Warning: Permanently added '[localhost]:51147' (ECDSA) to the list of known hosts.
2025/09/01 09:57:21 fuzzer started
2025/09/01 09:57:22 dialing manager at localhost:35473
syzkaller login: [ 50.487439] cgroup: Unknown subsys name 'net'
[ 50.565351] cgroup: Unknown subsys name 'cpuset'
[ 50.584451] cgroup: Unknown subsys name 'rlimit'
2025/09/01 09:57:32 syscalls: 2214
2025/09/01 09:57:32 code coverage: enabled
2025/09/01 09:57:32 comparison tracing: enabled
2025/09/01 09:57:32 extra coverage: enabled
2025/09/01 09:57:32 setuid sandbox: enabled
2025/09/01 09:57:32 namespace sandbox: enabled
2025/09/01 09:57:32 Android sandbox: enabled
2025/09/01 09:57:32 fault injection: enabled
2025/09/01 09:57:32 leak checking: enabled
2025/09/01 09:57:32 net packet injection: enabled
2025/09/01 09:57:32 net device setup: enabled
2025/09/01 09:57:32 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2025/09/01 09:57:32 devlink PCI setup: PCI device 0000:00:10.0 is not available
2025/09/01 09:57:32 USB emulation: enabled
2025/09/01 09:57:32 hci packet injection: enabled
2025/09/01 09:57:32 wifi device emulation: enabled
2025/09/01 09:57:32 802.15.4 emulation: enabled
2025/09/01 09:57:32 fetching corpus: 0, signal 0/2000 (executing program)
2025/09/01 09:57:32 fetching corpus: 50, signal 26412/29780 (executing program)
2025/09/01 09:57:32 fetching corpus: 100, signal 38991/43548 (executing program)
2025/09/01 09:57:32 fetching corpus: 150, signal 43428/49308 (executing program)
2025/09/01 09:57:33 fetching corpus: 200, signal 48873/55887 (executing program)
2025/09/01 09:57:33 fetching corpus: 250, signal 55725/63598 (executing program)
2025/09/01 09:57:33 fetching corpus: 300, signal 60987/69679 (executing program)
2025/09/01 09:57:33 fetching corpus: 350, signal 66463/75874 (executing program)
2025/09/01 09:57:33 fetching corpus: 400, signal 73858/83606 (executing program)
2025/09/01 09:57:33 fetching corpus: 450, signal 77343/87808 (executing program)
2025/09/01 09:57:33 fetching corpus: 500, signal 79685/90870 (executing program)
2025/09/01 09:57:33 fetching corpus: 550, signal 82030/93938 (executing program)
2025/09/01 09:57:33 fetching corpus: 600, signal 84886/97322 (executing program)
2025/09/01 09:57:33 fetching corpus: 650, signal 87240/100284 (executing program)
2025/09/01 09:57:34 fetching corpus: 700, signal 89806/103275 (executing program)
2025/09/01 09:57:34 fetching corpus: 750, signal 91085/105220 (executing program)
2025/09/01 09:57:34 fetching corpus: 800, signal 93546/108046 (executing program)
2025/09/01 09:57:34 fetching corpus: 850, signal 95428/110360 (executing program)
2025/09/01 09:57:34 fetching corpus: 900, signal 97521/112773 (executing program)
2025/09/01 09:57:34 fetching corpus: 950, signal 99560/115194 (executing program)
2025/09/01 09:57:34 fetching corpus: 1000, signal 100854/116954 (executing program)
2025/09/01 09:57:34 fetching corpus: 1050, signal 102784/119129 (executing program)
2025/09/01 09:57:34 fetching corpus: 1100, signal 104696/121186 (executing program)
2025/09/01 09:57:34 fetching corpus: 1150, signal 106187/122935 (executing program)
2025/09/01 09:57:35 fetching corpus: 1200, signal 107051/124293 (executing program)
2025/09/01 09:57:35 fetching corpus: 1250, signal 107854/125528 (executing program)
2025/09/01 09:57:35 fetching corpus: 1300, signal 109155/127095 (executing program)
2025/09/01 09:57:35 fetching corpus: 1350, signal 110258/128517 (executing program)
2025/09/01 09:57:35 fetching corpus: 1400, signal 111198/129815 (executing program)
2025/09/01 09:57:35 fetching corpus: 1450, signal 112360/131180 (executing program)
2025/09/01 09:57:35 fetching corpus: 1500, signal 113772/132665 (executing program)
2025/09/01 09:57:35 fetching corpus: 1550, signal 114649/133828 (executing program)
2025/09/01 09:57:35 fetching corpus: 1600, signal 115470/134893 (executing program)
2025/09/01 09:57:35 fetching corpus: 1650, signal 116988/136373 (executing program)
2025/09/01 09:57:35 fetching corpus: 1700, signal 118253/137675 (executing program)
2025/09/01 09:57:36 fetching corpus: 1750, signal 119208/138805 (executing program)
2025/09/01 09:57:36 fetching corpus: 1800, signal 120494/140009 (executing program)
2025/09/01 09:57:36 fetching corpus: 1850, signal 121504/141095 (executing program)
2025/09/01 09:57:36 fetching corpus: 1900, signal 122381/142131 (executing program)
2025/09/01 09:57:36 fetching corpus: 1950, signal 123301/143142 (executing program)
2025/09/01 09:57:36 fetching corpus: 2000, signal 123750/143929 (executing program)
2025/09/01 09:57:36 fetching corpus: 2050, signal 124482/144730 (executing program)
2025/09/01 09:57:36 fetching corpus: 2100, signal 125804/145851 (executing program)
2025/09/01 09:57:36 fetching corpus: 2150, signal 126616/146738 (executing program)
2025/09/01 09:57:36 fetching corpus: 2200, signal 127496/147575 (executing program)
2025/09/01 09:57:37 fetching corpus: 2250, signal 128589/148513 (executing program)
2025/09/01 09:57:37 fetching corpus: 2300, signal 130289/149735 (executing program)
2025/09/01 09:57:37 fetching corpus: 2350, signal 131304/150564 (executing program)
2025/09/01 09:57:37 fetching corpus: 2400, signal 132111/151335 (executing program)
2025/09/01 09:57:37 fetching corpus: 2450, signal 132895/152071 (executing program)
2025/09/01 09:57:37 fetching corpus: 2500, signal 133733/152777 (executing program)
2025/09/01 09:57:37 fetching corpus: 2550, signal 134366/153356 (executing program)
2025/09/01 09:57:37 fetching corpus: 2600, signal 135070/153999 (executing program)
2025/09/01 09:57:37 fetching corpus: 2650, signal 135837/154582 (executing program)
2025/09/01 09:57:38 fetching corpus: 2700, signal 136574/155169 (executing program)
2025/09/01 09:57:38 fetching corpus: 2750, signal 137230/155684 (executing program)
2025/09/01 09:57:38 fetching corpus: 2800, signal 138066/156275 (executing program)
2025/09/01 09:57:38 fetching corpus: 2850, signal 138629/156775 (executing program)
2025/09/01 09:57:38 fetching corpus: 2900, signal 139174/157219 (executing program)
2025/09/01 09:57:38 fetching corpus: 2950, signal 140097/157746 (executing program)
2025/09/01 09:57:38 fetching corpus: 3000, signal 140748/158261 (executing program)
2025/09/01 09:57:38 fetching corpus: 3050, signal 141508/158706 (executing program)
2025/09/01 09:57:38 fetching corpus: 3100, signal 142611/159235 (executing program)
2025/09/01 09:57:38 fetching corpus: 3150, signal 143054/159584 (executing program)
2025/09/01 09:57:38 fetching corpus: 3200, signal 143442/159930 (executing program)
2025/09/01 09:57:39 fetching corpus: 3250, signal 143866/160256 (executing program)
2025/09/01 09:57:39 fetching corpus: 3300, signal 144575/160625 (executing program)
2025/09/01 09:57:39 fetching corpus: 3350, signal 145279/160970 (executing program)
2025/09/01 09:57:39 fetching corpus: 3400, signal 145847/161294 (executing program)
2025/09/01 09:57:39 fetching corpus: 3450, signal 146646/161648 (executing program)
2025/09/01 09:57:39 fetching corpus: 3500, signal 147203/161908 (executing program)
2025/09/01 09:57:39 fetching corpus: 3550, signal 148029/162225 (executing program)
2025/09/01 09:57:39 fetching corpus: 3600, signal 148514/162535 (executing program)
2025/09/01 09:57:39 fetching corpus: 3650, signal 149289/162827 (executing program)
2025/09/01 09:57:39 fetching corpus: 3700, signal 149756/163039 (executing program)
2025/09/01 09:57:40 fetching corpus: 3750, signal 150509/163302 (executing program)
2025/09/01 09:57:40 fetching corpus: 3800, signal 151272/163484 (executing program)
2025/09/01 09:57:40 fetching corpus: 3850, signal 151815/163665 (executing program)
2025/09/01 09:57:40 fetching corpus: 3900, signal 152398/163882 (executing program)
2025/09/01 09:57:40 fetching corpus: 3950, signal 153085/164033 (executing program)
2025/09/01 09:57:40 fetching corpus: 4000, signal 153428/164134 (executing program)
2025/09/01 09:57:40 fetching corpus: 4050, signal 153912/164146 (executing program)
2025/09/01 09:57:40 fetching corpus: 4100, signal 154575/164154 (executing program)
2025/09/01 09:57:40 fetching corpus: 4150, signal 154985/164165 (executing program)
2025/09/01 09:57:40 fetching corpus: 4200, signal 155421/164172 (executing program)
2025/09/01 09:57:41 fetching corpus: 4250, signal 156027/164251 (executing program)
2025/09/01 09:57:41 fetching corpus: 4300, signal 156339/164262 (executing program)
2025/09/01 09:57:41 fetching corpus: 4350, signal 156766/164284 (executing program)
2025/09/01 09:57:41 fetching corpus: 4400, signal 157150/164300 (executing program)
2025/09/01 09:57:41 fetching corpus: 4450, signal 157490/164346 (executing program)
2025/09/01 09:57:41 fetching corpus: 4500, signal 157867/164352 (executing program)
2025/09/01 09:57:41 fetching corpus: 4550, signal 158234/164368 (executing program)
2025/09/01 09:57:41 fetching corpus: 4600, signal 158757/164373 (executing program)
2025/09/01 09:57:41 fetching corpus: 4650, signal 159191/164417 (executing program)
2025/09/01 09:57:41 fetching corpus: 4700, signal 159527/164424 (executing program)
2025/09/01 09:57:41 fetching corpus: 4750, signal 159860/164424 (executing program)
2025/09/01 09:57:42 fetching corpus: 4800, signal 160713/164436 (executing program)
2025/09/01 09:57:42 fetching corpus: 4850, signal 161105/164474 (executing program)
2025/09/01 09:57:42 fetching corpus: 4900, signal 161710/164587 (executing program)
2025/09/01 09:57:42 fetching corpus: 4930, signal 161814/164605 (executing program)
2025/09/01 09:57:42 fetching corpus: 4930, signal 161814/164605 (executing program)
2025/09/01 09:57:43 starting 8 fuzzer processes
09:57:43 executing program 0:
ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @dev}, {0x2, 0x0, @empty}, 0x0, 0x0, 0x0, 0x0, 0x88})
r0 = syz_io_uring_setup(0x2260, &(0x7f0000003a00), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff4000/0x4000)=nil, &(0x7f0000003a80), &(0x7f0000003ac0))
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x17, &(0x7f00000000c0)=[{0x0}], 0x1)
09:57:43 executing program 4:
syz_open_dev$sg(&(0x7f0000000640), 0x0, 0x20500)
09:57:43 executing program 1:
r0 = shmget$private(0x0, 0x5000, 0x0, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000ffb000/0x2000)=nil, 0x4000)
mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0xe)
09:57:43 executing program 2:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x0)
ioctl$EVIOCSREP(r0, 0x40084503, 0x0)
09:57:43 executing program 7:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'wlan0\x00', &(0x7f0000000000)=@ethtool_rx_ntuple={0xb, {0x0, @tcp_ip4_spec={@rand_addr, @private}, @esp_ip4_spec={@multicast1, @local}}}})
09:57:43 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$nfs4(0x0, &(0x7f00000012c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_any}, {@access_any}, {@access_any}]}})
[ 72.285226] audit: type=1400 audit(1756720664.051:7): avc: denied { execmem } for pid=273 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
09:57:44 executing program 5:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x800448d2, &(0x7f0000000240))
09:57:44 executing program 6:
r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x1000})
[ 73.494912] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 73.506065] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 73.512381] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 73.519158] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 73.523333] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 73.528011] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 73.528256] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 73.555111] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 73.558932] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 73.561238] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 73.571153] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 73.574536] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 73.577940] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 73.580293] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 73.581836] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 73.588778] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 73.597018] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 73.602129] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 73.603363] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 73.606510] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 73.631380] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[ 73.642882] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[ 73.644336] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[ 73.648183] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[ 73.654802] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[ 73.656516] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 73.658168] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[ 73.673824] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[ 73.675479] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[ 73.678996] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 73.680311] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[ 73.685302] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 73.688843] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[ 73.688967] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[ 73.696220] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[ 73.702820] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 73.702849] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[ 73.705880] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[ 73.709899] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 73.715056] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[ 75.582296] Bluetooth: hci0: command tx timeout
[ 75.645751] Bluetooth: hci1: command tx timeout
[ 75.646735] Bluetooth: hci3: command tx timeout
[ 75.709886] Bluetooth: hci2: command tx timeout
[ 75.773798] Bluetooth: hci7: command tx timeout
[ 75.775933] Bluetooth: hci6: command tx timeout
[ 75.776708] Bluetooth: hci5: command tx timeout
[ 75.777828] Bluetooth: hci4: command tx timeout
[ 77.629737] Bluetooth: hci0: command tx timeout
[ 77.696967] Bluetooth: hci1: command tx timeout
[ 77.697404] Bluetooth: hci3: command tx timeout
[ 77.757807] Bluetooth: hci2: command tx timeout
[ 77.822101] Bluetooth: hci5: command tx timeout
[ 77.823430] Bluetooth: hci6: command tx timeout
[ 77.824255] Bluetooth: hci7: command tx timeout
[ 77.825081] Bluetooth: hci4: command tx timeout
[ 79.678720] Bluetooth: hci0: command tx timeout
[ 79.744134] Bluetooth: hci3: command tx timeout
[ 79.745740] Bluetooth: hci1: command tx timeout
[ 79.806829] Bluetooth: hci2: command tx timeout
[ 79.869767] Bluetooth: hci5: command tx timeout
[ 79.870930] Bluetooth: hci6: command tx timeout
[ 79.871411] Bluetooth: hci7: command tx timeout
[ 79.872329] Bluetooth: hci4: command tx timeout
[ 81.725785] Bluetooth: hci0: command tx timeout
[ 81.790690] Bluetooth: hci3: command tx timeout
[ 81.791103] Bluetooth: hci1: command tx timeout
[ 81.853682] Bluetooth: hci2: command tx timeout
[ 81.918695] Bluetooth: hci4: command tx timeout
[ 81.919097] Bluetooth: hci7: command tx timeout
[ 81.919479] Bluetooth: hci6: command tx timeout
[ 81.920147] Bluetooth: hci5: command tx timeout
[ 111.025219] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 111.025861] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 111.104803] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 111.105371] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 111.273752] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 111.274372] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 111.464110] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 111.464763] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 111.547530] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 111.548164] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 111.658312] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 111.659291] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:58:23 executing program 4:
syz_usb_connect$cdc_ncm(0x0, 0x6f, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5d, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x1, "a0"}, {0x5}, {0xd}, {0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{}, {{0x9, 0x5, 0x3, 0x2, 0x0, 0x0, 0x0, 0x3}}}}}}}]}}, 0x0)
09:58:23 executing program 7:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'wlan0\x00', &(0x7f0000000000)=@ethtool_rx_ntuple={0xb, {0x0, @tcp_ip4_spec={@rand_addr, @private}, @esp_ip4_spec={@multicast1, @local}}}})
[ 111.945449] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 111.953008] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 111.956693] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 111.957261] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 111.986865] audit: type=1400 audit(1756720703.752:8): avc: denied { open } for pid=3832 comm="syz-executor.3" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
09:58:23 executing program 7:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'wlan0\x00', &(0x7f0000000000)=@ethtool_rx_ntuple={0xb, {0x0, @tcp_ip4_spec={@rand_addr, @private}, @esp_ip4_spec={@multicast1, @local}}}})
[ 111.996728] audit: type=1400 audit(1756720703.752:9): avc: denied { kernel } for pid=3832 comm="syz-executor.3" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
09:58:23 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$nfs4(0x0, &(0x7f00000012c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_any}, {@access_any}, {@access_any}]}})
09:58:23 executing program 7:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'wlan0\x00', &(0x7f0000000000)=@ethtool_rx_ntuple={0xb, {0x0, @tcp_ip4_spec={@rand_addr, @private}, @esp_ip4_spec={@multicast1, @local}}}})
[ 112.126318] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 112.127045] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:58:23 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$nfs4(0x0, &(0x7f00000012c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_any}, {@access_any}, {@access_any}]}})
09:58:24 executing program 7:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$nfs4(0x0, &(0x7f00000012c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_any}, {@access_any}, {@access_any}]}})
[ 112.259345] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 112.260056] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:58:24 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$nfs4(0x0, &(0x7f00000012c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_any}, {@access_any}, {@access_any}]}})
[ 112.364436] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 112.365071] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 112.475503] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[ 112.485874] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[ 112.781176] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 112.781867] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 112.786415] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 112.787062] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 112.806613] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 112.807209] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 112.861023] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 112.861677] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 112.887918] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 112.888541] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 112.952488] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 112.953163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:58:24 executing program 4:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/disk', 0x40181, 0x0)
pwritev2(r0, &(0x7f0000000100)=[{&(0x7f0000000040)="fe", 0x1}], 0x1, 0x0, 0x0, 0x0)
09:58:24 executing program 0:
ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @dev}, {0x2, 0x0, @empty}, 0x0, 0x0, 0x0, 0x0, 0x88})
r0 = syz_io_uring_setup(0x2260, &(0x7f0000003a00), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff4000/0x4000)=nil, &(0x7f0000003a80), &(0x7f0000003ac0))
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x17, &(0x7f00000000c0)=[{0x0}], 0x1)
09:58:24 executing program 3:
pselect6(0xffffffffffffff74, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0)
09:58:24 executing program 5:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x800448d2, &(0x7f0000000240))
09:58:24 executing program 6:
r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x1000})
09:58:24 executing program 2:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x0)
ioctl$EVIOCSREP(r0, 0x40084503, 0x0)
09:58:24 executing program 1:
r0 = shmget$private(0x0, 0x5000, 0x0, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000ffb000/0x2000)=nil, 0x4000)
mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0xe)
09:58:24 executing program 7:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$nfs4(0x0, &(0x7f00000012c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_any}, {@access_any}, {@access_any}]}})
09:58:24 executing program 1:
r0 = shmget$private(0x0, 0x5000, 0x0, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000ffb000/0x2000)=nil, 0x4000)
mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0xe)
09:58:25 executing program 0:
ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @dev}, {0x2, 0x0, @empty}, 0x0, 0x0, 0x0, 0x0, 0x88})
r0 = syz_io_uring_setup(0x2260, &(0x7f0000003a00), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff4000/0x4000)=nil, &(0x7f0000003a80), &(0x7f0000003ac0))
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x17, &(0x7f00000000c0)=[{0x0}], 0x1)
09:58:25 executing program 4:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/disk', 0x40181, 0x0)
pwritev2(r0, &(0x7f0000000100)=[{&(0x7f0000000040)="fe", 0x1}], 0x1, 0x0, 0x0, 0x0)
09:58:25 executing program 6:
r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x1000})
09:58:25 executing program 3:
pselect6(0xffffffffffffff74, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0)
09:58:25 executing program 5:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x800448d2, &(0x7f0000000240))
09:58:25 executing program 1:
r0 = shmget$private(0x0, 0x5000, 0x0, &(0x7f0000ffb000/0x5000)=nil)
shmat(r0, &(0x7f0000ffb000/0x2000)=nil, 0x4000)
mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0xe)
09:58:25 executing program 2:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x0)
ioctl$EVIOCSREP(r0, 0x40084503, 0x0)
09:58:25 executing program 7:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$nfs4(0x0, &(0x7f00000012c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_any}, {@access_any}, {@access_any}]}})
[ 113.352234] kmemleak: Found object by alias at 0x607f1a63ea94
[ 113.352253] CPU: 1 UID: 0 PID: 3931 Comm: syz-executor.5 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 113.352271] Tainted: [W]=WARN
[ 113.352275] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 113.352282] Call Trace:
[ 113.352287]
[ 113.352291] dump_stack_lvl+0xca/0x120
[ 113.352322] __lookup_object+0x94/0xb0
[ 113.352340] delete_object_full+0x27/0x70
[ 113.352356] free_percpu+0x30/0x1160
[ 113.352374] ? arch_uprobe_clear_state+0x16/0x140
[ 113.352394] futex_hash_free+0x38/0xc0
[ 113.352410] mmput+0x2d3/0x390
[ 113.352429] do_exit+0x79d/0x2970
[ 113.352443] ? signal_wake_up_state+0x85/0x120
[ 113.352459] ? zap_other_threads+0x2b9/0x3a0
[ 113.352476] ? __pfx_do_exit+0x10/0x10
[ 113.352489] ? do_group_exit+0x1c3/0x2a0
[ 113.352503] ? lock_release+0xc8/0x290
[ 113.352521] do_group_exit+0xd3/0x2a0
[ 113.352536] __x64_sys_exit_group+0x3e/0x50
[ 113.352550] x64_sys_call+0x18c5/0x18d0
[ 113.352567] do_syscall_64+0xbf/0x360
[ 113.352580] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 113.352592] RIP: 0033:0x7f1b1a2c4b19
[ 113.352601] Code: Unable to access opcode bytes at 0x7f1b1a2c4aef.
[ 113.352606] RSP: 002b:00007ffc467352d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 113.352618] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f1b1a2c4b19
[ 113.352631] RDX: 00007f1b1a27772b RSI: ffffffffffffffbc RDI: 0000000000000000
[ 113.352638] RBP: 0000000000000000 R08: 0000001b2d7240c8 R09: 0000000000000000
[ 113.352645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 113.352652] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc467353c0
[ 113.352668]
[ 113.352672] kmemleak: Object (percpu) 0x607f1a63ea90 (size 8):
[ 113.352679] kmemleak: comm "syz-executor.7", pid 3944, jiffies 4294779956
[ 113.352686] kmemleak: min_count = 1
[ 113.352691] kmemleak: count = 0
[ 113.352694] kmemleak: flags = 0x21
[ 113.352698] kmemleak: checksum = 0
[ 113.352702] kmemleak: backtrace:
[ 113.352706] pcpu_alloc_noprof+0x87a/0x1170
[ 113.352721] perf_trace_event_init+0x366/0xa10
[ 113.352735] perf_trace_init+0x1a4/0x2f0
[ 113.352748] perf_tp_event_init+0xa6/0x120
[ 113.352764] perf_try_init_event+0x140/0x9f0
[ 113.352778] perf_event_alloc.part.0+0x118e/0x45f0
[ 113.352795] __do_sys_perf_event_open+0x719/0x2c20
[ 113.352809] do_syscall_64+0xbf/0x360
[ 113.352818] entry_SYSCALL_64_after_hwframe+0x77/0x7f
09:58:25 executing program 0:
ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @dev}, {0x2, 0x0, @empty}, 0x0, 0x0, 0x0, 0x0, 0x88})
r0 = syz_io_uring_setup(0x2260, &(0x7f0000003a00), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff4000/0x4000)=nil, &(0x7f0000003a80), &(0x7f0000003ac0))
io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x17, &(0x7f00000000c0)=[{0x0}], 0x1)
09:58:25 executing program 6:
r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x1000})
09:58:25 executing program 3:
pselect6(0xffffffffffffff74, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0)
09:58:25 executing program 4:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/disk', 0x40181, 0x0)
pwritev2(r0, &(0x7f0000000100)=[{&(0x7f0000000040)="fe", 0x1}], 0x1, 0x0, 0x0, 0x0)
09:58:25 executing program 2:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x0)
ioctl$EVIOCSREP(r0, 0x40084503, 0x0)
09:58:25 executing program 0:
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ptrace(0xffffffffffffffff, 0x0)
getgid()
memfd_create(0x0, 0x4)
pipe2(&(0x7f00000000c0), 0x0)
mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0)
openat$sndseq(0xffffffffffffff9c, 0x0, 0x0)
pipe2(0x0, 0x0)
mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0)
pipe2(0x0, 0x0)
creat(0x0, 0x0)
sendmsg$unix(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0}, 0x0)
09:58:25 executing program 3:
pselect6(0xffffffffffffff74, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0)
09:58:25 executing program 1:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_io_uring_setup(0x0, &(0x7f00000000c0), &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x0, 0x0)
setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = epoll_create(0x6)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080))
accept(0xffffffffffffffff, 0x0, 0x0)
statfs(0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000017c0), 0x0, 0x0, &(0x7f00000018c0))
09:58:25 executing program 5:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x800448d2, &(0x7f0000000240))
09:58:25 executing program 6:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$tun(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="00001e74408d0000a6e834b50f474f6edaeb1ff964b113cf65f0be4ab146aa7a9636645f0ae3094e59e50bfee32de576970308a41f1fd6c2cf47288f8895dca6e8681f1f7c4666d7035828c4690bca329e3b"], 0x52)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'vcan0\x00'})
09:58:25 executing program 4:
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/disk', 0x40181, 0x0)
pwritev2(r0, &(0x7f0000000100)=[{&(0x7f0000000040)="fe", 0x1}], 0x1, 0x0, 0x0, 0x0)
09:58:25 executing program 7:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x16)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000040)=0x20)
09:58:25 executing program 2:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), 0xffffffffffffffff)
r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0)
sendmsg$NL802154_CMD_GET_SEC_DEV(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0}}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x38, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x38}}, 0x0)
[ 113.578902] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#1] SMP KASAN NOPTI
[ 113.579821] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[ 113.580426] CPU: 1 UID: 0 PID: 3967 Comm: syz-executor.1 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 113.581968] Tainted: [W]=WARN
[ 113.582810] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 113.584664] RIP: 0010:perf_tp_event+0x175/0xe70
[ 113.585729] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 113.590387] RSP: 0018:ffff88804514f800 EFLAGS: 00010212
[ 113.590809] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90005e28000
[ 113.591371] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 113.591935] RBP: ffff88804514fa70 R08: ffff88806cf31340 R09: ffffe8ffffd16118
[ 113.592495] R10: 0000000000000000 R11: 0000000000000024 R12: dffffc0000000000
[ 113.593065] R13: 0000000000000024 R14: ffff88806cf31340 R15: dffffc0000000000
[ 113.593631] FS: 00007f2a52466700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000
[ 113.594268] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 113.594730] CR2: 00007fa8f1680547 CR3: 00000000425c9000 CR4: 0000000000350ef0
[ 113.595289] Call Trace:
[ 113.595495]
[ 113.595684] ? __pfx_perf_tp_event+0x10/0x10
[ 113.596043] ? lock_is_held_type+0x9e/0x120
[ 113.596396] ? lock_is_held_type+0x9e/0x120
[ 113.596745] ? ctx_sched_in+0x134/0x9b0
[ 113.597076] ? __pfx_ctx_sched_in+0x10/0x10
[ 113.597417] ? arch_stack_walk+0x9c/0xf0
[ 113.597743] ? find_held_lock+0x2b/0x80
[ 113.598070] ? find_held_lock+0x2b/0x80
[ 113.598397] ? __perf_install_in_context+0x503/0xb90
[ 113.598802] ? lock_release+0xc8/0x290
[ 113.599116] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 113.599585] ? do_raw_spin_unlock+0x53/0x220
[ 113.599945] ? perf_trace_run_bpf_submit+0xef/0x180
[ 113.600351] perf_trace_run_bpf_submit+0xef/0x180
[ 113.600744] perf_trace_lock_acquire+0x3c2/0x700
[ 113.601139] ? __pfx_perf_trace_lock_acquire+0x10/0x10
[ 113.601560] ? futex_ref_get+0x48/0x300
[ 113.601879] ? find_held_lock+0x2b/0x80
[ 113.602212] lock_acquire+0xc5/0x2f0
[ 113.602515] ? futex_wake+0x228/0x540
[ 113.602827] _raw_spin_lock+0x2b/0x40
[ 113.603137] ? futex_wake+0x228/0x540
[ 113.603447] futex_wake+0x228/0x540
[ 113.603746] ? __pfx_futex_wake+0x10/0x10
[ 113.604082] ? __do_sys_perf_event_open+0x44d/0x2c20
[ 113.604485] ? lock_release+0xc8/0x290
[ 113.604802] do_futex+0x26d/0x370
[ 113.605093] ? __pfx_do_futex+0x10/0x10
[ 113.605413] ? __pfx___do_sys_perf_event_open+0x10/0x10
[ 113.605836] ? find_held_lock+0x2b/0x80
[ 113.606162] __x64_sys_futex+0x1c9/0x4d0
[ 113.606491] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 113.606953] ? __pfx___x64_sys_futex+0x10/0x10
[ 113.607317] ? xfd_validate_state+0x55/0x180
[ 113.607679] do_syscall_64+0xbf/0x360
[ 113.607988] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 113.608397] RIP: 0033:0x7f2a54ef0b19
[ 113.608693] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 113.610120] RSP: 002b:00007f2a52466218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 113.610711] RAX: ffffffffffffffda RBX: 00007f2a55003f68 RCX: 00007f2a54ef0b19
[ 113.611276] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f2a55003f6c
[ 113.611832] RBP: 00007f2a55003f60 R08: 000000000000000e R09: 0000000000000000
[ 113.612388] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f2a55003f6c
[ 113.612941] R13: 00007ffcc41a2ebf R14: 00007f2a52466300 R15: 0000000000022000
[ 113.613517]
[ 113.613704] Modules linked in:
[ 113.613968] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#2] SMP KASAN NOPTI
[ 113.614879] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[ 113.615561] CPU: 0 UID: 0 PID: 3968 Comm: syz-executor.4 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 113.616491] Tainted: [D]=DIE, [W]=WARN
[ 113.616796] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 113.617452] RIP: 0010:perf_tp_event+0x175/0xe70
[ 113.617835] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 113.619248] RSP: 0018:ffff88804510f7c0 EFLAGS: 00010212
[ 113.619668] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc90003e18000
[ 113.620223] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000100000190
[ 113.620780] RBP: ffff88804510fa30 R08: ffff88806ce31340 R09: ffffe8ffffc16118
[ 113.621348] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000
[ 113.621906] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000
[ 113.622465] FS: 00007f54e0db0700(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[ 113.623096] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 113.623552] CR2: 00007f54e394e018 CR3: 000000000c01a000 CR4: 0000000000350ef0
[ 113.624110] Call Trace:
[ 113.624319]
[ 113.624508] ? __pfx_perf_tp_event+0x10/0x10
[ 113.624870] ? lock_acquire+0xc5/0x2f0
[ 113.625191] ? lock_acquire+0x18c/0x2f0
[ 113.625510] ? lock_acquire+0x18c/0x2f0
[ 113.625827] ? lock_release+0x1c7/0x290
[ 113.626146] ? __is_insn_slot_addr+0x140/0x290
[ 113.626521] ? kernel_text_address+0x5b/0xc0
[ 113.626876] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 113.627308] ? __kernel_text_address+0xd/0x40
[ 113.627668] ? unwind_get_return_address+0x59/0xa0
[ 113.628065] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 113.628492] ? arch_stack_walk+0x9c/0xf0
[ 113.628822] ? perf_trace_run_bpf_submit+0xef/0x180
[ 113.629229] perf_trace_run_bpf_submit+0xef/0x180
[ 113.629619] perf_trace_lock_acquire+0x3c2/0x700
[ 113.630008] ? __pfx_perf_trace_lock_acquire+0x10/0x10
[ 113.630430] ? __pfx_perf_trace_lock_acquire+0x10/0x10
[ 113.630853] lock_acquire+0xc5/0x2f0
[ 113.631154] ? futex_private_hash_put+0x4c/0x2d0
[ 113.631533] ? lock_release+0x1c7/0x290
[ 113.631857] futex_private_hash_put+0x5d/0x2d0
[ 113.632224] ? futex_private_hash_put+0x4c/0x2d0
[ 113.632601] futex_hash_put+0x3f/0x50
[ 113.632905] futex_wake+0x1bb/0x540
[ 113.633210] ? kasan_quarantine_put+0x84/0x1e0
[ 113.633580] ? __pfx_futex_wake+0x10/0x10
[ 113.633917] ? kmem_cache_free+0x2a1/0x540
[ 113.634251] ? putname.part.0+0x11b/0x160
[ 113.634589] do_futex+0x26d/0x370
[ 113.634874] ? __pfx_do_futex+0x10/0x10
[ 113.635199] __x64_sys_futex+0x1c9/0x4d0
[ 113.635526] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 113.635988] ? __x64_sys_openat+0x142/0x200
[ 113.636344] ? __pfx___x64_sys_futex+0x10/0x10
[ 113.636716] do_syscall_64+0xbf/0x360
[ 113.637033] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 113.637441] RIP: 0033:0x7f54e383ab19
[ 113.637737] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 113.639157] RSP: 002b:00007f54e0db0218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 113.639746] RAX: ffffffffffffffda RBX: 00007f54e394df68 RCX: 00007f54e383ab19
[ 113.640304] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f54e394df6c
[ 113.640861] RBP: 00007f54e394df60 R08: 000000000000000e R09: 0000000000000000
[ 113.641426] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f54e394df6c
[ 113.641985] R13: 00007ffd50c1e07f R14: 00007f54e0db0300 R15: 0000000000022000
[ 113.642551]
[ 113.642738] Modules linked in:
[ 113.642997] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#3] SMP KASAN NOPTI
[ 113.643876] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[ 113.644476] CPU: 1 UID: 0 PID: 3967 Comm: syz-executor.1 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 113.645415] Tainted: [D]=DIE, [W]=WARN
[ 113.645716] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 113.646356] RIP: 0010:perf_tp_event+0x175/0xe70
[ 113.646733] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 113.648155] RSP: 0018:ffff88806cf08a80 EFLAGS: 00010012
[ 113.648571] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[ 113.649134] RDX: ffff888042b73700 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 113.649700] RBP: ffff88806cf08cf0 R08: ffff88806cf31490 R09: ffffe8ffffd16118
[ 113.650260] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000
[ 113.650824] R13: 000000000000002c R14: ffff88806cf31490 R15: dffffc0000000000
[ 113.651381] FS: 00007f2a52466700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000
[ 113.652005] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 113.652464] CR2: 00007fa8f1680547 CR3: 00000000425c9000 CR4: 0000000000350ef0
[ 113.653033] Call Trace:
[ 113.653240]
[ 113.653429] ? __pfx_perf_tp_event+0x10/0x10
[ 113.653787] ? __lock_acquire+0xc65/0x1b70
[ 113.654133] ? __lock_acquire+0x694/0x1b70
[ 113.654477] ? lock_acquire+0x15e/0x2f0
[ 113.654800] ? perf_trace_run_bpf_submit+0xef/0x180
[ 113.655203] ? match_held_lock+0xb0/0xd0
[ 113.655533] perf_trace_run_bpf_submit+0xef/0x180
[ 113.655925] perf_trace_lock_acquire+0x3c2/0x700
[ 113.656310] ? __pfx_perf_trace_lock_acquire+0x10/0x10
[ 113.656734] ? lock_is_held_type+0x9e/0x120
[ 113.657093] ? find_held_lock+0x2b/0x80
[ 113.657417] ? sched_ttwu_pending+0x2e0/0x4a0
[ 113.657785] lock_acquire+0xc5/0x2f0
[ 113.658087] ? hrtimer_interrupt+0xd6/0x830
[ 113.658427] ? _raw_spin_unlock+0x1e/0x40
[ 113.658759] ? sched_ttwu_pending+0x2e0/0x4a0
[ 113.659129] _raw_spin_lock_irqsave+0x3a/0x60
[ 113.659498] ? hrtimer_interrupt+0xd6/0x830
[ 113.659839] hrtimer_interrupt+0xd6/0x830
[ 113.660170] ? __pfx_sched_ttwu_pending+0x10/0x10
[ 113.660563] ? trace_csd_function_exit+0x134/0x190
[ 113.660960] ? __flush_smp_call_function_queue+0x443/0x740
[ 113.661414] __sysvec_apic_timer_interrupt+0xbb/0x330
[ 113.661831] sysvec_apic_timer_interrupt+0x6b/0x80
[ 113.662225]
[ 113.662407]
[ 113.662591] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 113.663011] RIP: 0010:oops_exit+0x0/0x50
[ 113.663342] Code: 00 3a 00 be ff ff ff ff 48 c7 c7 50 b4 43 86 e8 c6 0f f9 ff 5b e9 50 00 3a 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 53 e8 36 00 3a 00 8b 1d c0 3d 4f 06 31 ff 89 de e8 57
[ 113.664761] RSP: 0018:ffff88804514f690 EFLAGS: 00000202
[ 113.665185] RAX: 000000000002b3f6 RBX: 0000000000000216 RCX: ffffc90005e28000
[ 113.665742] RDX: 0000000000040000 RSI: ffffffff812a3dca RDI: 0000000000000007
[ 113.666301] RBP: 000000000000000b R08: 0000000000000001 R09: fffffbfff0f12690
[ 113.666862] R10: 0000000000000000 R11: 000000000000002c R12: ffff88804514f758
[ 113.667425] R13: 0000000000000000 R14: dffffc0000000032 R15: 0000000000000000
[ 113.667991] ? oops_end+0x4a/0xe0
[ 113.668281] oops_end+0x65/0xe0
[ 113.668561] exc_general_protection+0x1a2/0x330
[ 113.668944] asm_exc_general_protection+0x26/0x30
[ 113.669339] RIP: 0010:perf_tp_event+0x175/0xe70
[ 113.669718] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 113.671134] RSP: 0018:ffff88804514f800 EFLAGS: 00010212
[ 113.671552] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90005e28000
[ 113.672109] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 113.672683] RBP: ffff88804514fa70 R08: ffff88806cf31340 R09: ffffe8ffffd16118
[ 113.673285] R10: 0000000000000000 R11: 0000000000000024 R12: dffffc0000000000
[ 113.673881] R13: 0000000000000024 R14: ffff88806cf31340 R15: dffffc0000000000
[ 113.674473] ? perf_tp_event+0x167/0xe70
[ 113.674831] ? __pfx_perf_tp_event+0x10/0x10
[ 113.675212] ? lock_is_held_type+0x9e/0x120
[ 113.675588] ? lock_is_held_type+0x9e/0x120
[ 113.675957] ? ctx_sched_in+0x134/0x9b0
[ 113.676297] ? __pfx_ctx_sched_in+0x10/0x10
[ 113.676656] ? arch_stack_walk+0x9c/0xf0
[ 113.677012] ? find_held_lock+0x2b/0x80
[ 113.677355] ? find_held_lock+0x2b/0x80
[ 113.677701] ? __perf_install_in_context+0x503/0xb90
[ 113.678129] ? lock_release+0xc8/0x290
[ 113.678465] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 113.678954] ? do_raw_spin_unlock+0x53/0x220
[ 113.679335] ? perf_trace_run_bpf_submit+0xef/0x180
[ 113.679766] perf_trace_run_bpf_submit+0xef/0x180
[ 113.680183] perf_trace_lock_acquire+0x3c2/0x700
[ 113.680590] ? __pfx_perf_trace_lock_acquire+0x10/0x10
[ 113.681044] ? futex_ref_get+0x48/0x300
[ 113.681380] ? find_held_lock+0x2b/0x80
[ 113.681725] lock_acquire+0xc5/0x2f0
[ 113.682049] ? futex_wake+0x228/0x540
[ 113.682387] _raw_spin_lock+0x2b/0x40
[ 113.682711] ? futex_wake+0x228/0x540
[ 113.683043] futex_wake+0x228/0x540
[ 113.683359] ? __pfx_futex_wake+0x10/0x10
[ 113.683714] ? __do_sys_perf_event_open+0x44d/0x2c20
[ 113.684141] ? lock_release+0xc8/0x290
[ 113.684472] do_futex+0x26d/0x370
[ 113.684775] ? __pfx_do_futex+0x10/0x10
[ 113.685122] ? __pfx___do_sys_perf_event_open+0x10/0x10
[ 113.685583] ? find_held_lock+0x2b/0x80
[ 113.685933] __x64_sys_futex+0x1c9/0x4d0
[ 113.686285] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 113.686780] ? __pfx___x64_sys_futex+0x10/0x10
[ 113.687172] ? xfd_validate_state+0x55/0x180
[ 113.687557] do_syscall_64+0xbf/0x360
[ 113.687885] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 113.688323] RIP: 0033:0x7f2a54ef0b19
[ 113.688636] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 113.690131] RSP: 002b:00007f2a52466218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 113.690757] RAX: ffffffffffffffda RBX: 00007f2a55003f68 RCX: 00007f2a54ef0b19
[ 113.691353] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f2a55003f6c
[ 113.691950] RBP: 00007f2a55003f60 R08: 000000000000000e R09: 0000000000000000
[ 113.692545] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f2a55003f6c
[ 113.693142] R13: 00007ffcc41a2ebf R14: 00007f2a52466300 R15: 0000000000022000
[ 113.693755]
[ 113.693951] Modules linked in:
[ 113.694226] ---[ end trace 0000000000000000 ]---
[ 113.694227] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#4] SMP KASAN NOPTI
[ 113.694621] RIP: 0010:perf_tp_event+0x175/0xe70
[ 113.695537] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[ 113.695915] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 113.696623] CPU: 0 UID: 0 PID: 3968 Comm: syz-executor.4 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 113.698128] RSP: 0018:ffff88804514f800 EFLAGS: 00010212
[ 113.699100] Tainted: [D]=DIE, [W]=WARN
[ 113.699539] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90005e28000
[ 113.699854] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 113.700441] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 113.701128] RIP: 0010:perf_tp_event+0x175/0xe70
[ 113.701713] RBP: ffff88804514fa70 R08: ffff88806cf31340 R09: ffffe8ffffd16118
[ 113.702096] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 113.702688] R10: 0000000000000000 R11: 0000000000000024 R12: dffffc0000000000
[ 113.704189] RSP: 0018:ffff88806ce08a80 EFLAGS: 00010012
[ 113.704781] R13: 0000000000000024 R14: ffff88806cf31340 R15: dffffc0000000000
[ 113.705227] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002
[ 113.705825] FS: 00007f2a52466700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000
[ 113.706409] RDX: ffff888015a95280 RSI: ffffffff8189a4e7 RDI: 0000000100000190
[ 113.707068] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 113.707656] RBP: ffff88806ce08cf0 R08: ffff88806ce31490 R09: ffffe8ffffc16118
[ 113.708142] CR2: 00007fa8f1680547 CR3: 00000000425c9000 CR4: 0000000000350ef0
[ 113.708729] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000
[ 113.709331] Kernel panic - not syncing: Fatal exception in interrupt
[ 114.751229] Shutting down cpus with NMI
[ 114.762699] Kernel Offset: disabled
[ 114.763000] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
VM DIAGNOSIS:
09:58:25 Registers:
info registers vcpu 0
RAX=0000000000000001 RBX=0000000000000001 RCX=ffffffff84be3c0e RDX=fffffbfff0f0f609
RSI=0000000000000004 RDI=ffffffff8787b044 RBP=ffffffff8787b044 RSP=ffff88804510f570
R8 =0000000000000000 R9 =fffffbfff0f0f608 R10=ffffffff8787b047 R11=202c746c75616620
R12=1ffff11008a21eaf R13=0000000000000007 R14=fffffbfff0f0f608 R15=ffff88804510f5a8
RIP=ffffffff84be3da0 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f54e0db0700 00000000 00000000
GS =0000 ffff8880e55d8000 00000000 00000000
LDT=0000 fffffe7c00000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f54e394e018 CR3=000000000c01a000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007f54e39217c000007f54e39217c8
XMM02=00007f54e39217e000007f54e39217c0 XMM03=00007f54e39217c800007f54e39217c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=0000000000000020 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff828e5105 RDI=ffffffff88729280 RBP=ffffffff88729240 RSP=ffff88804514f0f0
R8 =0000000000000000 R9 =ffffed100148b046 R10=0000000000000020 R11=000000000000002c
R12=0000000000000020 R13=0000000000000010 R14=ffffffff88729240 R15=ffffffff828e50f0
RIP=ffffffff828e515d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f2a52466700 00000000 00000000
GS =0000 ffff8880e56d8000 00000000 00000000
LDT=0000 fffffe2300000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007fa8f1680547 CR3=00000000425c9000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007f2a54fd77c000007f2a54fd77c8
XMM02=00007f2a54fd77e000007f2a54fd77c0 XMM03=00007f2a54fd77c800007f2a54fd77c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000