Warning: Permanently added '[localhost]:22141' (ECDSA) to the list of known hosts. 2025/08/29 08:16:35 fuzzer started 2025/08/29 08:16:36 dialing manager at localhost:43077 syzkaller login: [ 43.913028] cgroup: Unknown subsys name 'net' [ 43.973435] cgroup: Unknown subsys name 'cpuset' [ 43.992178] cgroup: Unknown subsys name 'rlimit' 2025/08/29 08:16:46 syscalls: 2214 2025/08/29 08:16:46 code coverage: enabled 2025/08/29 08:16:46 comparison tracing: enabled 2025/08/29 08:16:46 extra coverage: enabled 2025/08/29 08:16:46 setuid sandbox: enabled 2025/08/29 08:16:46 namespace sandbox: enabled 2025/08/29 08:16:46 Android sandbox: enabled 2025/08/29 08:16:46 fault injection: enabled 2025/08/29 08:16:46 leak checking: enabled 2025/08/29 08:16:46 net packet injection: enabled 2025/08/29 08:16:46 net device setup: enabled 2025/08/29 08:16:46 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/08/29 08:16:46 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/08/29 08:16:46 USB emulation: enabled 2025/08/29 08:16:46 hci packet injection: enabled 2025/08/29 08:16:46 wifi device emulation: enabled 2025/08/29 08:16:46 802.15.4 emulation: enabled 2025/08/29 08:16:46 fetching corpus: 0, signal 0/2000 (executing program) 2025/08/29 08:16:46 fetching corpus: 50, signal 20211/23297 (executing program) 2025/08/29 08:16:47 fetching corpus: 100, signal 35727/39261 (executing program) 2025/08/29 08:16:47 fetching corpus: 150, signal 41680/45883 (executing program) 2025/08/29 08:16:47 fetching corpus: 200, signal 47893/52494 (executing program) 2025/08/29 08:16:47 fetching corpus: 250, signal 52180/57126 (executing program) 2025/08/29 08:16:47 fetching corpus: 300, signal 56632/61700 (executing program) 2025/08/29 08:16:47 fetching corpus: 350, signal 61830/66649 (executing program) 2025/08/29 08:16:48 fetching corpus: 400, signal 67070/71411 (executing program) 2025/08/29 08:16:48 fetching corpus: 450, signal 69712/73939 (executing program) 2025/08/29 08:16:48 fetching corpus: 500, signal 71873/75973 (executing program) 2025/08/29 08:16:48 fetching corpus: 550, signal 75678/79041 (executing program) 2025/08/29 08:16:48 fetching corpus: 600, signal 77543/80588 (executing program) 2025/08/29 08:16:48 fetching corpus: 650, signal 79534/82226 (executing program) 2025/08/29 08:16:48 fetching corpus: 700, signal 82203/84208 (executing program) 2025/08/29 08:16:48 fetching corpus: 713, signal 84082/85505 (executing program) 2025/08/29 08:16:48 fetching corpus: 714, signal 84113/85637 (executing program) 2025/08/29 08:16:48 fetching corpus: 714, signal 84113/85727 (executing program) 2025/08/29 08:16:48 fetching corpus: 714, signal 84113/85823 (executing program) 2025/08/29 08:16:48 fetching corpus: 714, signal 84113/85924 (executing program) 2025/08/29 08:16:48 fetching corpus: 714, signal 84113/86013 (executing program) 2025/08/29 08:16:48 fetching corpus: 714, signal 84113/86091 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/86174 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/86262 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/86353 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/86441 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/86524 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/86607 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/86684 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/86791 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/86871 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/86953 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/87038 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/87108 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/87195 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/87274 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/87358 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/87450 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/87535 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/87618 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/87706 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/87787 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/87848 (executing program) 2025/08/29 08:16:49 fetching corpus: 714, signal 84113/87848 (executing program) 2025/08/29 08:16:51 starting 8 fuzzer processes 08:16:51 executing program 0: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x0, 0x0) lseek(r0, 0x0, 0x0) 08:16:51 executing program 3: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000140), &(0x7f0000000180)=0x4) 08:16:51 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40345410, &(0x7f0000000040)={{0x1}}) r1 = dup(r0) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f0000000100)=""/192) 08:16:51 executing program 6: madvise(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x11) 08:16:51 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x1, &(0x7f0000000040)=0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) io_submit(r0, 0x1, &(0x7f0000000300)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) io_cancel(r0, 0x0, 0x0) 08:16:51 executing program 7: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) 08:16:51 executing program 4: r0 = creat(&(0x7f0000000000)='./file1\x00', 0x0) r1 = socket$netlink(0x10, 0x3, 0x2) write$binfmt_script(r1, &(0x7f0000000040)={'#! ', './file1'}, 0xb) close_range(r0, 0xffffffffffffffff, 0x0) [ 58.673746] audit: type=1400 audit(1756455411.367:7): avc: denied { execmem } for pid=273 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 08:16:51 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') r1 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r1, 0x0) lseek(r0, 0xd20e, 0x0) [ 59.878798] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 59.881078] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 59.883202] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 59.888508] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 59.890968] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 59.940506] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 59.948838] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 59.959111] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 59.960468] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 59.962152] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 59.966121] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 59.969247] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 59.971717] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 59.975077] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 59.977506] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 59.979734] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 59.981163] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 59.983484] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 59.991665] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 60.014015] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 60.016781] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 60.035684] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 60.052390] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 60.058788] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 60.060066] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 60.061429] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 60.064004] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 60.066957] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 60.072867] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 60.075256] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 60.077128] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 60.080208] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 60.081913] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 60.083961] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 60.089750] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 60.092216] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 60.100222] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 60.101694] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 60.112295] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 60.115276] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 61.973108] Bluetooth: hci0: command tx timeout [ 62.036683] Bluetooth: hci1: command tx timeout [ 62.039656] Bluetooth: hci2: command tx timeout [ 62.101587] Bluetooth: hci3: command tx timeout [ 62.166553] Bluetooth: hci5: command tx timeout [ 62.167125] Bluetooth: hci7: command tx timeout [ 62.167621] Bluetooth: hci6: command tx timeout [ 62.167663] Bluetooth: hci4: command tx timeout [ 64.021688] Bluetooth: hci0: command tx timeout [ 64.084614] Bluetooth: hci2: command tx timeout [ 64.085074] Bluetooth: hci1: command tx timeout [ 64.148650] Bluetooth: hci3: command tx timeout [ 64.212758] Bluetooth: hci6: command tx timeout [ 64.213156] Bluetooth: hci7: command tx timeout [ 64.213183] Bluetooth: hci4: command tx timeout [ 64.213703] Bluetooth: hci5: command tx timeout [ 66.069217] Bluetooth: hci0: command tx timeout [ 66.133555] Bluetooth: hci2: command tx timeout [ 66.133977] Bluetooth: hci1: command tx timeout [ 66.196682] Bluetooth: hci3: command tx timeout [ 66.261185] Bluetooth: hci6: command tx timeout [ 66.262364] Bluetooth: hci5: command tx timeout [ 66.262773] Bluetooth: hci4: command tx timeout [ 66.262848] Bluetooth: hci7: command tx timeout [ 68.118631] Bluetooth: hci0: command tx timeout [ 68.180644] Bluetooth: hci1: command tx timeout [ 68.180915] Bluetooth: hci2: command tx timeout [ 68.245355] Bluetooth: hci3: command tx timeout [ 68.308646] Bluetooth: hci5: command tx timeout [ 68.308715] Bluetooth: hci4: command tx timeout [ 68.309102] Bluetooth: hci6: command tx timeout [ 68.309854] Bluetooth: hci7: command tx timeout [ 96.817634] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.818298] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.063449] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.064591] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.742789] audit: type=1400 audit(1756455450.435:8): avc: denied { open } for pid=3702 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 97.756696] audit: type=1400 audit(1756455450.435:9): avc: denied { kernel } for pid=3702 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 97.815676] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.816298] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.940038] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.940675] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.927928] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.928572] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.009542] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.010123] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.142059] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.142659] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.251919] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.252565] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.520763] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.521371] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.595366] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.596188] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.830998] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.831634] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.888190] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.888824] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.953679] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.954262] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.984742] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.985303] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.110161] audit: type=1400 audit(1756455452.805:10): avc: denied { read } for pid=3889 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 100.186281] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.187154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.209906] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.210462] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:17:33 executing program 3: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000140), &(0x7f0000000180)=0x4) 08:17:33 executing program 0: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x0, 0x0) lseek(r0, 0x0, 0x0) 08:17:33 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x1, &(0x7f0000000040)=0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) io_submit(r0, 0x1, &(0x7f0000000300)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) io_cancel(r0, 0x0, 0x0) 08:17:33 executing program 6: madvise(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x11) 08:17:33 executing program 4: r0 = creat(&(0x7f0000000000)='./file1\x00', 0x0) r1 = socket$netlink(0x10, 0x3, 0x2) write$binfmt_script(r1, &(0x7f0000000040)={'#! ', './file1'}, 0xb) close_range(r0, 0xffffffffffffffff, 0x0) 08:17:33 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40345410, &(0x7f0000000040)={{0x1}}) r1 = dup(r0) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f0000000100)=""/192) 08:17:33 executing program 7: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) 08:17:33 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') r1 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r1, 0x0) lseek(r0, 0xd20e, 0x0) 08:17:33 executing program 0: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x0, 0x0) lseek(r0, 0x0, 0x0) 08:17:33 executing program 6: madvise(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x11) 08:17:33 executing program 4: r0 = creat(&(0x7f0000000000)='./file1\x00', 0x0) r1 = socket$netlink(0x10, 0x3, 0x2) write$binfmt_script(r1, &(0x7f0000000040)={'#! ', './file1'}, 0xb) close_range(r0, 0xffffffffffffffff, 0x0) 08:17:33 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40345410, &(0x7f0000000040)={{0x1}}) r1 = dup(r0) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f0000000100)=""/192) 08:17:33 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x1, &(0x7f0000000040)=0x0) r1 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) io_submit(r0, 0x1, &(0x7f0000000300)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) io_cancel(r0, 0x0, 0x0) 08:17:33 executing program 7: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) 08:17:33 executing program 6: madvise(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x11) 08:17:33 executing program 3: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000140), &(0x7f0000000180)=0x4) [ 100.555276] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#1] SMP KASAN NOPTI [ 100.556334] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197] [ 100.557026] CPU: 1 UID: 0 PID: 3925 Comm: syz-executor.7 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 100.558625] Tainted: [W]=WARN [ 100.559497] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 100.561328] RIP: 0010:perf_tp_event+0x175/0xe70 [ 100.562400] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 100.567265] RSP: 0018:ffff8880427af800 EFLAGS: 00010212 [ 100.567705] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002 [ 100.568270] RDX: ffff88801b40d280 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 100.568840] RBP: ffff8880427afa70 R08: ffff88806cf31340 R09: ffffe8ffffd15b38 [ 100.569402] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 100.569965] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000 [ 100.570533] FS: 000055557de64400(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000 [ 100.571170] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 100.571632] CR2: 000055557de65c18 CR3: 0000000041270000 CR4: 0000000000350ef0 [ 100.572196] Call Trace: [ 100.572407] [ 100.572603] ? arch_scale_cpu_capacity+0x17/0xa0 [ 100.572994] ? __pfx_perf_tp_event+0x10/0x10 [ 100.573353] ? __asan_memset+0x24/0x50 [ 100.573681] ? perf_trace_lock+0xb5/0x5d0 [ 100.574021] ? kvm_sched_clock_read+0x16/0x30 [ 100.574392] ? sched_clock+0x37/0x60 [ 100.574704] ? sched_clock_cpu+0x6c/0x4e0 [ 100.575044] ? lock_is_held_type+0x9e/0x120 [ 100.575396] ? perf_trace_run_bpf_submit+0xef/0x180 [ 100.575805] perf_trace_run_bpf_submit+0xef/0x180 [ 100.576200] perf_trace_lock+0x337/0x5d0 [ 100.576533] ? __pfx_perf_trace_lock+0x10/0x10 [ 100.576909] ? lock_acquire+0x15e/0x2f0 [ 100.577234] ? futex_ref_get+0x48/0x300 [ 100.577555] ? futex_ref_get+0x114/0x300 [ 100.577880] ? futex_hash+0x15c/0x390 [ 100.578186] lock_release+0x1ab/0x290 [ 100.578498] ? futex_hash+0x15c/0x390 [ 100.578805] futex_ref_get+0x119/0x300 [ 100.579121] ? futex_hash+0x15c/0x390 [ 100.579432] futex_hash+0x70/0x390 [ 100.579722] futex_wake+0x143/0x540 [ 100.580021] ? put_pid+0x1f/0x30 [ 100.580298] ? kernel_clone+0x204/0x7f0 [ 100.580630] ? __pfx_futex_wake+0x10/0x10 [ 100.580968] ? __pfx_kernel_clone+0x10/0x10 [ 100.581318] ? perf_trace_lock+0xb5/0x5d0 [ 100.581653] do_futex+0x26d/0x370 [ 100.581938] ? __pfx_do_futex+0x10/0x10 [ 100.582262] ? __pfx___do_sys_clone+0x10/0x10 [ 100.582623] ? find_held_lock+0x2b/0x80 [ 100.582959] __x64_sys_futex+0x1c9/0x4d0 [ 100.583288] ? __pfx___x64_sys_futex+0x10/0x10 [ 100.583658] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 100.584081] do_syscall_64+0xbf/0x360 [ 100.584390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.584807] RIP: 0033:0x7f1c239e7b19 [ 100.585105] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 100.586528] RSP: 002b:00007fff50798088 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 100.587128] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1c239e7b19 [ 100.587687] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1c23afaf68 [ 100.588248] RBP: 00007f1c23afaf60 R08: 00007f1c20f5d700 R09: 0000000000000000 [ 100.588813] R10: 00007f1c20f5d700 R11: 0000000000000246 R12: 00007f1c23affa68 [ 100.589374] R13: 00007fff50798190 R14: 00007f1c23afaf60 R15: 0000000000018865 [ 100.589942] [ 100.590134] Modules linked in: [ 100.590400] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#2] SMP KASAN NOPTI [ 100.592182] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] [ 100.593372] CPU: 0 UID: 0 PID: 3931 Comm: syz-executor.3 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 100.595197] Tainted: [D]=DIE, [W]=WARN [ 100.595804] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 100.597072] RIP: 0010:perf_tp_event+0x175/0xe70 [ 100.597831] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 100.600641] RSP: 0018:ffff88804285f600 EFLAGS: 00010212 [ 100.601466] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc900029fe000 [ 100.602550] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000000000191 [ 100.603641] RBP: ffff88804285f870 R08: ffff88806ce31340 R09: ffffe8ffffc15b38 [ 100.604736] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 [ 100.605825] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000 [ 100.606918] FS: 00007f02b8144700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 100.608144] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 100.609045] CR2: 000055558b880c18 CR3: 0000000040ce3000 CR4: 0000000000350ef0 [ 100.610136] Call Trace: [ 100.610541] [ 100.610908] ? __pfx_perf_tp_event+0x10/0x10 [ 100.611649] ? perf_trace_run_bpf_submit+0xef/0x180 [ 100.612429] perf_trace_run_bpf_submit+0xef/0x180 [ 100.613205] perf_trace_lock+0x337/0x5d0 [ 100.613848] ? __pfx_perf_trace_lock+0x10/0x10 [ 100.614572] ? get_futex_key+0x592/0x14a0 [ 100.615217] ? futex_ref_get+0x114/0x300 [ 100.615844] ? futex_hash+0x15c/0x390 [ 100.616439] lock_release+0x1ab/0x290 [ 100.617071] ? futex_hash+0x15c/0x390 [ 100.617670] futex_ref_get+0x119/0x300 [ 100.618285] ? futex_hash+0x15c/0x390 [ 100.618877] futex_hash+0x70/0x390 [ 100.619440] futex_wait_setup+0xae/0x550 [ 100.620085] __futex_wait+0x151/0x300 [ 100.620696] ? __pfx___futex_wait+0x10/0x10 [ 100.621377] ? __pfx_futex_wake_mark+0x10/0x10 [ 100.622111] futex_wait+0xde/0x380 [ 100.622677] ? __pfx_futex_wait+0x10/0x10 [ 100.623325] ? perf_trace_lock+0xb5/0x5d0 [ 100.623975] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 100.624788] ? do_vfs_ioctl+0x125/0x1470 [ 100.625435] do_futex+0x2ee/0x370 [ 100.625990] ? __pfx_do_futex+0x10/0x10 [ 100.626607] ? build_sched_domains+0x2744/0x53d0 [ 100.627344] ? do_raw_spin_lock+0x123/0x260 [ 100.628023] __x64_sys_futex+0x1c9/0x4d0 [ 100.628669] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 100.629469] ? __pfx___x64_sys_futex+0x10/0x10 [ 100.630180] ? kcov_ioctl+0x386/0x6c0 [ 100.630776] ? fput+0x6a/0x100 [ 100.631299] do_syscall_64+0xbf/0x360 [ 100.631900] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.632698] RIP: 0033:0x7f02babceb19 [ 100.633273] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 100.636047] RSP: 002b:00007f02b8144218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 100.637221] RAX: ffffffffffffffda RBX: 00007f02bace1f68 RCX: 00007f02babceb19 [ 100.638308] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f02bace1f68 [ 100.639395] RBP: 00007f02bace1f60 R08: 00007f02b8144700 R09: 0000000000000000 [ 100.640477] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f02bace1f6c [ 100.641582] R13: 00007fff5ee30eef R14: 00007f02b8144300 R15: 0000000000022000 [ 100.642684] [ 100.643054] Modules linked in: [ 100.643565] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#3] SMP KASAN NOPTI [ 100.644427] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197] [ 100.645102] CPU: 1 UID: 0 PID: 3925 Comm: syz-executor.7 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 100.646023] Tainted: [D]=DIE, [W]=WARN [ 100.646324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 100.646960] RIP: 0010:perf_tp_event+0x175/0xe70 [ 100.647333] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 100.648744] RSP: 0018:ffff88806cf08a80 EFLAGS: 00010012 [ 100.649160] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002 [ 100.649715] RDX: ffff88801b40d280 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 100.650269] RBP: ffff88806cf08cf0 R08: ffff88806cf31490 R09: ffffe8ffffd15b38 [ 100.650825] R10: 0000000000000000 R11: ffff88806cf37018 R12: dffffc0000000000 [ 100.651377] R13: 0000000000000024 R14: ffff88806cf31490 R15: dffffc0000000000 [ 100.651931] FS: 000055557de64400(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000 [ 100.652554] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 100.653018] CR2: 000055557de65c18 CR3: 0000000041270000 CR4: 0000000000350ef0 [ 100.653572] Call Trace: [ 100.653777] [ 100.653958] ? __pfx_perf_tp_event+0x10/0x10 [ 100.654316] ? sched_clock_cpu+0x6c/0x4e0 [ 100.654649] ? trace_pelt_se_tp+0xdf/0x130 [ 100.654983] ? __update_load_avg_se+0x428/0xa40 [ 100.655358] ? match_held_lock+0xb0/0xd0 [ 100.655687] ? perf_trace_lock+0xb5/0x5d0 [ 100.656016] ? perf_trace_lock+0xb5/0x5d0 [ 100.656345] ? place_entity+0x1c/0x410 [ 100.656663] ? kvm_sched_clock_read+0x16/0x30 [ 100.657023] ? __pfx_perf_trace_lock+0x10/0x10 [ 100.657387] ? __pfx_perf_trace_lock+0x10/0x10 [ 100.657751] ? lock_is_held_type+0x9e/0x120 [ 100.658099] ? perf_trace_run_bpf_submit+0xef/0x180 [ 100.658496] perf_trace_run_bpf_submit+0xef/0x180 [ 100.658883] perf_trace_lock+0x337/0x5d0 [ 100.659210] ? kvm_sched_clock_read+0x16/0x30 [ 100.659571] ? __pfx_perf_trace_lock+0x10/0x10 [ 100.659935] ? check_preempt_wakeup_fair+0x6e/0x950 [ 100.660330] ? sched_ttwu_pending+0x2e0/0x4a0 [ 100.660698] lock_release+0x1ab/0x290 [ 100.661000] ? ttwu_do_activate+0x1a4/0x8a0 [ 100.661346] _raw_spin_unlock+0x16/0x40 [ 100.661664] sched_ttwu_pending+0x2e0/0x4a0 [ 100.662009] ? __pfx_sched_ttwu_pending+0x10/0x10 [ 100.662396] ? hrtimer_interrupt+0x652/0x830 [ 100.662748] __flush_smp_call_function_queue+0x434/0x740 [ 100.663181] __sysvec_call_function_single+0x6d/0x370 [ 100.663595] sysvec_call_function_single+0xa1/0xc0 [ 100.663985] [ 100.664167] [ 100.664347] asm_sysvec_call_function_single+0x1a/0x20 [ 100.664769] RIP: 0010:oops_exit+0x0/0x50 [ 100.665095] Code: f1 39 00 be ff ff ff ff 48 c7 c7 50 ac 43 86 e8 c6 0f f9 ff 5b e9 20 f1 39 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 53 e8 06 f1 39 00 8b 1d c0 ed 4e 06 31 ff 89 de e8 27 [ 100.666495] RSP: 0018:ffff8880427af690 EFLAGS: 00000202 [ 100.666910] RAX: 0000000000000000 RBX: 0000000000000293 RCX: ffffffff8139f06f [ 100.667460] RDX: ffff88801b40d280 RSI: ffffffff812a3dca RDI: 0000000000000007 [ 100.668012] RBP: 000000000000000b R08: 0000000000000001 R09: fffffbfff0f11c90 [ 100.668572] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880427af758 [ 100.669126] R13: 0000000000000000 R14: dffffc0020000032 R15: 0000000000000000 [ 100.669680] ? add_taint+0x5f/0xd0 [ 100.669975] ? oops_end+0x4a/0xe0 [ 100.670262] oops_end+0x65/0xe0 [ 100.670535] exc_general_protection+0x1a2/0x330 [ 100.670910] asm_exc_general_protection+0x26/0x30 [ 100.671289] RIP: 0010:perf_tp_event+0x175/0xe70 [ 100.671661] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 100.673075] RSP: 0018:ffff8880427af800 EFLAGS: 00010212 [ 100.673490] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002 [ 100.674042] RDX: ffff88801b40d280 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 100.674598] RBP: ffff8880427afa70 R08: ffff88806cf31340 R09: ffffe8ffffd15b38 [ 100.675152] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 100.675705] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000 [ 100.676268] ? perf_tp_event+0x167/0xe70 [ 100.676602] ? arch_scale_cpu_capacity+0x17/0xa0 [ 100.676987] ? __pfx_perf_tp_event+0x10/0x10 [ 100.677339] ? __asan_memset+0x24/0x50 [ 100.677661] ? perf_trace_lock+0xb5/0x5d0 [ 100.677991] ? kvm_sched_clock_read+0x16/0x30 [ 100.678352] ? sched_clock+0x37/0x60 [ 100.678653] ? sched_clock_cpu+0x6c/0x4e0 [ 100.678982] ? lock_is_held_type+0x9e/0x120 [ 100.679329] ? perf_trace_run_bpf_submit+0xef/0x180 [ 100.679726] perf_trace_run_bpf_submit+0xef/0x180 [ 100.680114] perf_trace_lock+0x337/0x5d0 [ 100.680442] ? __pfx_perf_trace_lock+0x10/0x10 [ 100.680816] ? lock_acquire+0x15e/0x2f0 [ 100.681132] ? futex_ref_get+0x48/0x300 [ 100.681443] ? futex_ref_get+0x114/0x300 [ 100.681763] ? futex_hash+0x15c/0x390 [ 100.682064] lock_release+0x1ab/0x290 [ 100.682371] ? futex_hash+0x15c/0x390 [ 100.682672] futex_ref_get+0x119/0x300 [ 100.682982] ? futex_hash+0x15c/0x390 [ 100.683281] futex_hash+0x70/0x390 [ 100.683565] futex_wake+0x143/0x540 [ 100.683857] ? put_pid+0x1f/0x30 [ 100.684128] ? kernel_clone+0x204/0x7f0 [ 100.684442] ? __pfx_futex_wake+0x10/0x10 [ 100.684784] ? __pfx_kernel_clone+0x10/0x10 [ 100.685130] ? perf_trace_lock+0xb5/0x5d0 [ 100.685460] do_futex+0x26d/0x370 [ 100.685742] ? __pfx_do_futex+0x10/0x10 [ 100.686058] ? __pfx___do_sys_clone+0x10/0x10 [ 100.686414] ? find_held_lock+0x2b/0x80 [ 100.686737] __x64_sys_futex+0x1c9/0x4d0 [ 100.687063] ? __pfx___x64_sys_futex+0x10/0x10 [ 100.687430] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 100.687842] do_syscall_64+0xbf/0x360 [ 100.688145] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.688550] RIP: 0033:0x7f1c239e7b19 [ 100.688850] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 100.690252] RSP: 002b:00007fff50798088 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 100.690845] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1c239e7b19 [ 100.691410] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1c23afaf68 [ 100.691979] RBP: 00007f1c23afaf60 R08: 00007f1c20f5d700 R09: 0000000000000000 [ 100.692542] R10: 00007f1c20f5d700 R11: 0000000000000246 R12: 00007f1c23affa68 [ 100.693111] R13: 00007fff50798190 R14: 00007f1c23afaf60 R15: 0000000000018865 [ 100.693681] [ 100.693872] Modules linked in: [ 100.694135] ---[ end trace 0000000000000000 ]--- [ 100.694137] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#4] SMP KASAN NOPTI [ 100.694509] RIP: 0010:perf_tp_event+0x175/0xe70 [ 100.696062] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] [ 100.696425] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 100.697491] CPU: 0 UID: 0 PID: 3931 Comm: syz-executor.3 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 100.698902] RSP: 0018:ffff8880427af800 EFLAGS: 00010212 [ 100.700577] Tainted: [D]=DIE, [W]=WARN [ 100.700991] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002 [ 100.701529] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 100.702086] RDX: ffff88801b40d280 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 100.703233] RIP: 0010:perf_tp_event+0x175/0xe70 [ 100.703791] RBP: ffff8880427afa70 R08: ffff88806cf31340 R09: ffffe8ffffd15b38 [ 100.704437] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 100.705002] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 100.707527] RSP: 0018:ffff88806ce08a80 EFLAGS: 00010012 [ 100.708082] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000 [ 100.708087] [ 100.708096] FS: 000055557de64400(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000 [ 100.708841] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002 [ 100.709400] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 100.709644] RDX: ffff888018319b80 RSI: ffffffff818995b7 RDI: 0000000000000191 [ 100.710274] CR2: 000055557de65c18 CR3: 0000000041270000 CR4: 0000000000350ef0 [ 100.711270] RBP: ffff88806ce08cf0 R08: ffff88806ce31490 R09: ffffe8ffffc15b38 [ 100.711733] Kernel panic - not syncing: Fatal exception in interrupt [ 101.755743] Shutting down cpus with NMI [ 101.757928] Kernel Offset: disabled [ 101.758217] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- VM DIAGNOSIS: 08:17:33 Registers: info registers vcpu 0 RAX=0000000000000000 RBX=0000000000000000 RCX=ffffffff82276ea3 RDX=ffff88801715d280 RSI=0000000000000000 RDI=0000000000000005 RBP=0000000000004000 RSP=ffff88800c91fa48 R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000 R12=ffff88800d36c300 R13=0000000000000081 R14=0000000000000001 R15=0000000020000000 RIP=ffffffff8173e784 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 000055556d0e2400 00000000 00000000 GS =0000 ffff8880e55dd000 00000000 00000000 LDT=0000 fffffe1600000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055556d0ebc58 CR3=000000003ebcb000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000000000000000ff000000000000ff XMM01=25252525252525252525252525252525 XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=dffffc0000000060 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd RSI=ffffffff828e3230 RDI=ffffffff88724180 RBP=ffffffff88724140 RSP=ffff8880427af058 R8 =0000000000000000 R9 =ffffed10014f2046 R10=00000000000fe503 R11=0000000065646f43 R12=0000000000000823 R13=0000000000000060 R14=fffffbfff10e4882 R15=dffffc0000000000 RIP=ffffffff828e3285 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 000055557de64400 00000000 00000000 GS =0000 ffff8880e56dd000 00000000 00000000 LDT=0000 fffffe5300000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055557de65c18 CR3=0000000041270000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f1c23ace7c000007f1c23ace7c8 XMM02=00007f1c23ace7e000007f1c23ace7c0 XMM03=00007f1c23ace7c800007f1c23ace7c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000