Warning: Permanently added '[localhost]:46574' (ECDSA) to the list of known hosts. 2025/09/01 11:58:07 fuzzer started 2025/09/01 11:58:08 dialing manager at localhost:35473 syzkaller login: [ 58.487943] cgroup: Unknown subsys name 'net' [ 58.555959] cgroup: Unknown subsys name 'cpuset' [ 58.612855] cgroup: Unknown subsys name 'rlimit' 2025/09/01 11:58:19 syscalls: 2214 2025/09/01 11:58:19 code coverage: enabled 2025/09/01 11:58:19 comparison tracing: enabled 2025/09/01 11:58:19 extra coverage: enabled 2025/09/01 11:58:19 setuid sandbox: enabled 2025/09/01 11:58:19 namespace sandbox: enabled 2025/09/01 11:58:19 Android sandbox: enabled 2025/09/01 11:58:19 fault injection: enabled 2025/09/01 11:58:19 leak checking: enabled 2025/09/01 11:58:19 net packet injection: enabled 2025/09/01 11:58:19 net device setup: enabled 2025/09/01 11:58:19 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/09/01 11:58:19 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/09/01 11:58:19 USB emulation: enabled 2025/09/01 11:58:19 hci packet injection: enabled 2025/09/01 11:58:19 wifi device emulation: enabled 2025/09/01 11:58:19 802.15.4 emulation: enabled 2025/09/01 11:58:19 fetching corpus: 0, signal 0/2000 (executing program) 2025/09/01 11:58:19 fetching corpus: 50, signal 24483/28019 (executing program) 2025/09/01 11:58:19 fetching corpus: 100, signal 35703/40652 (executing program) 2025/09/01 11:58:19 fetching corpus: 150, signal 43321/49574 (executing program) 2025/09/01 11:58:20 fetching corpus: 200, signal 49427/56956 (executing program) 2025/09/01 11:58:20 fetching corpus: 250, signal 54434/63112 (executing program) 2025/09/01 11:58:20 fetching corpus: 300, signal 60220/69955 (executing program) 2025/09/01 11:58:20 fetching corpus: 350, signal 63438/74290 (executing program) 2025/09/01 11:58:20 fetching corpus: 400, signal 67678/79520 (executing program) 2025/09/01 11:58:20 fetching corpus: 450, signal 71663/84416 (executing program) 2025/09/01 11:58:20 fetching corpus: 500, signal 74215/87930 (executing program) 2025/09/01 11:58:20 fetching corpus: 550, signal 77964/92377 (executing program) 2025/09/01 11:58:20 fetching corpus: 600, signal 79730/95099 (executing program) 2025/09/01 11:58:20 fetching corpus: 650, signal 82490/98651 (executing program) 2025/09/01 11:58:20 fetching corpus: 700, signal 84151/101193 (executing program) 2025/09/01 11:58:21 fetching corpus: 750, signal 85566/103481 (executing program) 2025/09/01 11:58:21 fetching corpus: 800, signal 87987/106573 (executing program) 2025/09/01 11:58:21 fetching corpus: 850, signal 91266/110313 (executing program) 2025/09/01 11:58:21 fetching corpus: 900, signal 92409/112305 (executing program) 2025/09/01 11:58:21 fetching corpus: 950, signal 94647/115147 (executing program) 2025/09/01 11:58:21 fetching corpus: 1000, signal 96705/117801 (executing program) 2025/09/01 11:58:21 fetching corpus: 1050, signal 98449/120148 (executing program) 2025/09/01 11:58:21 fetching corpus: 1100, signal 99901/122267 (executing program) 2025/09/01 11:58:21 fetching corpus: 1150, signal 101159/124137 (executing program) 2025/09/01 11:58:21 fetching corpus: 1200, signal 102973/126475 (executing program) 2025/09/01 11:58:22 fetching corpus: 1250, signal 105427/129312 (executing program) 2025/09/01 11:58:22 fetching corpus: 1300, signal 106814/131223 (executing program) 2025/09/01 11:58:22 fetching corpus: 1350, signal 108424/133321 (executing program) 2025/09/01 11:58:22 fetching corpus: 1400, signal 109598/135050 (executing program) 2025/09/01 11:58:22 fetching corpus: 1450, signal 111552/137279 (executing program) 2025/09/01 11:58:22 fetching corpus: 1500, signal 112708/138956 (executing program) 2025/09/01 11:58:22 fetching corpus: 1550, signal 113883/140563 (executing program) 2025/09/01 11:58:22 fetching corpus: 1600, signal 115117/142196 (executing program) 2025/09/01 11:58:22 fetching corpus: 1650, signal 116183/143705 (executing program) 2025/09/01 11:58:22 fetching corpus: 1700, signal 117566/145385 (executing program) 2025/09/01 11:58:23 fetching corpus: 1750, signal 118800/146940 (executing program) 2025/09/01 11:58:23 fetching corpus: 1800, signal 120506/148758 (executing program) 2025/09/01 11:58:23 fetching corpus: 1850, signal 121660/150207 (executing program) 2025/09/01 11:58:23 fetching corpus: 1900, signal 122305/151335 (executing program) 2025/09/01 11:58:23 fetching corpus: 1950, signal 123874/153012 (executing program) 2025/09/01 11:58:23 fetching corpus: 2000, signal 124716/154257 (executing program) 2025/09/01 11:58:23 fetching corpus: 2050, signal 125588/155483 (executing program) 2025/09/01 11:58:23 fetching corpus: 2100, signal 126543/156666 (executing program) 2025/09/01 11:58:23 fetching corpus: 2150, signal 127471/157919 (executing program) 2025/09/01 11:58:23 fetching corpus: 2200, signal 128508/159142 (executing program) 2025/09/01 11:58:23 fetching corpus: 2250, signal 129572/160335 (executing program) 2025/09/01 11:58:24 fetching corpus: 2300, signal 130366/161398 (executing program) 2025/09/01 11:58:24 fetching corpus: 2350, signal 131184/162507 (executing program) 2025/09/01 11:58:24 fetching corpus: 2400, signal 132478/163811 (executing program) 2025/09/01 11:58:24 fetching corpus: 2450, signal 132892/164645 (executing program) 2025/09/01 11:58:24 fetching corpus: 2500, signal 133745/165619 (executing program) 2025/09/01 11:58:24 fetching corpus: 2550, signal 134270/166510 (executing program) 2025/09/01 11:58:24 fetching corpus: 2600, signal 135027/167477 (executing program) 2025/09/01 11:58:24 fetching corpus: 2650, signal 135631/168359 (executing program) 2025/09/01 11:58:24 fetching corpus: 2700, signal 136282/169286 (executing program) 2025/09/01 11:58:24 fetching corpus: 2750, signal 136968/170196 (executing program) 2025/09/01 11:58:24 fetching corpus: 2800, signal 137925/171240 (executing program) 2025/09/01 11:58:25 fetching corpus: 2850, signal 139990/172659 (executing program) 2025/09/01 11:58:25 fetching corpus: 2900, signal 140568/173458 (executing program) 2025/09/01 11:58:25 fetching corpus: 2950, signal 141156/174263 (executing program) 2025/09/01 11:58:25 fetching corpus: 3000, signal 142041/175189 (executing program) 2025/09/01 11:58:25 fetching corpus: 3050, signal 142610/175930 (executing program) 2025/09/01 11:58:25 fetching corpus: 3100, signal 143383/176799 (executing program) 2025/09/01 11:58:25 fetching corpus: 3150, signal 143884/177517 (executing program) 2025/09/01 11:58:25 fetching corpus: 3200, signal 144319/178187 (executing program) 2025/09/01 11:58:25 fetching corpus: 3250, signal 145118/178951 (executing program) 2025/09/01 11:58:25 fetching corpus: 3300, signal 145710/179600 (executing program) 2025/09/01 11:58:25 fetching corpus: 3350, signal 146103/180239 (executing program) 2025/09/01 11:58:25 fetching corpus: 3400, signal 146590/180888 (executing program) 2025/09/01 11:58:26 fetching corpus: 3450, signal 147014/181510 (executing program) 2025/09/01 11:58:26 fetching corpus: 3500, signal 147786/182234 (executing program) 2025/09/01 11:58:26 fetching corpus: 3550, signal 148270/182845 (executing program) 2025/09/01 11:58:26 fetching corpus: 3600, signal 148703/183433 (executing program) 2025/09/01 11:58:26 fetching corpus: 3650, signal 149823/184159 (executing program) 2025/09/01 11:58:26 fetching corpus: 3700, signal 150439/184807 (executing program) 2025/09/01 11:58:26 fetching corpus: 3750, signal 150939/185395 (executing program) 2025/09/01 11:58:26 fetching corpus: 3800, signal 151425/185961 (executing program) 2025/09/01 11:58:26 fetching corpus: 3850, signal 152033/186494 (executing program) 2025/09/01 11:58:26 fetching corpus: 3900, signal 152536/187034 (executing program) 2025/09/01 11:58:26 fetching corpus: 3950, signal 153031/187580 (executing program) 2025/09/01 11:58:27 fetching corpus: 4000, signal 153483/188143 (executing program) 2025/09/01 11:58:27 fetching corpus: 4050, signal 154077/188694 (executing program) 2025/09/01 11:58:27 fetching corpus: 4100, signal 154497/189158 (executing program) 2025/09/01 11:58:27 fetching corpus: 4150, signal 154972/189664 (executing program) 2025/09/01 11:58:27 fetching corpus: 4200, signal 155329/190101 (executing program) 2025/09/01 11:58:27 fetching corpus: 4250, signal 155784/190574 (executing program) 2025/09/01 11:58:27 fetching corpus: 4300, signal 156168/191014 (executing program) 2025/09/01 11:58:27 fetching corpus: 4350, signal 157335/191533 (executing program) 2025/09/01 11:58:27 fetching corpus: 4400, signal 157836/191986 (executing program) 2025/09/01 11:58:27 fetching corpus: 4450, signal 158404/192438 (executing program) 2025/09/01 11:58:27 fetching corpus: 4500, signal 158979/192892 (executing program) 2025/09/01 11:58:28 fetching corpus: 4550, signal 159659/193304 (executing program) 2025/09/01 11:58:28 fetching corpus: 4600, signal 160142/193673 (executing program) 2025/09/01 11:58:28 fetching corpus: 4650, signal 160458/194079 (executing program) 2025/09/01 11:58:28 fetching corpus: 4700, signal 161132/194435 (executing program) 2025/09/01 11:58:28 fetching corpus: 4750, signal 161539/194839 (executing program) 2025/09/01 11:58:28 fetching corpus: 4800, signal 161867/194874 (executing program) 2025/09/01 11:58:28 fetching corpus: 4850, signal 162225/194899 (executing program) 2025/09/01 11:58:28 fetching corpus: 4900, signal 162595/194912 (executing program) 2025/09/01 11:58:28 fetching corpus: 4950, signal 163429/194917 (executing program) 2025/09/01 11:58:28 fetching corpus: 5000, signal 163941/194925 (executing program) 2025/09/01 11:58:28 fetching corpus: 5050, signal 164576/194928 (executing program) 2025/09/01 11:58:28 fetching corpus: 5100, signal 165327/194930 (executing program) 2025/09/01 11:58:29 fetching corpus: 5150, signal 165831/194943 (executing program) 2025/09/01 11:58:29 fetching corpus: 5200, signal 166454/195019 (executing program) 2025/09/01 11:58:29 fetching corpus: 5250, signal 166992/195090 (executing program) 2025/09/01 11:58:29 fetching corpus: 5300, signal 167341/195091 (executing program) 2025/09/01 11:58:29 fetching corpus: 5350, signal 167639/195108 (executing program) 2025/09/01 11:58:29 fetching corpus: 5400, signal 168072/195142 (executing program) 2025/09/01 11:58:29 fetching corpus: 5450, signal 168626/195161 (executing program) 2025/09/01 11:58:29 fetching corpus: 5500, signal 168959/195165 (executing program) 2025/09/01 11:58:29 fetching corpus: 5550, signal 169242/195171 (executing program) 2025/09/01 11:58:29 fetching corpus: 5600, signal 169728/195173 (executing program) 2025/09/01 11:58:29 fetching corpus: 5650, signal 170429/195190 (executing program) 2025/09/01 11:58:30 fetching corpus: 5700, signal 170962/195197 (executing program) 2025/09/01 11:58:30 fetching corpus: 5750, signal 171331/195231 (executing program) 2025/09/01 11:58:30 fetching corpus: 5800, signal 171818/195237 (executing program) 2025/09/01 11:58:30 fetching corpus: 5850, signal 172415/195249 (executing program) 2025/09/01 11:58:30 fetching corpus: 5900, signal 172935/195260 (executing program) 2025/09/01 11:58:30 fetching corpus: 5950, signal 173461/195260 (executing program) 2025/09/01 11:58:30 fetching corpus: 6000, signal 173878/195260 (executing program) 2025/09/01 11:58:30 fetching corpus: 6050, signal 174204/195303 (executing program) 2025/09/01 11:58:30 fetching corpus: 6100, signal 174668/195303 (executing program) 2025/09/01 11:58:30 fetching corpus: 6150, signal 174972/195305 (executing program) 2025/09/01 11:58:30 fetching corpus: 6200, signal 175344/195316 (executing program) 2025/09/01 11:58:31 fetching corpus: 6250, signal 175617/195319 (executing program) 2025/09/01 11:58:31 fetching corpus: 6300, signal 175928/195348 (executing program) 2025/09/01 11:58:31 fetching corpus: 6350, signal 176231/195356 (executing program) 2025/09/01 11:58:31 fetching corpus: 6400, signal 176472/195364 (executing program) 2025/09/01 11:58:31 fetching corpus: 6450, signal 176788/195382 (executing program) 2025/09/01 11:58:31 fetching corpus: 6500, signal 177137/195403 (executing program) 2025/09/01 11:58:31 fetching corpus: 6550, signal 177484/195414 (executing program) 2025/09/01 11:58:31 fetching corpus: 6600, signal 177780/195423 (executing program) 2025/09/01 11:58:31 fetching corpus: 6650, signal 178059/195426 (executing program) 2025/09/01 11:58:31 fetching corpus: 6700, signal 178528/195428 (executing program) 2025/09/01 11:58:31 fetching corpus: 6750, signal 178910/195447 (executing program) 2025/09/01 11:58:31 fetching corpus: 6800, signal 179375/195453 (executing program) 2025/09/01 11:58:32 fetching corpus: 6850, signal 179809/195455 (executing program) 2025/09/01 11:58:32 fetching corpus: 6900, signal 180144/195456 (executing program) 2025/09/01 11:58:32 fetching corpus: 6950, signal 180453/195456 (executing program) 2025/09/01 11:58:32 fetching corpus: 7000, signal 180771/195456 (executing program) 2025/09/01 11:58:32 fetching corpus: 7050, signal 181085/195459 (executing program) 2025/09/01 11:58:32 fetching corpus: 7100, signal 181416/195460 (executing program) 2025/09/01 11:58:32 fetching corpus: 7150, signal 181670/195462 (executing program) 2025/09/01 11:58:32 fetching corpus: 7200, signal 181945/195466 (executing program) 2025/09/01 11:58:32 fetching corpus: 7250, signal 182304/195468 (executing program) 2025/09/01 11:58:32 fetching corpus: 7300, signal 182514/195469 (executing program) 2025/09/01 11:58:32 fetching corpus: 7350, signal 182708/195472 (executing program) 2025/09/01 11:58:32 fetching corpus: 7400, signal 183080/195475 (executing program) 2025/09/01 11:58:33 fetching corpus: 7450, signal 183339/195483 (executing program) 2025/09/01 11:58:33 fetching corpus: 7500, signal 183573/195485 (executing program) 2025/09/01 11:58:33 fetching corpus: 7550, signal 183882/195492 (executing program) 2025/09/01 11:58:33 fetching corpus: 7600, signal 184070/195493 (executing program) 2025/09/01 11:58:33 fetching corpus: 7650, signal 184275/195501 (executing program) 2025/09/01 11:58:33 fetching corpus: 7700, signal 184551/195517 (executing program) 2025/09/01 11:58:33 fetching corpus: 7750, signal 184770/195522 (executing program) 2025/09/01 11:58:33 fetching corpus: 7800, signal 184976/195523 (executing program) 2025/09/01 11:58:33 fetching corpus: 7850, signal 185201/195528 (executing program) 2025/09/01 11:58:34 fetching corpus: 7900, signal 185478/195544 (executing program) 2025/09/01 11:58:34 fetching corpus: 7950, signal 185900/195544 (executing program) 2025/09/01 11:58:34 fetching corpus: 8000, signal 186211/195556 (executing program) 2025/09/01 11:58:34 fetching corpus: 8050, signal 186610/195560 (executing program) 2025/09/01 11:58:34 fetching corpus: 8100, signal 186827/195560 (executing program) 2025/09/01 11:58:34 fetching corpus: 8150, signal 187065/195570 (executing program) 2025/09/01 11:58:34 fetching corpus: 8200, signal 187289/195573 (executing program) 2025/09/01 11:58:34 fetching corpus: 8250, signal 187648/195575 (executing program) 2025/09/01 11:58:34 fetching corpus: 8300, signal 187945/195575 (executing program) 2025/09/01 11:58:34 fetching corpus: 8350, signal 188280/195679 (executing program) 2025/09/01 11:58:34 fetching corpus: 8400, signal 188531/195686 (executing program) 2025/09/01 11:58:34 fetching corpus: 8450, signal 188730/195714 (executing program) 2025/09/01 11:58:35 fetching corpus: 8500, signal 188979/195723 (executing program) 2025/09/01 11:58:35 fetching corpus: 8550, signal 189189/195725 (executing program) 2025/09/01 11:58:35 fetching corpus: 8600, signal 189400/195730 (executing program) 2025/09/01 11:58:35 fetching corpus: 8650, signal 189678/195732 (executing program) 2025/09/01 11:58:35 fetching corpus: 8700, signal 189919/195741 (executing program) 2025/09/01 11:58:35 fetching corpus: 8750, signal 190413/195749 (executing program) 2025/09/01 11:58:35 fetching corpus: 8800, signal 190720/195750 (executing program) 2025/09/01 11:58:35 fetching corpus: 8850, signal 190940/195754 (executing program) 2025/09/01 11:58:35 fetching corpus: 8900, signal 191169/195760 (executing program) 2025/09/01 11:58:35 fetching corpus: 8950, signal 191405/195762 (executing program) 2025/09/01 11:58:35 fetching corpus: 9000, signal 191610/195780 (executing program) 2025/09/01 11:58:36 fetching corpus: 9050, signal 191878/195818 (executing program) 2025/09/01 11:58:36 fetching corpus: 9100, signal 192085/195818 (executing program) 2025/09/01 11:58:36 fetching corpus: 9150, signal 192339/195825 (executing program) 2025/09/01 11:58:36 fetching corpus: 9200, signal 192518/195841 (executing program) 2025/09/01 11:58:36 fetching corpus: 9250, signal 192788/195841 (executing program) 2025/09/01 11:58:36 fetching corpus: 9259, signal 192834/195841 (executing program) 2025/09/01 11:58:36 fetching corpus: 9259, signal 192834/195841 (executing program) 2025/09/01 11:58:38 starting 8 fuzzer processes 11:58:38 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000400)=ANY=[@ANYBLOB="280000001d008d52000000000000000007"], 0x28}], 0x1}, 0x0) 11:58:38 executing program 5: prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) 11:58:38 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0) r2 = dup2(r0, r1) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x0, 0x11, r2, 0x0) 11:58:38 executing program 7: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x21, &(0x7f0000000000)="92f46193", 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000007b00)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000200)={0xa, 0x4e21, 0xbc, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c, 0x0, 0x0, &(0x7f0000000740)=ANY=[], 0x18}}], 0x2, 0x0) 11:58:38 executing program 2: ioctl$AUTOFS_IOC_PROTOVER(0xffffffffffffffff, 0x80049363, 0x0) timer_getoverrun(0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, 0x0, &(0x7f0000000180)) timer_gettime(0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000400)={{}, {0x0, 0x989680}}, 0x0) clock_gettime(0x0, 0x0) 11:58:38 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000001280)='\x00', 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000000), 0x0, 0x0, 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000040), 0x0, 0x0, 0x0) 11:58:38 executing program 6: r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000080), 0x64e00, 0x0) fremovexattr(r0, &(0x7f0000000100)=@random={'trusted.', '^[\')\x00'}) 11:58:38 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000002240)=[{&(0x7f00000005c0)={0x24, 0x26, 0x111, 0x0, 0x0, "", [@generic="bfbbe3d8d40f362658df1d13b23dbee05d"]}, 0x24}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000001b80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 88.857249] audit: type=1400 audit(1756727918.541:7): avc: denied { execmem } for pid=274 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 89.976843] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 89.979569] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 89.983869] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 89.989342] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 89.993227] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 90.033677] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 90.041686] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 90.043746] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 90.050327] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 90.053754] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 90.113507] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 90.118318] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 90.121054] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 90.125991] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 90.135996] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 90.138773] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 90.148870] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 90.151794] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 90.159930] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 90.166730] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 90.173599] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 90.186241] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 90.188854] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 90.205838] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 90.205857] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 90.214799] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 90.218014] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 90.218444] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 90.219370] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 90.220360] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 90.223368] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 90.228105] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 90.234196] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 90.236193] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 90.246566] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 90.252130] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 90.254402] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 90.256627] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 90.275645] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 90.290522] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 92.006488] Bluetooth: hci0: command tx timeout [ 92.070002] Bluetooth: hci1: command tx timeout [ 92.197969] Bluetooth: hci2: command tx timeout [ 92.261989] Bluetooth: hci3: command tx timeout [ 92.262749] Bluetooth: hci4: command tx timeout [ 92.326589] Bluetooth: hci6: command tx timeout [ 92.327366] Bluetooth: hci7: command tx timeout [ 92.390259] Bluetooth: hci5: command tx timeout [ 94.054395] Bluetooth: hci0: command tx timeout [ 94.117976] Bluetooth: hci1: command tx timeout [ 94.245992] Bluetooth: hci2: command tx timeout [ 94.310184] Bluetooth: hci3: command tx timeout [ 94.310636] Bluetooth: hci4: command tx timeout [ 94.374100] Bluetooth: hci7: command tx timeout [ 94.374540] Bluetooth: hci6: command tx timeout [ 94.437992] Bluetooth: hci5: command tx timeout [ 96.102939] Bluetooth: hci0: command tx timeout [ 96.167959] Bluetooth: hci1: command tx timeout [ 96.294078] Bluetooth: hci2: command tx timeout [ 96.358460] Bluetooth: hci3: command tx timeout [ 96.358863] Bluetooth: hci4: command tx timeout [ 96.421995] Bluetooth: hci7: command tx timeout [ 96.422403] Bluetooth: hci6: command tx timeout [ 96.485983] Bluetooth: hci5: command tx timeout [ 98.150057] Bluetooth: hci0: command tx timeout [ 98.215011] Bluetooth: hci1: command tx timeout [ 98.342139] Bluetooth: hci2: command tx timeout [ 98.406099] Bluetooth: hci4: command tx timeout [ 98.406530] Bluetooth: hci3: command tx timeout [ 98.470126] Bluetooth: hci6: command tx timeout [ 98.470528] Bluetooth: hci7: command tx timeout [ 98.534018] Bluetooth: hci5: command tx timeout [ 125.775426] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.776813] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 125.978599] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 125.979248] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 126.399384] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 126.400262] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 126.507150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 126.507738] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 11:59:16 executing program 6: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = epoll_create1(0x0) r1 = getpid() r2 = getpid() r3 = pidfd_open(r2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000000)) r4 = getpid() r5 = pidfd_open(r4, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r1, 0x7, r5, &(0x7f0000000040)={r0, r3}) [ 126.609406] audit: type=1400 audit(1756727956.293:8): avc: denied { open } for pid=3770 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 126.613419] audit: type=1400 audit(1756727956.293:9): avc: denied { kernel } for pid=3770 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 11:59:16 executing program 6: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = epoll_create1(0x0) r1 = getpid() r2 = getpid() r3 = pidfd_open(r2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000000)) r4 = getpid() r5 = pidfd_open(r4, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r1, 0x7, r5, &(0x7f0000000040)={r0, r3}) 11:59:16 executing program 6: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = epoll_create1(0x0) r1 = getpid() r2 = getpid() r3 = pidfd_open(r2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000000)) r4 = getpid() r5 = pidfd_open(r4, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r1, 0x7, r5, &(0x7f0000000040)={r0, r3}) 11:59:16 executing program 6: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = epoll_create1(0x0) r1 = getpid() r2 = getpid() r3 = pidfd_open(r2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000000)) r4 = getpid() r5 = pidfd_open(r4, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r1, 0x7, r5, &(0x7f0000000040)={r0, r3}) 11:59:16 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000002240)=[{&(0x7f00000005c0)={0x24, 0x26, 0x111, 0x0, 0x0, "", [@generic="bfbbe3d8d40f362658df1d13b23dbee05d"]}, 0x24}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000001b80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 11:59:16 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000002240)=[{&(0x7f00000005c0)={0x24, 0x26, 0x111, 0x0, 0x0, "", [@generic="bfbbe3d8d40f362658df1d13b23dbee05d"]}, 0x24}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000001b80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 11:59:16 executing program 6: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000002240)=[{&(0x7f00000005c0)={0x24, 0x26, 0x111, 0x0, 0x0, "", [@generic="bfbbe3d8d40f362658df1d13b23dbee05d"]}, 0x24}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000001b80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 11:59:16 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000002240)=[{&(0x7f00000005c0)={0x24, 0x26, 0x111, 0x0, 0x0, "", [@generic="bfbbe3d8d40f362658df1d13b23dbee05d"]}, 0x24}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000001b80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 127.341029] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 127.341671] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 127.464815] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 127.465480] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 127.535946] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 127.536537] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 127.627084] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 127.627695] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 127.731973] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 127.732603] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 127.849619] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 127.850274] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 127.944117] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 127.944757] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 127.995243] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 127.995872] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.077105] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.077740] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.149924] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.150547] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.244099] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.0'. [ 128.452856] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.454052] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.492639] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.493661] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 11:59:18 executing program 0: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_GET(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100001000ff7f0000041900000018000180140002006c6f"], 0x2c}}, 0x0) 11:59:18 executing program 7: syz_mount_image$tmpfs(&(0x7f00000007c0), 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)) 11:59:18 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x80111500, 0x0) 11:59:18 executing program 5: r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGSW(r0, 0x8040451b, 0x0) ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f0000000080)=""/35) 11:59:18 executing program 2: ioctl$AUTOFS_IOC_PROTOVER(0xffffffffffffffff, 0x80049363, 0x0) timer_getoverrun(0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, 0x0, &(0x7f0000000180)) timer_gettime(0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000400)={{}, {0x0, 0x989680}}, 0x0) clock_gettime(0x0, 0x0) 11:59:18 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0) r2 = dup2(r0, r1) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x0, 0x11, r2, 0x0) 11:59:18 executing program 6: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000002240)=[{&(0x7f00000005c0)={0x24, 0x26, 0x111, 0x0, 0x0, "", [@generic="bfbbe3d8d40f362658df1d13b23dbee05d"]}, 0x24}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000001b80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 11:59:18 executing program 4: openat$sr(0xffffffffffffff9c, &(0x7f00000003c0), 0x800, 0x0) 11:59:18 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0) r2 = dup2(r0, r1) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x0, 0x11, r2, 0x0) 11:59:18 executing program 6: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000002240)=[{&(0x7f00000005c0)={0x24, 0x26, 0x111, 0x0, 0x0, "", [@generic="bfbbe3d8d40f362658df1d13b23dbee05d"]}, 0x24}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000001b80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 11:59:18 executing program 0: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0xa, &(0x7f0000000040)=0x7, 0x4) sendmmsg$inet6(r0, &(0x7f0000004100)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1c, 0x0}}], 0x1, 0x0) 11:59:18 executing program 7: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8936, &(0x7f00000000c0)={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x3}}, 0x0, r2}) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0) 11:59:18 executing program 2: ioctl$AUTOFS_IOC_PROTOVER(0xffffffffffffffff, 0x80049363, 0x0) timer_getoverrun(0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, 0x0, &(0x7f0000000180)) timer_gettime(0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000400)={{}, {0x0, 0x989680}}, 0x0) clock_gettime(0x0, 0x0) 11:59:18 executing program 5: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000000)) syz_mount_image$tmpfs(0x0, &(0x7f0000000d00)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) getxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='security.selinux\x00', &(0x7f00000000c0)=""/241, 0xf1) 11:59:18 executing program 3: syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020801000240008000f80100200040000000000000000000800029600c6cf153595a4b414c4c4552202046415431322020200e1fbe5b7cac22c0740b56b40ebb0700cd105eebf032e4cd16cd19ebfe54686973206973206e6f74206120626f6f7461626c65206469736b2e2020506c6561736520696e73657274206120626f6f7461626c6520666c6f70707920616e640d0a707265737320616e79206b657920746f2074727920616761696e202e2e2e200d0a00", 0xc0}, {0x0, 0x0, 0x1e0}, {0x0, 0x0, 0x400}], 0x0, &(0x7f0000010d00)) statfs(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)=""/159) 11:59:18 executing program 4: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) tee(r0, r1, 0x208, 0x0) 11:59:18 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0) r2 = dup2(r0, r1) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff3000/0xd000)=nil, 0xd000, 0x0, 0x11, r2, 0x0) [ 128.850605] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#1] SMP KASAN NOPTI [ 128.851593] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] [ 128.852232] CPU: 1 UID: 0 PID: 3946 Comm: syz-executor.2 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 128.854053] Tainted: [W]=WARN [ 128.854945] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 128.856796] RIP: 0010:perf_tp_event+0x175/0xe70 [ 128.857893] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 128.862139] RSP: 0018:ffff888046337800 EFLAGS: 00010212 [ 128.862575] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90009636000 [ 128.863152] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 128.863715] RBP: ffff888046337a70 R08: ffff88806cf31340 R09: ffffe8ffffd061b0 [ 128.864285] R10: 0000000000000000 R11: 0000000000000024 R12: dffffc0000000000 [ 128.864845] R13: 0000000000000024 R14: ffff88806cf31340 R15: dffffc0000000000 [ 128.865405] FS: 00007f51cbf0e700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000 [ 128.866040] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 128.866502] CR2: 00007fa4a4d34fe8 CR3: 000000001e4b4000 CR4: 0000000000350ef0 [ 128.867067] Call Trace: [ 128.867280] [ 128.867469] ? __pfx_perf_tp_event+0x10/0x10 [ 128.867841] ? lock_is_held_type+0x9e/0x120 [ 128.868198] ? lock_is_held_type+0x9e/0x120 [ 128.868551] ? ctx_sched_in+0x134/0x9b0 [ 128.868873] ? __pfx_ctx_sched_in+0x10/0x10 [ 128.869214] ? arch_stack_walk+0x9c/0xf0 [ 128.869542] ? find_held_lock+0x2b/0x80 [ 128.869872] ? find_held_lock+0x2b/0x80 [ 128.870197] ? __perf_install_in_context+0x503/0xb90 [ 128.870602] ? lock_release+0xc8/0x290 [ 128.870916] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 128.871381] ? do_raw_spin_unlock+0x53/0x220 [ 128.871740] ? perf_trace_run_bpf_submit+0xef/0x180 [ 128.872156] perf_trace_run_bpf_submit+0xef/0x180 [ 128.872553] perf_trace_lock_acquire+0x3c2/0x700 [ 128.872942] ? __pfx_perf_trace_lock_acquire+0x10/0x10 [ 128.873363] ? futex_ref_get+0x48/0x300 [ 128.873685] ? find_held_lock+0x2b/0x80 [ 128.874017] lock_acquire+0xc5/0x2f0 [ 128.874321] ? futex_wake+0x228/0x540 [ 128.874639] _raw_spin_lock+0x2b/0x40 [ 128.874954] ? futex_wake+0x228/0x540 [ 128.875272] futex_wake+0x228/0x540 [ 128.875577] ? __pfx_futex_wake+0x10/0x10 [ 128.875926] ? __do_sys_perf_event_open+0x44d/0x2c20 [ 128.876332] ? lock_release+0xc8/0x290 [ 128.876653] do_futex+0x26d/0x370 [ 128.876940] ? __pfx_do_futex+0x10/0x10 [ 128.877261] ? __pfx___do_sys_perf_event_open+0x10/0x10 [ 128.877695] __x64_sys_futex+0x1c9/0x4d0 [ 128.878024] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 128.878485] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 128.878953] ? __pfx___x64_sys_futex+0x10/0x10 [ 128.879320] ? xfd_validate_state+0x55/0x180 [ 128.879691] do_syscall_64+0xbf/0x360 [ 128.880011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.880423] RIP: 0033:0x7f51ce998b19 [ 128.880725] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 128.882155] RSP: 002b:00007f51cbf0e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 128.882773] RAX: ffffffffffffffda RBX: 00007f51ceaabf68 RCX: 00007f51ce998b19 [ 128.883364] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f51ceaabf6c [ 128.883954] RBP: 00007f51ceaabf60 R08: 000000000000000e R09: 0000000000000000 [ 128.884538] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f51ceaabf6c [ 128.885116] R13: 00007ffd3b4c395f R14: 00007f51cbf0e300 R15: 0000000000022000 [ 128.885701] [ 128.885898] Modules linked in: [ 128.886176] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#2] SMP KASAN NOPTI [ 128.887123] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] [ 128.887741] CPU: 0 UID: 0 PID: 3943 Comm: syz-executor.0 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 128.888726] Tainted: [D]=DIE, [W]=WARN [ 128.889043] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 128.889716] RIP: 0010:perf_tp_event+0x175/0xe70 [ 128.890116] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 128.891587] RSP: 0018:ffff8880476a7780 EFLAGS: 00010012 [ 128.892037] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002 [ 128.892615] RDX: ffff888012e81b80 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 128.893199] RBP: ffff8880476a79f0 R08: ffff88806ce31340 R09: ffffe8ffffc16938 [ 128.893776] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 [ 128.894353] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 [ 128.894930] FS: 000055555faad400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000 [ 128.895581] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 128.896072] CR2: 00007f8e8ebdc018 CR3: 0000000046a0b000 CR4: 0000000000350ef0 [ 128.896660] Call Trace: [ 128.896874] [ 128.897065] ? __pfx_perf_tp_event+0x10/0x10 [ 128.897435] ? arch_scale_cpu_capacity+0x17/0xa0 [ 128.897835] ? cpu_util.constprop.0+0x17d/0x340 [ 128.898225] ? __asan_memset+0x24/0x50 [ 128.898551] ? sched_balance_find_dst_group+0xa9a/0x1c00 [ 128.898993] ? lock_release+0xc8/0x290 [ 128.899327] ? __pfx_sched_balance_find_dst_group+0x10/0x10 [ 128.899803] ? __lock_acquire+0x694/0x1b70 [ 128.900157] ? perf_trace_run_bpf_submit+0xef/0x180 [ 128.900570] ? sched_clock+0x37/0x60 [ 128.900887] ? sched_clock_cpu+0x6c/0x4e0 [ 128.901231] ? lock_is_held_type+0x9e/0x120 [ 128.901591] perf_trace_run_bpf_submit+0xef/0x180 [ 128.901991] perf_trace_preemptirq_template+0x259/0x430 [ 128.902427] ? lock_is_held_type+0x9e/0x120 [ 128.902785] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 128.903268] ? perf_trace_lock_acquire+0xc9/0x700 [ 128.903671] ? _raw_spin_lock_irqsave+0x53/0x60 [ 128.904083] trace_irq_disable.constprop.0+0xa6/0x100 [ 128.904507] _raw_spin_lock_irqsave+0x53/0x60 [ 128.904882] try_to_wake_up+0xa0/0x11d0 [ 128.905213] ? lock_acquire+0x18c/0x2f0 [ 128.905543] ? __pfx_try_to_wake_up+0x10/0x10 [ 128.905922] ? plist_del+0x122/0x270 [ 128.906235] ? __futex_unqueue+0xda/0x1c0 [ 128.906581] wake_up_q+0xa1/0x130 [ 128.906872] futex_wake+0x47e/0x540 [ 128.907185] ? __pfx_futex_wake+0x10/0x10 [ 128.907529] ? xfd_validate_state+0x55/0x180 [ 128.907918] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 128.908350] ? finish_task_switch.isra.0+0x206/0x840 [ 128.908778] do_futex+0x26d/0x370 [ 128.909072] ? __pfx_do_futex+0x10/0x10 [ 128.909406] ? __pfx___schedule+0x10/0x10 [ 128.909756] __x64_sys_futex+0x1c9/0x4d0 [ 128.910095] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 128.910573] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 128.911060] ? __pfx___x64_sys_futex+0x10/0x10 [ 128.911440] ? xfd_validate_state+0x55/0x180 [ 128.911841] do_syscall_64+0xbf/0x360 [ 128.912160] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.912582] RIP: 0033:0x7fb4ada1db19 [ 128.912889] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 128.914361] RSP: 002b:00007ffd14a9a188 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 128.914976] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb4ada1db19 [ 128.915557] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fb4adb30f68 [ 128.916155] RBP: 00007fb4adb30f60 R08: 00007fb4aaf93700 R09: 0000000000000000 [ 128.916729] R10: 00007fb4aaf93700 R11: 0000000000000246 R12: 00007fb4adb35060 [ 128.917310] R13: 00007ffd14a9a290 R14: 00007fb4adb30f60 R15: 000000000001f681 [ 128.917904] [ 128.918101] Modules linked in: [ 128.918376] ---[ end trace 0000000000000000 ]--- [ 128.918377] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#3] SMP KASAN NOPTI [ 128.918760] RIP: 0010:perf_tp_event+0x175/0xe70 [ 128.919651] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] [ 128.920051] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 128.920670] CPU: 1 UID: 0 PID: 3946 Comm: syz-executor.2 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 128.922136] RSP: 0018:ffff888046337800 EFLAGS: 00010212 [ 128.923082] Tainted: [D]=DIE, [W]=WARN [ 128.923509] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90009636000 [ 128.923827] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 128.924409] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 128.925078] RIP: 0010:perf_tp_event+0x175/0xe70 [ 128.925662] RBP: ffff888046337a70 R08: ffff88806cf31340 R09: ffffe8ffffd061b0 [ 128.926053] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 128.926632] R10: 0000000000000000 R11: 0000000000000024 R12: dffffc0000000000 [ 128.928105] RSP: 0018:ffff88806cf08a80 EFLAGS: 00010012 [ 128.928684] R13: 0000000000000024 R14: ffff88806cf31340 R15: dffffc0000000000 [ 128.928696] FS: 000055555faad400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000 [ 128.929126] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002 [ 128.929707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 128.930348] RDX: ffff88800f429b80 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 128.930920] CR2: 00007f8e8ebdc018 CR3: 0000000046a0b000 CR4: 0000000000350ef0 [ 128.931385] RBP: ffff88806cf08cf0 R08: ffff88806cf31490 R09: ffffe8ffffd061b0 [ 128.931977] note: syz-executor.0[3943] exited with irqs disabled [ 128.932560] R10: 0000000000000000 R11: 000000000000002c R12: dffffc0000000000 [ 128.934200] R13: 000000000000002c R14: ffff88806cf31490 R15: dffffc0000000000 [ 128.934791] FS: 00007f51cbf0e700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000 [ 128.935454] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 128.935934] CR2: 00007fa4a4d34fe8 CR3: 000000001e4b4000 CR4: 0000000000350ef0 [ 128.936528] Call Trace: [ 128.936741] [ 128.936936] ? __pfx_perf_tp_event+0x10/0x10 [ 128.937307] ? trace_pelt_se_tp+0xdf/0x130 [ 128.937658] ? __update_load_avg_se+0x428/0xa40 [ 128.938049] ? lock_is_held_type+0x9e/0x120 [ 128.938411] ? __pick_eevdf+0x326/0x570 [ 128.938737] ? update_curr+0x1b9/0x500 [ 128.939061] ? perf_trace_lock_acquire+0xc9/0x700 [ 128.939471] ? perf_trace_run_bpf_submit+0xef/0x180 [ 128.939890] ? perf_trace_lock_acquire+0xc9/0x700 [ 128.940295] perf_trace_run_bpf_submit+0xef/0x180 [ 128.940705] perf_trace_lock_acquire+0x3c2/0x700 [ 128.941109] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 128.941505] ? __pfx_perf_trace_lock_acquire+0x10/0x10 [ 128.941940] ? lock_acquire+0x15e/0x2f0 [ 128.942272] ? find_held_lock+0x2b/0x80 [ 128.942603] ? clockevents_program_event+0x14f/0x360 [ 128.943025] ? lock_release+0xc8/0x290 [ 128.943358] lock_acquire+0xc5/0x2f0 [ 128.943677] ? hrtimer_interrupt+0xd6/0x830 [ 128.944034] ? __pfx_lapic_next_deadline+0x10/0x10 [ 128.944452] _raw_spin_lock_irqsave+0x3a/0x60 [ 128.944831] ? hrtimer_interrupt+0xd6/0x830 [ 128.945186] hrtimer_interrupt+0xd6/0x830 [ 128.945543] __sysvec_apic_timer_interrupt+0xbb/0x330 [ 128.945971] sysvec_apic_timer_interrupt+0x6b/0x80 [ 128.946382] [ 128.946570] [ 128.946761] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 128.947194] RIP: 0010:oops_exit+0x0/0x50 [ 128.947529] Code: 00 3a 00 be ff ff ff ff 48 c7 c7 50 b4 43 86 e8 c6 0f f9 ff 5b e9 50 00 3a 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 53 e8 36 00 3a 00 8b 1d c0 3d 4f 06 31 ff 89 de e8 57 [ 128.949020] RSP: 0018:ffff888046337690 EFLAGS: 00000202 [ 128.949464] RAX: 000000000002b122 RBX: 0000000000000216 RCX: ffffc90009636000 [ 128.950041] RDX: 0000000000040000 RSI: ffffffff812a3dca RDI: 0000000000000007 [ 128.950622] RBP: 000000000000000b R08: 0000000000000001 R09: fffffbfff0f12690 [ 128.951207] R10: 0000000000000000 R11: 000000000000002c R12: ffff888046337758 [ 128.951797] R13: 0000000000000000 R14: dffffc0000000032 R15: 0000000000000000 [ 128.952383] ? oops_end+0x4a/0xe0 [ 128.952687] oops_end+0x65/0xe0 [ 128.952982] exc_general_protection+0x1a2/0x330 [ 128.953381] asm_exc_general_protection+0x26/0x30 [ 128.953779] RIP: 0010:perf_tp_event+0x175/0xe70 [ 128.954165] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 128.955657] RSP: 0018:ffff888046337800 EFLAGS: 00010212 [ 128.956110] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90009636000 [ 128.956760] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 128.957350] RBP: ffff888046337a70 R08: ffff88806cf31340 R09: ffffe8ffffd061b0 [ 128.957940] R10: 0000000000000000 R11: 0000000000000024 R12: dffffc0000000000 [ 128.958534] R13: 0000000000000024 R14: ffff88806cf31340 R15: dffffc0000000000 [ 128.959129] ? perf_tp_event+0x167/0xe70 [ 128.959477] ? __pfx_perf_tp_event+0x10/0x10 [ 128.959859] ? lock_is_held_type+0x9e/0x120 [ 128.960226] ? lock_is_held_type+0x9e/0x120 [ 128.960597] ? ctx_sched_in+0x134/0x9b0 [ 128.960931] ? __pfx_ctx_sched_in+0x10/0x10 [ 128.961292] ? arch_stack_walk+0x9c/0xf0 [ 128.961639] ? find_held_lock+0x2b/0x80 [ 128.961982] ? find_held_lock+0x2b/0x80 [ 128.962324] ? __perf_install_in_context+0x503/0xb90 [ 128.962742] ? lock_release+0xc8/0x290 [ 128.963067] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 128.963549] ? do_raw_spin_unlock+0x53/0x220 [ 128.963935] ? perf_trace_run_bpf_submit+0xef/0x180 [ 128.964352] perf_trace_run_bpf_submit+0xef/0x180 [ 128.964753] perf_trace_lock_acquire+0x3c2/0x700 [ 128.965163] ? __pfx_perf_trace_lock_acquire+0x10/0x10 [ 128.965604] ? futex_ref_get+0x48/0x300 [ 128.965934] ? find_held_lock+0x2b/0x80 [ 128.966270] lock_acquire+0xc5/0x2f0 [ 128.966586] ? futex_wake+0x228/0x540 [ 128.966912] _raw_spin_lock+0x2b/0x40 [ 128.967232] ? futex_wake+0x228/0x540 [ 128.967561] futex_wake+0x228/0x540 [ 128.967885] ? __pfx_futex_wake+0x10/0x10 [ 128.968240] ? __do_sys_perf_event_open+0x44d/0x2c20 [ 128.968668] ? lock_release+0xc8/0x290 [ 128.969000] do_futex+0x26d/0x370 [ 128.969297] ? __pfx_do_futex+0x10/0x10 [ 128.969634] ? __pfx___do_sys_perf_event_open+0x10/0x10 [ 128.970085] __x64_sys_futex+0x1c9/0x4d0 [ 128.970427] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 128.970922] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 128.971414] ? __pfx___x64_sys_futex+0x10/0x10 [ 128.971806] ? xfd_validate_state+0x55/0x180 [ 128.972186] do_syscall_64+0xbf/0x360 [ 128.972510] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.972944] RIP: 0033:0x7f51ce998b19 [ 128.973256] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 128.974751] RSP: 002b:00007f51cbf0e218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 128.975385] RAX: ffffffffffffffda RBX: 00007f51ceaabf68 RCX: 00007f51ce998b19 [ 128.975980] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f51ceaabf6c [ 128.976569] RBP: 00007f51ceaabf60 R08: 000000000000000e R09: 0000000000000000 [ 128.977155] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f51ceaabf6c [ 128.977747] R13: 00007ffd3b4c395f R14: 00007f51cbf0e300 R15: 0000000000022000 [ 128.978339] [ 128.978542] Modules linked in: [ 128.978816] ---[ end trace 0000000000000000 ]--- [ 128.978818] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#4] SMP KASAN NOPTI [ 128.979212] RIP: 0010:perf_tp_event+0x175/0xe70 [ 128.980145] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] [ 128.980526] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 128.981138] CPU: 0 UID: 0 PID: 3943 Comm: syz-executor.0 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) [ 128.982608] RSP: 0018:ffff888046337800 EFLAGS: 00010212 [ 128.983573] Tainted: [D]=DIE, [W]=WARN [ 128.984010] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90009636000 [ 128.984329] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 128.984914] RDX: 0000000000040000 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 128.985598] RIP: 0010:perf_tp_event+0x175/0xe70 [ 128.986177] RBP: ffff888046337a70 R08: ffff88806cf31340 R09: ffffe8ffffd061b0 [ 128.986554] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 128.987138] R10: 0000000000000000 R11: 0000000000000024 R12: dffffc0000000000 [ 128.988655] RSP: 0018:ffff88806ce08b40 EFLAGS: 00010012 [ 128.989237] R13: 0000000000000024 R14: ffff88806cf31340 R15: dffffc0000000000 [ 128.989248] FS: 00007f51cbf0e700(0000) GS:ffff8880e56d8000(0000) knlGS:0000000000000000 [ 128.989670] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002 [ 128.990252] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 128.990913] RDX: ffff888012e81b80 RSI: ffffffff8189a4e7 RDI: 0000000000000191 [ 128.991497] CR2: 00007fa4a4d34fe8 CR3: 000000001e4b4000 CR4: 0000000000350ef0 [ 128.991989] RBP: ffff88806ce08db0 R08: ffff88806ce313e8 R09: ffffe8ffffc16938 [ 128.992575] Kernel panic - not syncing: Fatal exception in interrupt [ 130.036432] Shutting down cpus with NMI [ 130.038070] Kernel Offset: disabled [ 130.038370] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- VM DIAGNOSIS: 11:59:18 Registers: info registers vcpu 0 RAX=0000000000000001 RBX=0000000000000001 RCX=ffffffff84be3c0e RDX=fffffbfff0f0f609 RSI=0000000000000004 RDI=ffffffff8787b044 RBP=ffffffff8787b044 RSP=ffff8880476a7530 R8 =0000000000000000 R9 =fffffbfff0f0f608 R10=ffffffff8787b047 R11=202c746c75616620 R12=1ffff11008ed4ea7 R13=0000000000000007 R14=fffffbfff0f0f608 R15=ffff8880476a7568 RIP=ffffffff84be3da0 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 000055555faad400 00000000 00000000 GS =0000 ffff8880e55d8000 00000000 00000000 LDT=0000 fffffe3a00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f8e8ebdc018 CR3=0000000046a0b000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007fb4adb047c000007fb4adb047c8 XMM02=00007fb4adb047e000007fb4adb047c0 XMM03=00007fb4adb047c800007fb4adb047c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000030 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff828e5105 RDI=ffffffff88729280 RBP=ffffffff88729240 RSP=ffff8880463370f0 R8 =0000000000000000 R9 =ffffed10014f7046 R10=0000000000000030 R11=000000000000002c R12=0000000000000030 R13=0000000000000010 R14=ffffffff88729240 R15=ffffffff828e50f0 RIP=ffffffff828e515d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f51cbf0e700 00000000 00000000 GS =0000 ffff8880e56d8000 00000000 00000000 LDT=0000 fffffe3300000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fa4a4d34fe8 CR3=000000001e4b4000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f51cea7f7c000007f51cea7f7c8 XMM02=00007f51cea7f7e000007f51cea7f7c0 XMM03=00007f51cea7f7c800007f51cea7f7c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000