 950, signal 93598/108652 (executing program)
2025/09/01 09:27:32 fetching corpus: 1000, signal 95480/110818 (executing program)
2025/09/01 09:27:32 fetching corpus: 1050, signal 99635/114531 (executing program)
2025/09/01 09:27:32 fetching corpus: 1100, signal 100990/116163 (executing program)
2025/09/01 09:27:33 fetching corpus: 1150, signal 102232/117622 (executing program)
2025/09/01 09:27:33 fetching corpus: 1200, signal 105094/120154 (executing program)
2025/09/01 09:27:33 fetching corpus: 1250, signal 106844/121912 (executing program)
2025/09/01 09:27:33 fetching corpus: 1300, signal 108314/123452 (executing program)
2025/09/01 09:27:33 fetching corpus: 1350, signal 109418/124727 (executing program)
2025/09/01 09:27:33 fetching corpus: 1400, signal 110668/126037 (executing program)
2025/09/01 09:27:34 fetching corpus: 1450, signal 111958/127321 (executing program)
2025/09/01 09:27:34 fetching corpus: 1500, signal 112726/128298 (executing program)
2025/09/01 09:27:34 fetching corpus: 1550, signal 114108/129677 (executing program)
2025/09/01 09:27:34 fetching corpus: 1600, signal 115349/130857 (executing program)
2025/09/01 09:27:34 fetching corpus: 1650, signal 116953/132187 (executing program)
2025/09/01 09:27:34 fetching corpus: 1700, signal 118118/133256 (executing program)
2025/09/01 09:27:34 fetching corpus: 1750, signal 119100/134236 (executing program)
2025/09/01 09:27:34 fetching corpus: 1800, signal 120220/135226 (executing program)
2025/09/01 09:27:35 fetching corpus: 1850, signal 121397/136233 (executing program)
2025/09/01 09:27:35 fetching corpus: 1900, signal 122450/137154 (executing program)
2025/09/01 09:27:35 fetching corpus: 1950, signal 123112/137840 (executing program)
2025/09/01 09:27:35 fetching corpus: 2000, signal 123982/138661 (executing program)
2025/09/01 09:27:35 fetching corpus: 2050, signal 126557/140092 (executing program)
2025/09/01 09:27:35 fetching corpus: 2100, signal 128089/141100 (executing program)
2025/09/01 09:27:35 fetching corpus: 2150, signal 129102/141827 (executing program)
2025/09/01 09:27:35 fetching corpus: 2200, signal 130082/142507 (executing program)
2025/09/01 09:27:35 fetching corpus: 2250, signal 131014/143130 (executing program)
2025/09/01 09:27:35 fetching corpus: 2300, signal 131698/143658 (executing program)
2025/09/01 09:27:36 fetching corpus: 2350, signal 132383/144147 (executing program)
2025/09/01 09:27:36 fetching corpus: 2400, signal 133097/144612 (executing program)
2025/09/01 09:27:36 fetching corpus: 2450, signal 133923/145130 (executing program)
2025/09/01 09:27:36 fetching corpus: 2500, signal 134826/145638 (executing program)
2025/09/01 09:27:36 fetching corpus: 2550, signal 135568/146085 (executing program)
2025/09/01 09:27:36 fetching corpus: 2600, signal 136271/146500 (executing program)
2025/09/01 09:27:36 fetching corpus: 2650, signal 137037/146891 (executing program)
2025/09/01 09:27:36 fetching corpus: 2700, signal 137648/147281 (executing program)
2025/09/01 09:27:36 fetching corpus: 2750, signal 138130/147586 (executing program)
2025/09/01 09:27:37 fetching corpus: 2800, signal 138720/147904 (executing program)
2025/09/01 09:27:37 fetching corpus: 2850, signal 139867/148342 (executing program)
2025/09/01 09:27:37 fetching corpus: 2900, signal 140455/148598 (executing program)
2025/09/01 09:27:37 fetching corpus: 2950, signal 140964/148857 (executing program)
2025/09/01 09:27:37 fetching corpus: 3000, signal 141738/149139 (executing program)
2025/09/01 09:27:37 fetching corpus: 3050, signal 142141/149339 (executing program)
2025/09/01 09:27:37 fetching corpus: 3100, signal 142778/149571 (executing program)
2025/09/01 09:27:37 fetching corpus: 3150, signal 143626/149806 (executing program)
2025/09/01 09:27:37 fetching corpus: 3200, signal 144158/149971 (executing program)
2025/09/01 09:27:37 fetching corpus: 3250, signal 144665/150137 (executing program)
2025/09/01 09:27:38 fetching corpus: 3300, signal 145367/150295 (executing program)
2025/09/01 09:27:38 fetching corpus: 3350, signal 146114/150496 (executing program)
2025/09/01 09:27:38 fetching corpus: 3400, signal 146719/150624 (executing program)
2025/09/01 09:27:38 fetching corpus: 3450, signal 147267/150786 (executing program)
2025/09/01 09:27:38 fetching corpus: 3500, signal 148167/150899 (executing program)
2025/09/01 09:27:38 fetching corpus: 3507, signal 148218/150942 (executing program)
2025/09/01 09:27:38 fetching corpus: 3507, signal 148218/150976 (executing program)
2025/09/01 09:27:38 fetching corpus: 3507, signal 148218/151014 (executing program)
2025/09/01 09:27:38 fetching corpus: 3507, signal 148218/151025 (executing program)
2025/09/01 09:27:38 fetching corpus: 3507, signal 148218/151025 (executing program)
2025/09/01 09:27:40 starting 8 fuzzer processes
09:27:40 executing program 0:
syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010600)="0243443030310100004c0049004e0055005800200020002000200020002000200020002000200020004300440052004f004d002000200020002000200020002000200020002000200000000000000000bf000000000000bf252f45", 0x5b, 0x8800}], 0x0, &(0x7f0000012200))
09:27:40 executing program 1:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000000)=""/255, &(0x7f0000000100)=0xff)
09:27:40 executing program 7:
r0 = memfd_create(&(0x7f0000000500)='\x02\xce\x16Td\xa8\x98\x86\xb1:\x8f\xc5\x88{\xbd\xb4\xc2\xb1\x9b\x84\x97R\xcc\xdb<\x01\xfa\x91\x85\xa0\x81\xa9F0!/\x89\xacX\xbd\xcd\x12R|lTn\xac-\xfd\x8b\n\x1a\xbc\xf0^B6\xb6`[/\xafE\xdaYz\xd6\xc7\xbc!\xe5\x89\xc8^\x06np\xc6\xe7\x1d\xe4\xbe\xcaa}\x1c\x12\xf9\xd8\xefw\xe1\xcb\x85\xdb?^\x8f\f\nD\xf2\x1f\x11\xaa\x90>N\xb7\x86\x15\x03=\xcc\xbe\x0f\x0f\x14\x84\xde:;\x0f\xb5\xf1\x86\xf2{y\xe0t\xa2\xe9\x01\x00\x00\x00\x8e:^v\xc9\x8d\xd7E\xb4\vw\xbe\\\x11J\xf4\xae\xc6\x88F\x9c\xaflM\x1dSHjH\xd6\x8d\xa6\xbd\x96\xe4SR\xe6\x118L*\x9b\xb2\tbg\xad\x0fRu\xeb\xe4{GO\xa5M\x80-Y\xc6\x1f%\xb8i|\x86\xa9Zm+\x9fe~\x8a\xe7\xca\f\xad?\xa0t\x13_Rq\x1f\xc6\xd9\x1d#\x8a8q\x1e#c\x8c\x193\xab\xdbE\xe1\xc8d=\xe5\r\xe6\x9a\xe5zc-\f\xe5#\xa2v\x1eY\xf0\xe3\x1c*h\xdbq\x92\xf8a6\x99\x02\xc9}\x14\xfb\x03\xce\xb34\x95/\x18\xacJs0\x9f\x9b>\xae\a2\x01\xa7\x95\xbd\xf2\x99w\x11G\x1c\xd2\xbc\xf0E\x86\xca\x87\xefv\x8e\xad\xb8\xc7u\xc2z\x85\xc1\xd5R\x82\v\x1b\xea\x8f\xad\xc1\x02\x8a$\xd1T\xce\xa6\xa2m\x18K\xd5-\x03\xa0\xeeF^F\vJLx\xdc\xc8\b\xb7\xa1j2l\x8fQ\xc1\x89\xb8\xbef\xc6\x90\r\xae\xd4S\x8f\x7f\xe2[\x1cs\xab&\xa3\x81B<\xc5]n\xfc', 0x3)
write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0xfffffd1f)
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$addseals(r0, 0x409, 0x9)
09:27:40 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000c00)=@acquire={0x134, 0x17, 0x1, 0x0, 0x0, {{@in=@broadcast}, @in6=@private0, {@in6=@private2, @in6=@local}, {{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa}}}, [@policy_type={0xa, 0x10, {0x1}}]}, 0x134}}, 0x0)
09:27:40 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0)
r1 = dup(r0)
ioctl$BLKSECTGET(r1, 0x227e, &(0x7f0000000040))
09:27:40 executing program 3:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_mount_image$tmpfs(&(0x7f0000000cc0), &(0x7f0000000d00)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e40)=ANY=[])
mknodat$loop(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0)
name_to_handle_at(r0, &(0x7f00000015c0)='./file0\x00', &(0x7f0000001600)=@ceph_nfs_confh={0x10}, &(0x7f0000001640), 0x0)
[ 72.079893] audit: type=1400 audit(1756718860.334:7): avc: denied { execmem } for pid=272 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
09:27:40 executing program 4:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/freeze_filesystems', 0x28181, 0x0)
pwritev(r0, &(0x7f0000000400)=[{&(0x7f0000000600)='9', 0x1}], 0x1, 0x0, 0x0)
09:27:40 executing program 5:
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000001b40))
[ 73.250869] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 73.255615] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 73.261690] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 73.275901] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 73.279633] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 73.309839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 73.314081] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 73.316375] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 73.319764] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 73.323562] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 73.325943] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 73.327499] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 73.329729] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 73.331513] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 73.333577] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 73.370179] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[ 73.377153] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[ 73.382415] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 73.386196] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 73.389747] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 73.391056] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 73.394445] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 73.396990] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[ 73.400431] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 73.403013] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 73.406582] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[ 73.409827] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 73.411424] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[ 73.418777] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[ 73.431533] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[ 73.431717] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[ 73.436513] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[ 73.437450] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 73.441191] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[ 73.443779] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[ 73.457584] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 73.458998] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[ 73.488663] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[ 73.490673] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[ 73.495474] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[ 75.341931] Bluetooth: hci0: command tx timeout
[ 75.404531] Bluetooth: hci2: command tx timeout
[ 75.404602] Bluetooth: hci1: command tx timeout
[ 75.468328] Bluetooth: hci5: command tx timeout
[ 75.471396] Bluetooth: hci4: command tx timeout
[ 75.532452] Bluetooth: hci3: command tx timeout
[ 75.597294] Bluetooth: hci6: command tx timeout
[ 75.597335] Bluetooth: hci7: command tx timeout
[ 77.389764] Bluetooth: hci0: command tx timeout
[ 77.452355] Bluetooth: hci1: command tx timeout
[ 77.452378] Bluetooth: hci2: command tx timeout
[ 77.516498] Bluetooth: hci4: command tx timeout
[ 77.516917] Bluetooth: hci5: command tx timeout
[ 77.580456] Bluetooth: hci3: command tx timeout
[ 77.644423] Bluetooth: hci6: command tx timeout
[ 77.647409] Bluetooth: hci7: command tx timeout
[ 79.437304] Bluetooth: hci0: command tx timeout
[ 79.500433] Bluetooth: hci2: command tx timeout
[ 79.500466] Bluetooth: hci1: command tx timeout
[ 79.564323] Bluetooth: hci5: command tx timeout
[ 79.564767] Bluetooth: hci4: command tx timeout
[ 79.628385] Bluetooth: hci3: command tx timeout
[ 79.692350] Bluetooth: hci7: command tx timeout
[ 79.692784] Bluetooth: hci6: command tx timeout
[ 81.486092] Bluetooth: hci0: command tx timeout
[ 81.548346] Bluetooth: hci2: command tx timeout
[ 81.549851] Bluetooth: hci1: command tx timeout
[ 81.612455] Bluetooth: hci4: command tx timeout
[ 81.613017] Bluetooth: hci5: command tx timeout
[ 81.676411] Bluetooth: hci3: command tx timeout
[ 81.741300] Bluetooth: hci6: command tx timeout
[ 81.741706] Bluetooth: hci7: command tx timeout
[ 109.105007] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.105730] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 109.208559] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.209189] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 109.312822] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.313552] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 109.445878] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.446518] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 109.562115] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.562758] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 109.628710] audit: type=1400 audit(1756718897.888:8): avc: denied { open } for pid=3855 comm="syz-executor.3" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[ 109.630522] audit: type=1400 audit(1756718897.888:9): avc: denied { kernel } for pid=3855 comm="syz-executor.3" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[ 109.666375] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.666955] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:28:17 executing program 3:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_mount_image$tmpfs(&(0x7f0000000cc0), &(0x7f0000000d00)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e40)=ANY=[])
mknodat$loop(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0)
name_to_handle_at(r0, &(0x7f00000015c0)='./file0\x00', &(0x7f0000001600)=@ceph_nfs_confh={0x10}, &(0x7f0000001640), 0x0)
[ 109.752034] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.752655] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 109.797457] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.798089] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:28:18 executing program 3:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_mount_image$tmpfs(&(0x7f0000000cc0), &(0x7f0000000d00)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e40)=ANY=[])
mknodat$loop(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0)
name_to_handle_at(r0, &(0x7f00000015c0)='./file0\x00', &(0x7f0000001600)=@ceph_nfs_confh={0x10}, &(0x7f0000001640), 0x0)
[ 109.868555] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.869159] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:28:18 executing program 3:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_mount_image$tmpfs(&(0x7f0000000cc0), &(0x7f0000000d00)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e40)=ANY=[])
mknodat$loop(r0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0)
name_to_handle_at(r0, &(0x7f00000015c0)='./file0\x00', &(0x7f0000001600)=@ceph_nfs_confh={0x10}, &(0x7f0000001640), 0x0)
[ 109.920174] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.920811] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:28:18 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000c00)=@acquire={0x134, 0x17, 0x1, 0x0, 0x0, {{@in=@broadcast}, @in6=@private0, {@in6=@private2, @in6=@local}, {{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa}}}, [@policy_type={0xa, 0x10, {0x1}}]}, 0x134}}, 0x0)
09:28:18 executing program 5:
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000001b40))
09:28:18 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000c00)=@acquire={0x134, 0x17, 0x1, 0x0, 0x0, {{@in=@broadcast}, @in6=@private0, {@in6=@private2, @in6=@local}, {{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa}}}, [@policy_type={0xa, 0x10, {0x1}}]}, 0x134}}, 0x0)
09:28:18 executing program 2:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000c00)=@acquire={0x134, 0x17, 0x1, 0x0, 0x0, {{@in=@broadcast}, @in6=@private0, {@in6=@private2, @in6=@local}, {{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa}}}, [@policy_type={0xa, 0x10, {0x1}}]}, 0x134}}, 0x0)
[ 110.040800] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.041890] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:28:18 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
writev(r0, &(0x7f00000025c0)=[{&(0x7f0000000480)="8b68f60e9b3946", 0x7}], 0x1)
[ 110.115523] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.116109] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 110.153026] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.153827] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 110.236314] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.236933] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 110.254227] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.254986] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 110.279080] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.279701] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 110.410031] loop0: detected capacity change from 0 to 136
[ 110.420394] ISOFS: Logical zone size(0) < hardware blocksize(1024)
[ 110.434296] loop0: detected capacity change from 0 to 136
[ 110.437975] ISOFS: Logical zone size(0) < hardware blocksize(1024)
09:28:18 executing program 5:
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000001b40))
09:28:18 executing program 7:
r0 = memfd_create(&(0x7f0000000500)='\x02\xce\x16Td\xa8\x98\x86\xb1:\x8f\xc5\x88{\xbd\xb4\xc2\xb1\x9b\x84\x97R\xcc\xdb<\x01\xfa\x91\x85\xa0\x81\xa9F0!/\x89\xacX\xbd\xcd\x12R|lTn\xac-\xfd\x8b\n\x1a\xbc\xf0^B6\xb6`[/\xafE\xdaYz\xd6\xc7\xbc!\xe5\x89\xc8^\x06np\xc6\xe7\x1d\xe4\xbe\xcaa}\x1c\x12\xf9\xd8\xefw\xe1\xcb\x85\xdb?^\x8f\f\nD\xf2\x1f\x11\xaa\x90>N\xb7\x86\x15\x03=\xcc\xbe\x0f\x0f\x14\x84\xde:;\x0f\xb5\xf1\x86\xf2{y\xe0t\xa2\xe9\x01\x00\x00\x00\x8e:^v\xc9\x8d\xd7E\xb4\vw\xbe\\\x11J\xf4\xae\xc6\x88F\x9c\xaflM\x1dSHjH\xd6\x8d\xa6\xbd\x96\xe4SR\xe6\x118L*\x9b\xb2\tbg\xad\x0fRu\xeb\xe4{GO\xa5M\x80-Y\xc6\x1f%\xb8i|\x86\xa9Zm+\x9fe~\x8a\xe7\xca\f\xad?\xa0t\x13_Rq\x1f\xc6\xd9\x1d#\x8a8q\x1e#c\x8c\x193\xab\xdbE\xe1\xc8d=\xe5\r\xe6\x9a\xe5zc-\f\xe5#\xa2v\x1eY\xf0\xe3\x1c*h\xdbq\x92\xf8a6\x99\x02\xc9}\x14\xfb\x03\xce\xb34\x95/\x18\xacJs0\x9f\x9b>\xae\a2\x01\xa7\x95\xbd\xf2\x99w\x11G\x1c\xd2\xbc\xf0E\x86\xca\x87\xefv\x8e\xad\xb8\xc7u\xc2z\x85\xc1\xd5R\x82\v\x1b\xea\x8f\xad\xc1\x02\x8a$\xd1T\xce\xa6\xa2m\x18K\xd5-\x03\xa0\xeeF^F\vJLx\xdc\xc8\b\xb7\xa1j2l\x8fQ\xc1\x89\xb8\xbef\xc6\x90\r\xae\xd4S\x8f\x7f\xe2[\x1cs\xab&\xa3\x81B<\xc5]n\xfc', 0x3)
write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0xfffffd1f)
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$addseals(r0, 0x409, 0x9)
09:28:18 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0)
r1 = dup(r0)
ioctl$BLKSECTGET(r1, 0x227e, &(0x7f0000000040))
09:28:18 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
writev(r0, &(0x7f00000025c0)=[{&(0x7f0000000480)="8b68f60e9b3946", 0x7}], 0x1)
09:28:18 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='projid_map\x00')
r1 = syz_open_dev$vcsn(&(0x7f0000000040), 0x1a, 0x0)
dup2(r1, r0)
readv(r0, &(0x7f0000000200)=[{&(0x7f0000000080)=""/211, 0xd3}], 0x1)
09:28:18 executing program 4:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/freeze_filesystems', 0x28181, 0x0)
pwritev(r0, &(0x7f0000000400)=[{&(0x7f0000000600)='9', 0x1}], 0x1, 0x0, 0x0)
09:28:18 executing program 1:
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000000)=""/255, &(0x7f0000000100)=0xff)
09:28:18 executing program 0:
syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010600)="0243443030310100004c0049004e0055005800200020002000200020002000200020002000200020004300440052004f004d002000200020002000200020002000200020002000200000000000000000bf000000000000bf252f45", 0x5b, 0x8800}], 0x0, &(0x7f0000012200))
[ 110.677081] loop0: detected capacity change from 0 to 136
[ 110.690435] ISOFS: Logical zone size(0) < hardware blocksize(1024)
09:28:18 executing program 4:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/freeze_filesystems', 0x28181, 0x0)
pwritev(r0, &(0x7f0000000400)=[{&(0x7f0000000600)='9', 0x1}], 0x1, 0x0, 0x0)
09:28:19 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
writev(r0, &(0x7f00000025c0)=[{&(0x7f0000000480)="8b68f60e9b3946", 0x7}], 0x1)
09:28:19 executing program 0:
syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010600)="0243443030310100004c0049004e0055005800200020002000200020002000200020002000200020004300440052004f004d002000200020002000200020002000200020002000200000000000000000bf000000000000bf252f45", 0x5b, 0x8800}], 0x0, &(0x7f0000012200))
09:28:19 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0)
r1 = dup(r0)
ioctl$BLKSECTGET(r1, 0x227e, &(0x7f0000000040))
[ 110.763860] Oops: general protection fault, probably for non-canonical address 0xecfffc0000000032: 0000 [#1] SMP KASAN NOPTI
[ 110.764775] KASAN: maybe wild-memory-access in range [0x6800000000000190-0x6800000000000197]
[ 110.765471] CPU: 0 UID: 0 PID: 3927 Comm: syz-executor.7 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 110.766802] Tainted: [W]=WARN
[ 110.767435] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 110.769203] RIP: 0010:perf_tp_event+0x175/0xe70
[ 110.770148] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 110.774177] RSP: 0018:ffff8880163af800 EFLAGS: 00010212
[ 110.775403] RAX: 0d00000000000032 RBX: 67ffffffffffffa0 RCX: ffffc900050b2000
[ 110.775968] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 6800000000000190
[ 110.776522] RBP: ffff8880163afa70 R08: ffff88806ce31340 R09: ffffe8ffffc16b68
[ 110.777077] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 110.777630] R13: 0000000000000000 R14: ffff88806ce31340 R15: dffffc0000000000
[ 110.778196] FS: 00007f8430dcd700(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[ 110.778824] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 110.779284] CR2: 00005555794f4708 CR3: 00000000435bb000 CR4: 0000000000350ef0
[ 110.779842] Call Trace:
[ 110.780050]
[ 110.780231] ? perf_swevent_event+0x63/0x3f0
[ 110.780592] ? __pfx_perf_tp_event+0x10/0x10
[ 110.780948] ? tracing_gen_ctx_irq_test+0x167/0x1f0
[ 110.781348] ? tracing_gen_ctx_irq_test+0x167/0x1f0
[ 110.781744] ? perf_swevent_event+0x63/0x3f0
[ 110.782111] ? perf_tp_event+0x807/0xe70
[ 110.782442] ? __pfx_perf_tp_event+0x10/0x10
[ 110.782801] ? __perf_install_in_context+0x503/0xb90
[ 110.783205] ? do_raw_spin_unlock+0x53/0x220
[ 110.783569] ? perf_trace_run_bpf_submit+0xef/0x180
[ 110.783982] perf_trace_run_bpf_submit+0xef/0x180
[ 110.784373] perf_trace_lock+0x337/0x5d0
[ 110.784704] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.785073] ? lock_acquire+0x15e/0x2f0
[ 110.785395] ? futex_ref_get+0x48/0x300
[ 110.785719] ? futex_ref_get+0x114/0x300
[ 110.786047] ? futex_hash+0x15c/0x390
[ 110.786353] lock_release+0x1ab/0x290
[ 110.786659] ? futex_hash+0x15c/0x390
[ 110.786965] futex_ref_get+0x119/0x300
[ 110.787277] ? futex_hash+0x15c/0x390
[ 110.787590] futex_hash+0x70/0x390
[ 110.787605] futex_wake+0x143/0x540
[ 110.787621] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.787637] ? __pfx_futex_wake+0x10/0x10
[ 110.787655] ? __do_sys_perf_event_open+0x44d/0x2c20
[ 110.787670] ? lock_release+0xc8/0x290
[ 110.787687] do_futex+0x26d/0x370
[ 110.787701] ? __pfx_do_futex+0x10/0x10
[ 110.787716] ? __pfx___do_sys_perf_event_open+0x10/0x10
[ 110.787730] ? do_raw_spin_lock+0x123/0x260
[ 110.787748] __x64_sys_futex+0x1c9/0x4d0
[ 110.787765] ? __pfx___x64_sys_futex+0x10/0x10
[ 110.787779] ? kcov_ioctl+0x386/0x6c0
[ 110.787795] ? fput+0x6a/0x100
[ 110.787815] do_syscall_64+0xbf/0x360
[ 110.787830] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.787843] RIP: 0033:0x7f8433878b19
[ 110.787852] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 110.787863] RSP: 002b:00007f8430dcd218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 110.787875] RAX: ffffffffffffffda RBX: 00007f843398c028 RCX: 00007f8433878b19
[ 110.787883] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f843398c02c
[ 110.787891] RBP: 00007f843398c020 R08: 000000000000000e R09: 0000000000000000
[ 110.787898] R10: 0000000000000004 R11: 0000000000000246 R12: 00007f843398c02c
[ 110.787906] R13: 00007fff76eef6df R14: 00007f8430dcd300 R15: 0000000000022000
[ 110.787922]
[ 110.787926] Modules linked in:
[ 110.787963] Oops: general protection fault, probably for non-canonical address 0xecfffc0000000032: 0000 [#2] SMP KASAN NOPTI
[ 110.787975] KASAN: maybe wild-memory-access in range [0x6800000000000190-0x6800000000000197]
[ 110.787987] CPU: 0 UID: 0 PID: 3927 Comm: syz-executor.7 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 110.788005] Tainted: [D]=DIE, [W]=WARN
[ 110.788009] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 110.788015] RIP: 0010:perf_tp_event+0x175/0xe70
[ 110.788031] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 110.788041] RSP: 0018:ffff88806ce08a80 EFLAGS: 00010012
[ 110.788051] RAX: 0d00000000000032 RBX: 67ffffffffffffa0 RCX: ffffffff818998a3
[ 110.788059] RDX: ffff888043f4d280 RSI: ffffffff8189a4e7 RDI: 6800000000000190
[ 110.788066] RBP: ffff88806ce08cf0 R08: ffff88806ce31490 R09: ffffe8ffffc16b68
[ 110.788074] R10: 0000000000000000 R11: ffff88806ce37018 R12: dffffc0000000000
[ 110.788081] R13: 0000000000000000 R14: ffff88806ce31490 R15: dffffc0000000000
[ 110.788090] FS: 00007f8430dcd700(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[ 110.788100] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 110.788108] CR2: 00005555794f4708 CR3: 00000000435bb000 CR4: 0000000000350ef0
[ 110.788115] Call Trace:
[ 110.788119]
[ 110.788128] ? __pfx_perf_tp_event+0x10/0x10
[ 110.788145] ? __lock_acquire+0x694/0x1b70
[ 110.788160] ? trace_softirq_raise+0xbe/0x100
[ 110.788180] ? lock_acquire+0x15e/0x2f0
[ 110.788192] ? select_task_rq_fair+0x2b6/0x38b0
[ 110.788205] ? find_held_lock+0x2b/0x80
[ 110.788221] ? select_task_rq_fair+0x48c/0x38b0
[ 110.788234] ? __pfx_call_function_single_prep_ipi+0x10/0x10
[ 110.788251] ? kvm_sched_clock_read+0x16/0x30
[ 110.788267] ? sched_clock+0x37/0x60
[ 110.788282] ? __pfx___resched_curr+0x10/0x10
[ 110.788298] ? __pfx___smp_call_single_queue+0x10/0x10
[ 110.788319] ? perf_trace_run_bpf_submit+0xef/0x180
[ 110.788335] perf_trace_run_bpf_submit+0xef/0x180
[ 110.788353] perf_trace_lock+0x337/0x5d0
[ 110.814413] ? update_cfs_group+0x11d/0x260
[ 110.814427] ? kvm_sched_clock_read+0x16/0x30
[ 110.814445] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.814459] ? check_preempt_wakeup_fair+0x6e/0x950
[ 110.814471] ? lock_release+0xc8/0x290
[ 110.814485] ? sched_ttwu_pending+0x2e0/0x4a0
[ 110.814502] lock_release+0x1ab/0x290
[ 110.814514] ? ttwu_do_activate+0x1a4/0x8a0
[ 110.814531] _raw_spin_unlock+0x16/0x40
[ 110.814546] sched_ttwu_pending+0x2e0/0x4a0
[ 110.814565] ? __pfx_sched_ttwu_pending+0x10/0x10
[ 110.814581] ? hrtimer_interrupt+0x652/0x830
[ 110.814596] __flush_smp_call_function_queue+0x434/0x740
[ 110.814616] __sysvec_call_function_single+0x6d/0x370
[ 110.814635] sysvec_call_function_single+0xa1/0xc0
[ 110.814651]
[ 110.814655]
[ 110.814660] asm_sysvec_call_function_single+0x1a/0x20
[ 110.814672] RIP: 0010:oops_exit+0x0/0x50
[ 110.814687] Code: 00 3a 00 be ff ff ff ff 48 c7 c7 50 b4 43 86 e8 c6 0f f9 ff 5b e9 50 00 3a 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 53 e8 36 00 3a 00 8b 1d c0 3d 4f 06 31 ff 89 de e8 57
[ 110.814697] RSP: 0018:ffff8880163af690 EFLAGS: 00000202
[ 110.814707] RAX: 0000000000026919 RBX: 0000000000000216 RCX: ffffc900050b2000
[ 110.814714] RDX: 0000000000040000 RSI: ffffffff812a3dca RDI: 0000000000000007
[ 110.814722] RBP: 000000000000000b R08: 0000000000000001 R09: fffffbfff0f12690
[ 110.814729] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880163af758
[ 110.814735] R13: 0000000000000000 R14: ecfffc0000000032 R15: 0000000000000000
[ 110.814747] ? oops_end+0x4a/0xe0
[ 110.814766] oops_end+0x65/0xe0
[ 110.814783] exc_general_protection+0x1a2/0x330
[ 110.814801] asm_exc_general_protection+0x26/0x30
[ 110.814812] RIP: 0010:perf_tp_event+0x175/0xe70
[ 110.814827] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 110.814837] RSP: 0018:ffff8880163af800 EFLAGS: 00010212
[ 110.814846] RAX: 0d00000000000032 RBX: 67ffffffffffffa0 RCX: ffffc900050b2000
[ 110.814854] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 6800000000000190
[ 110.814861] RBP: ffff8880163afa70 R08: ffff88806ce31340 R09: ffffe8ffffc16b68
[ 110.814868] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 110.814875] R13: 0000000000000000 R14: ffff88806ce31340 R15: dffffc0000000000
[ 110.814887] ? perf_tp_event+0x167/0xe70
[ 110.814904] ? perf_swevent_event+0x63/0x3f0
[ 110.814922] ? __pfx_perf_tp_event+0x10/0x10
[ 110.814939] ? tracing_gen_ctx_irq_test+0x167/0x1f0
[ 110.814953] ? tracing_gen_ctx_irq_test+0x167/0x1f0
[ 110.814965] ? perf_swevent_event+0x63/0x3f0
[ 110.814981] ? perf_tp_event+0x807/0xe70
[ 110.815000] ? __pfx_perf_tp_event+0x10/0x10
[ 110.815016] ? __perf_install_in_context+0x503/0xb90
[ 110.815030] ? do_raw_spin_unlock+0x53/0x220
[ 110.815047] ? perf_trace_run_bpf_submit+0xef/0x180
[ 110.815062] perf_trace_run_bpf_submit+0xef/0x180
[ 110.815081] perf_trace_lock+0x337/0x5d0
[ 110.815096] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.815112] ? lock_acquire+0x15e/0x2f0
[ 110.815124] ? futex_ref_get+0x48/0x300
[ 110.815135] ? futex_ref_get+0x114/0x300
[ 110.815144] ? futex_hash+0x15c/0x390
[ 110.815155] lock_release+0x1ab/0x290
[ 110.815169] ? futex_hash+0x15c/0x390
[ 110.815180] futex_ref_get+0x119/0x300
[ 110.815191] ? futex_hash+0x15c/0x390
[ 110.815200] futex_hash+0x70/0x390
[ 110.815213] futex_wake+0x143/0x540
[ 110.815226] ? __pfx_perf_trace_lock+0x10/0x10
[ 110.815241] ? __pfx_futex_wake+0x10/0x10
[ 110.815258] ? __do_sys_perf_event_open+0x44d/0x2c20
[ 110.815272] ? lock_release+0xc8/0x290
[ 110.815287] do_futex+0x26d/0x370
[ 110.815300] ? __pfx_do_futex+0x10/0x10
[ 110.815313] ? __pfx___do_sys_perf_event_open+0x10/0x10
[ 110.815327] ? do_raw_spin_lock+0x123/0x260
[ 110.815344] __x64_sys_futex+0x1c9/0x4d0
[ 110.815359] ? __pfx___x64_sys_futex+0x10/0x10
[ 110.815372] ? kcov_ioctl+0x386/0x6c0
[ 110.815385] ? fput+0x6a/0x100
[ 110.815402] do_syscall_64+0xbf/0x360
[ 110.815414] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.815425] RIP: 0033:0x7f8433878b19
[ 110.815433] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 110.815443] RSP: 002b:00007f8430dcd218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 110.815454] RAX: ffffffffffffffda RBX: 00007f843398c028 RCX: 00007f8433878b19
[ 110.815461] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f843398c02c
[ 110.815468] RBP: 00007f843398c020 R08: 000000000000000e R09: 0000000000000000
[ 110.815475] R10: 0000000000000004 R11: 0000000000000246 R12: 00007f843398c02c
[ 110.815482] R13: 00007fff76eef6df R14: 00007f8430dcd300 R15: 0000000000022000
[ 110.815497]
[ 110.815500] Modules linked in:
[ 110.815509] ---[ end trace 0000000000000000 ]---
[ 110.815511] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#3] SMP KASAN NOPTI
[ 110.815514] RIP: 0010:perf_tp_event+0x175/0xe70
[ 110.815531] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[ 110.815531] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 110.815543] RSP: 0018:ffff8880163af800 EFLAGS: 00010212
[ 110.815547] CPU: 1 UID: 0 PID: 3925 Comm: syz-executor.7 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 110.815553] RAX: 0d00000000000032 RBX: 67ffffffffffffa0 RCX: ffffc900050b2000
[ 110.815562] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 6800000000000190
[ 110.815569] Tainted: [D]=DIE, [W]=WARN
[ 110.815571] RBP: ffff8880163afa70 R08: ffff88806ce31340 R09: ffffe8ffffc16b68
[ 110.815575] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 110.815580] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 110.815588] R13: 0000000000000000 R14: ffff88806ce31340 R15: dffffc0000000000
[ 110.815585] RIP: 0010:perf_tp_event+0x175/0xe70
[ 110.815599] FS: 00007f8430dcd700(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[ 110.815610] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 110.815611] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 110.815619] CR2: 00005555794f4708 CR3: 00000000435bb000 CR4: 0000000000350ef0
[ 110.815625] RSP: 0018:ffff88804685f800 EFLAGS: 00010212
[ 110.815630] Kernel panic - not syncing: Fatal exception in interrupt
[ 111.859973] Shutting down cpus with NMI
[ 111.860187] Kernel Offset: disabled
[ 111.908114] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
VM DIAGNOSIS:
09:28:19 Registers:
info registers vcpu 0
RAX=0000000000000061 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff828e5105 RDI=ffffffff88729280 RBP=ffffffff88729240 RSP=ffff8880163af0f0
R8 =0000000000000000 R9 =ffffed10013fa046 R10=0000000000000061 R11=0000000065646f43
R12=0000000000000061 R13=0000000000000010 R14=ffffffff88729240 R15=ffffffff828e50f0
RIP=ffffffff828e515d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f8430dcd700 00000000 00000000
GS =0000 ffff8880e55d8000 00000000 00000000
LDT=0000 fffffe4400000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00005555794f4708 CR3=00000000435bb000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007f843395f7c000007f843395f7c8
XMM02=00007f843395f7e000007f843395f7c0 XMM03=00007f843395f7c800007f843395f7c0
XMM04=b4bd7b88c58f3ab18698a8645416ce02 XMM05=fc6e5dc53c4281a326ab731c5be27f8f
XMM06=53d4ae0d90c666beb889c1518f6c326a XMM07=a1b708c8dc784c4a0b465e46eea0032d
XMM08=d54b186da2a6ce54d1248a02c1ad8fea XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=dffffc0000000000 RBX=ffff888017707ce8 RCX=0000000000000001 RDX=1ffff11002ee0f11
RSI=ffff888017707cd8 RDI=ffff888017707888 RBP=0000000000000000 RSP=ffff888017707810
R8 =0000000000000001 R9 =ffff8880177078c0 R10=000000000003bea3 R11=000000000003ee7b
R12=ffff8880177078e0 R13=ffff8880177078c8 R14=ffff888017707cd8 R15=ffff888017707880
RIP=ffffffff81359b02 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00005555839ed400 00000000 00000000
GS =0000 ffff8880e56d8000 00000000 00000000
LDT=0000 fffffe4300000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f950432f3a4 CR3=000000000e33e000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=ff00000000ff000000000000000000ff XMM01=25252525252525252525252525252525
XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000