Warning: Permanently added '[localhost]:11570' (ECDSA) to the list of known hosts. 2025/09/01 10:17:47 fuzzer started 2025/09/01 10:17:47 dialing manager at localhost:35473 syzkaller login: [ 60.123223] cgroup: Unknown subsys name 'net' [ 60.185054] cgroup: Unknown subsys name 'cpuset' [ 60.198956] cgroup: Unknown subsys name 'rlimit' 2025/09/01 10:18:00 syscalls: 2214 2025/09/01 10:18:00 code coverage: enabled 2025/09/01 10:18:00 comparison tracing: enabled 2025/09/01 10:18:00 extra coverage: enabled 2025/09/01 10:18:00 setuid sandbox: enabled 2025/09/01 10:18:00 namespace sandbox: enabled 2025/09/01 10:18:00 Android sandbox: enabled 2025/09/01 10:18:00 fault injection: enabled 2025/09/01 10:18:00 leak checking: enabled 2025/09/01 10:18:00 net packet injection: enabled 2025/09/01 10:18:00 net device setup: enabled 2025/09/01 10:18:00 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/09/01 10:18:00 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/09/01 10:18:00 USB emulation: enabled 2025/09/01 10:18:00 hci packet injection: enabled 2025/09/01 10:18:00 wifi device emulation: enabled 2025/09/01 10:18:00 802.15.4 emulation: enabled 2025/09/01 10:18:00 fetching corpus: 0, signal 0/2000 (executing program) 2025/09/01 10:18:00 fetching corpus: 50, signal 17167/20796 (executing program) 2025/09/01 10:18:00 fetching corpus: 100, signal 30306/35242 (executing program) 2025/09/01 10:18:00 fetching corpus: 150, signal 39546/45743 (executing program) 2025/09/01 10:18:00 fetching corpus: 200, signal 46863/54140 (executing program) 2025/09/01 10:18:00 fetching corpus: 250, signal 50191/58704 (executing program) 2025/09/01 10:18:00 fetching corpus: 300, signal 59117/68313 (executing program) 2025/09/01 10:18:00 fetching corpus: 350, signal 62749/72977 (executing program) 2025/09/01 10:18:00 fetching corpus: 400, signal 68549/79439 (executing program) 2025/09/01 10:18:00 fetching corpus: 450, signal 71983/83665 (executing program) 2025/09/01 10:18:00 fetching corpus: 500, signal 74455/86951 (executing program) 2025/09/01 10:18:01 fetching corpus: 550, signal 77700/90908 (executing program) 2025/09/01 10:18:01 fetching corpus: 600, signal 79430/93487 (executing program) 2025/09/01 10:18:01 fetching corpus: 650, signal 80774/95746 (executing program) 2025/09/01 10:18:01 fetching corpus: 700, signal 83125/98761 (executing program) 2025/09/01 10:18:01 fetching corpus: 750, signal 84982/101299 (executing program) 2025/09/01 10:18:01 fetching corpus: 800, signal 87356/104212 (executing program) 2025/09/01 10:18:01 fetching corpus: 850, signal 89249/106718 (executing program) 2025/09/01 10:18:01 fetching corpus: 900, signal 91140/109149 (executing program) 2025/09/01 10:18:01 fetching corpus: 950, signal 93463/111872 (executing program) 2025/09/01 10:18:01 fetching corpus: 1000, signal 96178/114860 (executing program) 2025/09/01 10:18:02 fetching corpus: 1050, signal 97545/116817 (executing program) 2025/09/01 10:18:02 fetching corpus: 1100, signal 99877/119400 (executing program) 2025/09/01 10:18:02 fetching corpus: 1150, signal 101245/121187 (executing program) 2025/09/01 10:18:02 fetching corpus: 1200, signal 102632/123016 (executing program) 2025/09/01 10:18:02 fetching corpus: 1250, signal 103801/124645 (executing program) 2025/09/01 10:18:02 fetching corpus: 1300, signal 105002/126304 (executing program) 2025/09/01 10:18:02 fetching corpus: 1350, signal 107697/128950 (executing program) 2025/09/01 10:18:02 fetching corpus: 1400, signal 109446/130883 (executing program) 2025/09/01 10:18:02 fetching corpus: 1450, signal 110433/132262 (executing program) 2025/09/01 10:18:02 fetching corpus: 1500, signal 111251/133539 (executing program) 2025/09/01 10:18:03 fetching corpus: 1550, signal 112881/135293 (executing program) 2025/09/01 10:18:03 fetching corpus: 1600, signal 114230/136796 (executing program) 2025/09/01 10:18:03 fetching corpus: 1650, signal 115754/138480 (executing program) 2025/09/01 10:18:03 fetching corpus: 1700, signal 117677/140342 (executing program) 2025/09/01 10:18:03 fetching corpus: 1750, signal 118522/141442 (executing program) 2025/09/01 10:18:03 fetching corpus: 1800, signal 119668/142727 (executing program) 2025/09/01 10:18:03 fetching corpus: 1850, signal 120610/143820 (executing program) 2025/09/01 10:18:03 fetching corpus: 1900, signal 121127/144724 (executing program) 2025/09/01 10:18:03 fetching corpus: 1950, signal 122398/145991 (executing program) 2025/09/01 10:18:04 fetching corpus: 2000, signal 123303/147051 (executing program) 2025/09/01 10:18:04 fetching corpus: 2050, signal 124502/148204 (executing program) 2025/09/01 10:18:04 fetching corpus: 2100, signal 125187/149130 (executing program) 2025/09/01 10:18:04 fetching corpus: 2150, signal 126083/150083 (executing program) 2025/09/01 10:18:04 fetching corpus: 2200, signal 127113/151149 (executing program) 2025/09/01 10:18:04 fetching corpus: 2250, signal 128604/152372 (executing program) 2025/09/01 10:18:04 fetching corpus: 2300, signal 129263/153193 (executing program) 2025/09/01 10:18:04 fetching corpus: 2350, signal 130620/154372 (executing program) 2025/09/01 10:18:04 fetching corpus: 2400, signal 132080/155494 (executing program) 2025/09/01 10:18:04 fetching corpus: 2450, signal 132997/156390 (executing program) 2025/09/01 10:18:05 fetching corpus: 2500, signal 134553/157460 (executing program) 2025/09/01 10:18:05 fetching corpus: 2550, signal 135361/158243 (executing program) 2025/09/01 10:18:05 fetching corpus: 2600, signal 135981/158911 (executing program) 2025/09/01 10:18:05 fetching corpus: 2650, signal 136719/159598 (executing program) 2025/09/01 10:18:05 fetching corpus: 2700, signal 137526/160304 (executing program) 2025/09/01 10:18:05 fetching corpus: 2750, signal 138126/160893 (executing program) 2025/09/01 10:18:05 fetching corpus: 2800, signal 138700/161506 (executing program) 2025/09/01 10:18:05 fetching corpus: 2850, signal 139244/162108 (executing program) 2025/09/01 10:18:05 fetching corpus: 2900, signal 139785/162710 (executing program) 2025/09/01 10:18:05 fetching corpus: 2950, signal 140795/163433 (executing program) 2025/09/01 10:18:05 fetching corpus: 3000, signal 141402/164036 (executing program) 2025/09/01 10:18:05 fetching corpus: 3050, signal 142263/164624 (executing program) 2025/09/01 10:18:06 fetching corpus: 3100, signal 142921/165180 (executing program) 2025/09/01 10:18:06 fetching corpus: 3150, signal 143527/165686 (executing program) 2025/09/01 10:18:06 fetching corpus: 3200, signal 144008/166178 (executing program) 2025/09/01 10:18:06 fetching corpus: 3250, signal 144545/166657 (executing program) 2025/09/01 10:18:06 fetching corpus: 3300, signal 145166/167160 (executing program) 2025/09/01 10:18:06 fetching corpus: 3350, signal 145594/167585 (executing program) 2025/09/01 10:18:06 fetching corpus: 3400, signal 146160/168050 (executing program) 2025/09/01 10:18:06 fetching corpus: 3450, signal 146697/168471 (executing program) 2025/09/01 10:18:06 fetching corpus: 3500, signal 147318/168916 (executing program) 2025/09/01 10:18:06 fetching corpus: 3550, signal 147799/169327 (executing program) 2025/09/01 10:18:06 fetching corpus: 3600, signal 148507/169726 (executing program) 2025/09/01 10:18:07 fetching corpus: 3650, signal 148949/170078 (executing program) 2025/09/01 10:18:07 fetching corpus: 3700, signal 149434/170419 (executing program) 2025/09/01 10:18:07 fetching corpus: 3750, signal 149979/170763 (executing program) 2025/09/01 10:18:07 fetching corpus: 3800, signal 150391/171105 (executing program) 2025/09/01 10:18:07 fetching corpus: 3850, signal 150899/171410 (executing program) 2025/09/01 10:18:07 fetching corpus: 3900, signal 151270/171708 (executing program) 2025/09/01 10:18:07 fetching corpus: 3950, signal 151668/171994 (executing program) 2025/09/01 10:18:07 fetching corpus: 4000, signal 152154/172281 (executing program) 2025/09/01 10:18:07 fetching corpus: 4050, signal 152469/172549 (executing program) 2025/09/01 10:18:07 fetching corpus: 4100, signal 153013/172822 (executing program) 2025/09/01 10:18:07 fetching corpus: 4150, signal 153309/173066 (executing program) 2025/09/01 10:18:08 fetching corpus: 4200, signal 153949/173309 (executing program) 2025/09/01 10:18:08 fetching corpus: 4250, signal 154339/173381 (executing program) 2025/09/01 10:18:08 fetching corpus: 4300, signal 155097/173387 (executing program) 2025/09/01 10:18:08 fetching corpus: 4350, signal 155483/173400 (executing program) 2025/09/01 10:18:08 fetching corpus: 4400, signal 155904/173422 (executing program) 2025/09/01 10:18:08 fetching corpus: 4450, signal 156557/173446 (executing program) 2025/09/01 10:18:08 fetching corpus: 4500, signal 157223/173449 (executing program) 2025/09/01 10:18:08 fetching corpus: 4550, signal 157567/173470 (executing program) 2025/09/01 10:18:08 fetching corpus: 4600, signal 158028/173483 (executing program) 2025/09/01 10:18:08 fetching corpus: 4650, signal 158760/173598 (executing program) 2025/09/01 10:18:09 fetching corpus: 4700, signal 159182/173611 (executing program) 2025/09/01 10:18:09 fetching corpus: 4750, signal 159493/173613 (executing program) 2025/09/01 10:18:09 fetching corpus: 4800, signal 159858/173631 (executing program) 2025/09/01 10:18:09 fetching corpus: 4850, signal 160256/173645 (executing program) 2025/09/01 10:18:09 fetching corpus: 4900, signal 160758/173660 (executing program) 2025/09/01 10:18:09 fetching corpus: 4950, signal 161073/173703 (executing program) 2025/09/01 10:18:09 fetching corpus: 5000, signal 161641/173703 (executing program) 2025/09/01 10:18:09 fetching corpus: 5050, signal 161973/173712 (executing program) 2025/09/01 10:18:09 fetching corpus: 5100, signal 162314/173745 (executing program) 2025/09/01 10:18:09 fetching corpus: 5150, signal 162777/173746 (executing program) 2025/09/01 10:18:09 fetching corpus: 5200, signal 163045/173748 (executing program) 2025/09/01 10:18:10 fetching corpus: 5250, signal 163331/173755 (executing program) 2025/09/01 10:18:10 fetching corpus: 5300, signal 164046/173759 (executing program) 2025/09/01 10:18:10 fetching corpus: 5350, signal 164482/173799 (executing program) 2025/09/01 10:18:10 fetching corpus: 5400, signal 165157/173806 (executing program) 2025/09/01 10:18:10 fetching corpus: 5450, signal 165568/173878 (executing program) 2025/09/01 10:18:10 fetching corpus: 5500, signal 165903/173883 (executing program) 2025/09/01 10:18:10 fetching corpus: 5550, signal 166293/173891 (executing program) 2025/09/01 10:18:10 fetching corpus: 5600, signal 166585/173896 (executing program) 2025/09/01 10:18:10 fetching corpus: 5650, signal 167180/173901 (executing program) 2025/09/01 10:18:10 fetching corpus: 5700, signal 167449/173929 (executing program) 2025/09/01 10:18:10 fetching corpus: 5750, signal 167905/173979 (executing program) 2025/09/01 10:18:11 fetching corpus: 5800, signal 168252/173990 (executing program) 2025/09/01 10:18:11 fetching corpus: 5850, signal 168624/173990 (executing program) 2025/09/01 10:18:11 fetching corpus: 5900, signal 168909/174007 (executing program) 2025/09/01 10:18:11 fetching corpus: 5950, signal 169488/174016 (executing program) 2025/09/01 10:18:11 fetching corpus: 6000, signal 169908/174029 (executing program) 2025/09/01 10:18:11 fetching corpus: 6050, signal 170164/174033 (executing program) 2025/09/01 10:18:11 fetching corpus: 6100, signal 170601/174036 (executing program) 2025/09/01 10:18:11 fetching corpus: 6150, signal 170886/174037 (executing program) 2025/09/01 10:18:11 fetching corpus: 6190, signal 171257/174047 (executing program) 2025/09/01 10:18:11 fetching corpus: 6190, signal 171257/174047 (executing program) 2025/09/01 10:18:13 starting 8 fuzzer processes 10:18:13 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000007040)) 10:18:13 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_INFO(0x0, 0x0, 0x3, &(0x7f0000000000)=""/8) semget$private(0x0, 0x1, 0x0) semop(0x0, &(0x7f0000000040)=[{0x0, 0x7fff}, {}], 0x2) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)=[0x66, 0x0, 0x0]) 10:18:13 executing program 2: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r1, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000280)={0x20, r2, 0x1, 0x0, 0x0, {0x1a}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0x20}}, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, r4}) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback}, 0x1c) 10:18:13 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xb2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f00000001c0)) 10:18:13 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_SETVESABLANK(0xffffffffffffffff, 0x541c, 0x0) ioctl$KDSETLED(r0, 0x541c, 0x0) [ 84.638372] audit: type=1400 audit(1756721893.890:7): avc: denied { execmem } for pid=273 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 10:18:13 executing program 7: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) syz_mount_image$tmpfs(0x0, &(0x7f0000000d00)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) rename(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='./file0\x00') 10:18:14 executing program 5: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000180)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x28, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}]}, 0x28}}, 0x0) 10:18:14 executing program 6: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) fstatfs(r0, &(0x7f0000001f80)=""/91) [ 85.778829] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.782754] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.786676] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.791092] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.793554] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.917403] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 85.921641] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.926289] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.928866] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 85.936884] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 85.941965] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.944007] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 85.947685] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.948063] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 85.953436] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 86.035527] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 86.040347] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 86.048894] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 86.061605] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 86.066570] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 86.114664] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 86.116966] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 86.119269] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 86.122568] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 86.122666] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 86.128493] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 86.129986] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 86.150648] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 86.163254] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 86.165922] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 86.175300] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 86.176414] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 86.178922] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 86.182193] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 86.183284] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 86.184367] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 86.188394] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 86.196615] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 86.214890] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 86.217678] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 87.872624] Bluetooth: hci0: command tx timeout [ 88.001569] Bluetooth: hci1: command tx timeout [ 88.001596] Bluetooth: hci2: command tx timeout [ 88.128147] Bluetooth: hci3: command tx timeout [ 88.258148] Bluetooth: hci6: command tx timeout [ 88.258874] Bluetooth: hci5: command tx timeout [ 88.260052] Bluetooth: hci4: command tx timeout [ 88.320103] Bluetooth: hci7: command tx timeout [ 89.920081] Bluetooth: hci0: command tx timeout [ 90.048240] Bluetooth: hci1: command tx timeout [ 90.049818] Bluetooth: hci2: command tx timeout [ 90.177280] Bluetooth: hci3: command tx timeout [ 90.305230] Bluetooth: hci6: command tx timeout [ 90.305591] Bluetooth: hci4: command tx timeout [ 90.305688] Bluetooth: hci5: command tx timeout [ 90.368090] Bluetooth: hci7: command tx timeout [ 91.968152] Bluetooth: hci0: command tx timeout [ 92.096094] Bluetooth: hci2: command tx timeout [ 92.096536] Bluetooth: hci1: command tx timeout [ 92.225160] Bluetooth: hci3: command tx timeout [ 92.352181] Bluetooth: hci5: command tx timeout [ 92.353221] Bluetooth: hci4: command tx timeout [ 92.353365] Bluetooth: hci6: command tx timeout [ 92.416143] Bluetooth: hci7: command tx timeout [ 94.017182] Bluetooth: hci0: command tx timeout [ 94.144103] Bluetooth: hci1: command tx timeout [ 94.144140] Bluetooth: hci2: command tx timeout [ 94.272850] Bluetooth: hci3: command tx timeout [ 94.400537] Bluetooth: hci6: command tx timeout [ 94.400717] Bluetooth: hci4: command tx timeout [ 94.401712] Bluetooth: hci5: command tx timeout [ 94.464150] Bluetooth: hci7: command tx timeout [ 122.688757] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.689393] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.878310] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.878936] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.143109] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.143724] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.398761] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.399953] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.421168] audit: type=1400 audit(1756721932.671:8): avc: denied { open } for pid=3695 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 123.425329] audit: type=1400 audit(1756721932.671:9): avc: denied { kernel } for pid=3695 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 123.600792] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.601694] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.784208] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.784823] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 10:18:53 executing program 2: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r1, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000280)={0x20, r2, 0x1, 0x0, 0x0, {0x1a}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0x20}}, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, r4}) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback}, 0x1c) 10:18:53 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xb2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f00000001c0)) 10:18:53 executing program 2: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r1, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000280)={0x20, r2, 0x1, 0x0, 0x0, {0x1a}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0x20}}, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, r4}) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback}, 0x1c) 10:18:53 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xb2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f00000001c0)) 10:18:53 executing program 2: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r1, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000280)={0x20, r2, 0x1, 0x0, 0x0, {0x1a}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0x20}}, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, r4}) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback}, 0x1c) 10:18:53 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xb2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f00000001c0)) [ 124.999057] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 124.999702] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.071485] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.072130] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.245902] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.246563] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.321852] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.322603] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.363566] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.364376] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.452213] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.452862] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.681679] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.682376] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.761800] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.762834] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.969444] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.970086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.990628] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.991247] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 10:18:55 executing program 0: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_INFO(0x0, 0x0, 0x3, &(0x7f0000000000)=""/8) semget$private(0x0, 0x1, 0x0) semop(0x0, &(0x7f0000000040)=[{0x0, 0x7fff}, {}], 0x2) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)=[0x66, 0x0, 0x0]) 10:18:55 executing program 2: r0 = syz_io_uring_setup(0x2375, &(0x7f00000066c0), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000006740), &(0x7f0000006780)) io_uring_enter(r0, 0x4e2f, 0x0, 0x0, 0x0, 0x0) 10:18:55 executing program 4: r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000400)=0x20) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x6200, 0x0) 10:18:55 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCL_SETVESABLANK(0xffffffffffffffff, 0x541c, 0x0) ioctl$KDSETLED(r0, 0x541c, 0x0) 10:18:55 executing program 5: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000180)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x28, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}]}, 0x28}}, 0x0) 10:18:55 executing program 7: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) syz_mount_image$tmpfs(0x0, &(0x7f0000000d00)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) rename(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='./file0\x00') 10:18:55 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_INFO(0x0, 0x0, 0x3, &(0x7f0000000000)=""/8) semget$private(0x0, 0x1, 0x0) semop(0x0, &(0x7f0000000040)=[{0x0, 0x7fff}, {}], 0x2) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)=[0x66, 0x0, 0x0]) 10:18:55 executing program 6: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) fstatfs(r0, &(0x7f0000001f80)=""/91) 10:18:55 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_INFO(0x0, 0x0, 0x3, &(0x7f0000000000)=""/8) semget$private(0x0, 0x1, 0x0) semop(0x0, &(0x7f0000000040)=[{0x0, 0x7fff}, {}], 0x2) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000000)=[0x66, 0x0, 0x0]) 10:18:55 executing program 6: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) fstatfs(r0, &(0x7f0000001f80)=""/91) 10:18:55 executing program 2: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000180)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x28, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan1\x00'}]}, 0x28}}, 0x0) [ 126.253209] Oops: general protection fault, probably for non-canonical address 0xe2fffc0000000032: 0000 [#1] SMP KASAN NOPTI [ 126.254153] KASAN: maybe wild-memory-access in range [0x1800000000000190-0x1800000000000197] [ 126.254865] CPU: 0 UID: 0 PID: 3932 Comm: syz-executor.1 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 126.256786] Tainted: [W]=WARN [ 126.257386] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 126.258923] RIP: 0010:perf_tp_event+0x175/0xe70 [ 126.260166] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 126.263421] RSP: 0018:ffff888046ac7800 EFLAGS: 00010212 [ 126.264245] RAX: 0300000000000032 RBX: 17ffffffffffffa0 RCX: ffffc900046ad000 [ 126.264817] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 1800000000000190 [ 126.265384] RBP: ffff888046ac7a70 R08: ffff88806ce31340 R09: ffffe8ffffc16018 [ 126.265947] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 126.266508] R13: 0000000000000000 R14: ffff88806ce31340 R15: dffffc0000000000 [ 126.267084] FS: 00007f7823660700(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000 [ 126.267720] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 126.268183] CR2: 00007f78261fe018 CR3: 0000000045aa6000 CR4: 0000000000350ef0 [ 126.268754] Call Trace: [ 126.268968] [ 126.269153] ? perf_swevent_event+0x63/0x3f0 [ 126.269516] ? __pfx_perf_tp_event+0x10/0x10 [ 126.269883] ? tracing_gen_ctx_irq_test+0x167/0x1f0 [ 126.270289] ? tracing_gen_ctx_irq_test+0x167/0x1f0 [ 126.270700] ? perf_swevent_event+0x63/0x3f0 [ 126.271068] ? perf_tp_event+0x807/0xe70 [ 126.271404] ? __pfx_perf_tp_event+0x10/0x10 [ 126.271766] ? __perf_install_in_context+0x503/0xb90 [ 126.272180] ? do_raw_spin_unlock+0x53/0x220 [ 126.272543] ? perf_trace_run_bpf_submit+0xef/0x180 [ 126.272953] perf_trace_run_bpf_submit+0xef/0x180 [ 126.273351] perf_trace_lock+0x337/0x5d0 [ 126.273690] ? __pfx_perf_trace_lock+0x10/0x10 [ 126.274064] ? lock_acquire+0x15e/0x2f0 [ 126.274389] ? futex_ref_get+0x48/0x300 [ 126.274724] ? futex_ref_get+0x114/0x300 [ 126.275049] ? futex_hash+0x15c/0x390 [ 126.275360] lock_release+0x1ab/0x290 [ 126.275673] ? futex_hash+0x15c/0x390 [ 126.275982] futex_ref_get+0x119/0x300 [ 126.276299] ? futex_hash+0x15c/0x390 [ 126.276604] futex_hash+0x70/0x390 [ 126.276896] futex_wake+0x143/0x540 [ 126.277198] ? __pfx_perf_trace_lock+0x10/0x10 [ 126.277575] ? __pfx_futex_wake+0x10/0x10 [ 126.277919] ? __do_sys_perf_event_open+0x44d/0x2c20 [ 126.278326] ? lock_release+0xc8/0x290 [ 126.278650] do_futex+0x26d/0x370 [ 126.278939] ? __pfx_do_futex+0x10/0x10 [ 126.279275] ? __pfx___do_sys_perf_event_open+0x10/0x10 [ 126.279700] ? find_held_lock+0x2b/0x80 [ 126.280036] __x64_sys_futex+0x1c9/0x4d0 [ 126.280367] ? __pfx___x64_sys_futex+0x10/0x10 [ 126.280745] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 126.281170] do_syscall_64+0xbf/0x360 [ 126.281483] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.281895] RIP: 0033:0x7f78260eab19 [ 126.282192] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 126.283646] RSP: 002b:00007f7823660218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 126.284250] RAX: ffffffffffffffda RBX: 00007f78261fdf68 RCX: 00007f78260eab19 [ 126.284816] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f78261fdf6c [ 126.285385] RBP: 00007f78261fdf60 R08: 000000000000000e R09: 0000000000000000 [ 126.285948] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f78261fdf6c [ 126.286511] R13: 00007fff9ff4847f R14: 00007f7823660300 R15: 0000000000022000 [ 126.287091] [ 126.287287] Modules linked in: [ 126.287588] Oops: general protection fault, probably for non-canonical address 0xe2fffc0000000032: 0000 [#2] SMP KASAN NOPTI [ 126.288462] KASAN: maybe wild-memory-access in range [0x1800000000000190-0x1800000000000197] [ 126.289128] CPU: 0 UID: 0 PID: 3932 Comm: syz-executor.1 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 126.290071] Tainted: [D]=DIE, [W]=WARN [ 126.290385] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 126.291057] RIP: 0010:perf_tp_event+0x175/0xe70 [ 126.291440] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 126.292883] RSP: 0018:ffff88806ce08a80 EFLAGS: 00010012 [ 126.293318] RAX: 0300000000000032 RBX: 17ffffffffffffa0 RCX: ffffffff818998a3 [ 126.293886] RDX: ffff888017b80000 RSI: ffffffff8189a4e7 RDI: 1800000000000190 [ 126.294458] RBP: ffff88806ce08cf0 R08: ffff88806ce31490 R09: ffffe8ffffc16018 [ 126.295032] R10: 0000000000000000 R11: 746e756f63716573 R12: dffffc0000000000 [ 126.295600] R13: 0000000000000000 R14: ffff88806ce31490 R15: dffffc0000000000 [ 126.296170] FS: 00007f7823660700(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000 [ 126.296814] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 126.297277] CR2: 00007f78261fe018 CR3: 0000000045aa6000 CR4: 0000000000350ef0 [ 126.297843] Call Trace: [ 126.298053] [ 126.298238] ? __pfx_perf_tp_event+0x10/0x10 [ 126.298607] ? __pfx_css_rstat_updated+0x10/0x10 [ 126.298996] ? lock_is_held_type+0x9e/0x120 [ 126.299351] ? trace_pelt_se_tp+0xdf/0x130 [ 126.299688] ? __update_load_avg_se+0x428/0xa40 [ 126.300075] ? perf_trace_lock+0xb5/0x5d0 [ 126.300417] ? __pfx_perf_trace_lock+0x10/0x10 [ 126.300789] ? lock_acquire+0x15e/0x2f0 [ 126.301110] ? lock_is_held_type+0x9e/0x120 [ 126.301467] ? perf_trace_run_bpf_submit+0xef/0x180 [ 126.301876] perf_trace_run_bpf_submit+0xef/0x180 [ 126.302274] perf_trace_lock+0x337/0x5d0 [ 126.302611] ? place_entity+0x1c/0x410 [ 126.302927] ? kvm_sched_clock_read+0x16/0x30 [ 126.303301] ? __pfx_perf_trace_lock+0x10/0x10 [ 126.303677] ? hrtimer_interrupt+0x114/0x830 [ 126.304032] lock_release+0x1ab/0x290 [ 126.304352] ktime_get_update_offsets_now+0xab/0x3c0 [ 126.304765] ? hrtimer_interrupt+0x114/0x830 [ 126.305123] hrtimer_interrupt+0x114/0x830 [ 126.305466] ? __pfx_do_sync_core+0x10/0x10 [ 126.305815] ? trace_csd_function_exit+0x134/0x190 [ 126.306218] ? __flush_smp_call_function_queue+0x28c/0x740 [ 126.306681] __sysvec_apic_timer_interrupt+0xbb/0x330 [ 126.307100] sysvec_apic_timer_interrupt+0x6b/0x80 [ 126.307502] [ 126.307686] [ 126.307871] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 126.308293] RIP: 0010:oops_exit+0x0/0x50 [ 126.308628] Code: 00 3a 00 be ff ff ff ff 48 c7 c7 50 b4 43 86 e8 c6 0f f9 ff 5b e9 50 00 3a 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 53 e8 36 00 3a 00 8b 1d c0 3d 4f 06 31 ff 89 de e8 57 [ 126.310063] RSP: 0018:ffff888046ac7690 EFLAGS: 00000202 [ 126.310490] RAX: 000000000002b8b3 RBX: 0000000000000212 RCX: ffffc900046ad000 [ 126.311056] RDX: 0000000000040000 RSI: ffffffff812a3dca RDI: 0000000000000007 [ 126.311618] RBP: 000000000000000b R08: 0000000000000001 R09: fffffbfff0f12690 [ 126.312180] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888046ac7758 [ 126.312738] R13: 0000000000000000 R14: e2fffc0000000032 R15: 0000000000000000 [ 126.313306] ? oops_end+0x4a/0xe0 [ 126.313596] oops_end+0x65/0xe0 [ 126.313871] exc_general_protection+0x1a2/0x330 [ 126.314255] asm_exc_general_protection+0x26/0x30 [ 126.314651] RIP: 0010:perf_tp_event+0x175/0xe70 [ 126.315027] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 126.316471] RSP: 0018:ffff888046ac7800 EFLAGS: 00010212 [ 126.316896] RAX: 0300000000000032 RBX: 17ffffffffffffa0 RCX: ffffc900046ad000 [ 126.317461] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 1800000000000190 [ 126.318028] RBP: ffff888046ac7a70 R08: ffff88806ce31340 R09: ffffe8ffffc16018 [ 126.318604] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 126.319169] R13: 0000000000000000 R14: ffff88806ce31340 R15: dffffc0000000000 [ 126.319737] ? perf_tp_event+0x167/0xe70 [ 126.320072] ? perf_swevent_event+0x63/0x3f0 [ 126.320435] ? __pfx_perf_tp_event+0x10/0x10 [ 126.320792] ? tracing_gen_ctx_irq_test+0x167/0x1f0 [ 126.321197] ? tracing_gen_ctx_irq_test+0x167/0x1f0 [ 126.321596] ? perf_swevent_event+0x63/0x3f0 [ 126.321956] ? perf_tp_event+0x807/0xe70 [ 126.322290] ? __pfx_perf_tp_event+0x10/0x10 [ 126.322656] ? __perf_install_in_context+0x503/0xb90 [ 126.323065] ? do_raw_spin_unlock+0x53/0x220 [ 126.323426] ? perf_trace_run_bpf_submit+0xef/0x180 [ 126.323829] perf_trace_run_bpf_submit+0xef/0x180 [ 126.324221] perf_trace_lock+0x337/0x5d0 [ 126.324551] ? __pfx_perf_trace_lock+0x10/0x10 [ 126.324923] ? lock_acquire+0x15e/0x2f0 [ 126.325244] ? futex_ref_get+0x48/0x300 [ 126.325562] ? futex_ref_get+0x114/0x300 [ 126.325888] ? futex_hash+0x15c/0x390 [ 126.326195] lock_release+0x1ab/0x290 [ 126.326504] ? futex_hash+0x15c/0x390 [ 126.326822] futex_ref_get+0x119/0x300 [ 126.327138] ? futex_hash+0x15c/0x390 [ 126.327445] futex_hash+0x70/0x390 [ 126.327735] futex_wake+0x143/0x540 [ 126.328032] ? __pfx_perf_trace_lock+0x10/0x10 [ 126.328403] ? __pfx_futex_wake+0x10/0x10 [ 126.328738] ? __do_sys_perf_event_open+0x44d/0x2c20 [ 126.329145] ? lock_release+0xc8/0x290 [ 126.329464] do_futex+0x26d/0x370 [ 126.329751] ? __pfx_do_futex+0x10/0x10 [ 126.330071] ? __pfx___do_sys_perf_event_open+0x10/0x10 [ 126.330494] ? find_held_lock+0x2b/0x80 [ 126.330828] __x64_sys_futex+0x1c9/0x4d0 [ 126.331162] ? __pfx___x64_sys_futex+0x10/0x10 [ 126.331534] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 126.331954] do_syscall_64+0xbf/0x360 [ 126.332263] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.332673] RIP: 0033:0x7f78260eab19 [ 126.332988] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 126.334421] RSP: 002b:00007f7823660218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 126.335030] RAX: ffffffffffffffda RBX: 00007f78261fdf68 RCX: 00007f78260eab19 [ 126.335598] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f78261fdf6c [ 126.336181] RBP: 00007f78261fdf60 R08: 000000000000000e R09: 0000000000000000 [ 126.336745] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f78261fdf6c [ 126.337305] R13: 00007fff9ff4847f R14: 00007f7823660300 R15: 0000000000022000 [ 126.337872] [ 126.338062] Modules linked in: [ 126.338324] ---[ end trace 0000000000000000 ]--- [ 126.338704] RIP: 0010:perf_tp_event+0x175/0xe70 [ 126.339080] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 126.340506] RSP: 0018:ffff888046ac7800 EFLAGS: 00010212 [ 126.340928] RAX: 0300000000000032 RBX: 17ffffffffffffa0 RCX: ffffc900046ad000 [ 126.341491] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 1800000000000190 [ 126.342049] RBP: ffff888046ac7a70 R08: ffff88806ce31340 R09: ffffe8ffffc16018 [ 126.342617] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 126.343181] R13: 0000000000000000 R14: ffff88806ce31340 R15: dffffc0000000000 [ 126.343746] FS: 00007f7823660700(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000 [ 126.344376] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 126.344839] CR2: 00007f78261fe018 CR3: 0000000045aa6000 CR4: 0000000000350ef0 [ 126.345411] Kernel panic - not syncing: Fatal exception in interrupt [ 126.346112] Kernel Offset: disabled [ 126.346438] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- VM DIAGNOSIS: 10:18:55 Registers: info registers vcpu 0 RAX=0000000000000037 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff828e5105 RDI=ffffffff88729280 RBP=ffffffff88729240 RSP=ffff888046ac7158 R8 =0000000000000000 R9 =ffffed1001735046 R10=0000000000000037 R11=30376578302f4952 R12=0000000000000037 R13=0000000000000010 R14=ffffffff88729240 R15=ffffffff828e50f0 RIP=ffffffff828e515d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f7823660700 00000000 00000000 GS =0000 ffff8880e55d8000 00000000 00000000 LDT=0000 fffffe2500000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f78261fe018 CR3=0000000045aa6000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f78261d17c000007f78261d17c8 XMM02=00007f78261d17e000007f78261d17c0 XMM03=00007f78261d17c800007f78261d17c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=00000000000119c4 RBX=ffff88806ce3de20 RCX=ffffc900084cc000 RDX=0000000000040000 RSI=ffffffff816880d6 RDI=0000000000000005 RBP=0000000000000003 RSP=ffff888046a375a8 R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000001 R11=1ffff1100d9e6bb1 R12=ffffed100d9c7bc5 R13=ffff88806ce3de28 R14=0000000000000001 R15=dffffc0000000000 RIP=ffffffff816880d8 RFL=00000216 [----AP-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f53696d8700 00000000 00000000 GS =0000 ffff8880e56d8000 00000000 00000000 LDT=0000 fffffe5800000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f536c276018 CR3=000000000ff09000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f536c2497c000007f536c2497c8 XMM02=00007f536c2497e000007f536c2497c0 XMM03=00007f536c2497c800007f536c2497c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000