Warning: Permanently added '[localhost]:29204' (ECDSA) to the list of known hosts.
2025/08/29 08:19:26 fuzzer started
2025/08/29 08:19:26 dialing manager at localhost:43077
syzkaller login: [ 52.021400] cgroup: Unknown subsys name 'net'
[ 52.084422] cgroup: Unknown subsys name 'cpuset'
[ 52.103601] cgroup: Unknown subsys name 'rlimit'
2025/08/29 08:19:36 syscalls: 2214
2025/08/29 08:19:36 code coverage: enabled
2025/08/29 08:19:36 comparison tracing: enabled
2025/08/29 08:19:36 extra coverage: enabled
2025/08/29 08:19:36 setuid sandbox: enabled
2025/08/29 08:19:36 namespace sandbox: enabled
2025/08/29 08:19:36 Android sandbox: enabled
2025/08/29 08:19:36 fault injection: enabled
2025/08/29 08:19:36 leak checking: enabled
2025/08/29 08:19:36 net packet injection: enabled
2025/08/29 08:19:36 net device setup: enabled
2025/08/29 08:19:36 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2025/08/29 08:19:36 devlink PCI setup: PCI device 0000:00:10.0 is not available
2025/08/29 08:19:36 USB emulation: enabled
2025/08/29 08:19:36 hci packet injection: enabled
2025/08/29 08:19:36 wifi device emulation: enabled
2025/08/29 08:19:36 802.15.4 emulation: enabled
2025/08/29 08:19:36 fetching corpus: 0, signal 0/2000 (executing program)
2025/08/29 08:19:37 fetching corpus: 50, signal 25722/28568 (executing program)
2025/08/29 08:19:37 fetching corpus: 100, signal 36066/39600 (executing program)
2025/08/29 08:19:37 fetching corpus: 150, signal 43885/47816 (executing program)
2025/08/29 08:19:37 fetching corpus: 200, signal 51063/55225 (executing program)
2025/08/29 08:19:37 fetching corpus: 250, signal 56705/60893 (executing program)
2025/08/29 08:19:37 fetching corpus: 300, signal 60656/64940 (executing program)
2025/08/29 08:19:38 fetching corpus: 350, signal 64215/68433 (executing program)
2025/08/29 08:19:38 fetching corpus: 400, signal 68343/72202 (executing program)
2025/08/29 08:19:38 fetching corpus: 450, signal 70530/74338 (executing program)
2025/08/29 08:19:38 fetching corpus: 500, signal 72644/76343 (executing program)
2025/08/29 08:19:38 fetching corpus: 550, signal 75833/79038 (executing program)
2025/08/29 08:19:38 fetching corpus: 600, signal 79475/81886 (executing program)
2025/08/29 08:19:38 fetching corpus: 650, signal 82198/84212 (executing program)
2025/08/29 08:19:38 fetching corpus: 700, signal 83956/85545 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/86050 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/86138 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/86234 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/86316 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/86406 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/86488 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/86569 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/86658 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/86753 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/86849 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/86945 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/87036 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/87113 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/87200 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/87288 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/87382 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/87461 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/87544 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/87630 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/87721 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/87821 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/87901 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/87988 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/88080 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/88160 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/88249 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/88334 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/88423 (executing program)
2025/08/29 08:19:39 fetching corpus: 732, signal 84598/88423 (executing program)
2025/08/29 08:19:41 starting 8 fuzzer processes
08:19:41 executing program 1:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_IPV6_ADDRFORM(r0, 0x3a, 0x7, 0x0, 0x0)
08:19:41 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)={0x14, 0x31, 0x1, 0x0, 0x0, "", [@generic="80"]}, 0x14}], 0x1}, 0x0)
08:19:41 executing program 3:
r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0)
ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f0000000000)=0x2)
08:19:41 executing program 2:
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @hci_ev_user_passkey_req={{0x34, 0x6}, {@fixed}}}, 0x9)
syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0xa}, @l2cap_cid_le_signaling={{0x6}, @l2cap_cmd_rej_unk={{0x1, 0x5, 0x2}}}}, 0xf)
[ 66.323612] audit: type=1400 audit(1756455581.369:7): avc: denied { execmem } for pid=273 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
08:19:41 executing program 7:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa006}, 0x4)
syz_emit_ethernet(0x3e, &(0x7f0000000280)={@local, @remote, @val={@void}, {@ipv4={0x800, @tipc={{0x5, 0x2, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @dev}, @payload_conn={{{0x18, 0x0, 0x0, 0x0, 0x0, 0x6}}}}}}}, 0x0)
08:19:41 executing program 4:
fremovexattr(0xffffffffffffffff, &(0x7f0000000080)=@random={'trusted.', 'k\xc1\xb3\xc7\x92\xd9 \x87j\x89\xe7xR\x84\x8e\x01\xff\xd9\xe5\xe6y\\\xceC\x80\v\xc8\xf7\xc2#\xdf\x8e\rdl\xbbu\xc4\xacd\x13\xf7v\x85\xe2\xcf\xf1\xe5%\xfd?e\x04\xb0$s726\xdf\xc7\xaf\xb0`\n\xea\r\x04;\xbb\x9e\x9es\xaa*<\xd83\xf0k\xcfcbD\x81\xf3Q\x8e\x1e\x9d\x0fru\x95\xad\xb9\x04%\xbf\x10\xbf\x15\xad\xdd\\\xb3\xa9\x17\x92]\xb4\xa8Y\xbf\xc0\xdf\xba\x15\xe8\xeb\xd7x\xeb\xd9\x9f:+\xd7\xbb\xbe\x95\x1e+\x11\xdc\xc2\xd3?\xdf/\xef\xad\x88\xedyW\xc6\xccP\xc9\x83\x95\xde\xe8\xe9\x84\xaf\xb8\xa8\x1b\x05\xc8\xb9Rh\xb1{\x95\xdf[\x11!\xe8\x92p\xbfm\xbb\xa5\xdc\x81\xc2&3Lg4\'\\\xf7B\xedZ\xcd\xca\x97\xa5\x149\xaf\x9a\xfd\x02\xc2o\xf66\x85\xf8\xf8OJ\xaf\'d\x99\x17\xb4\xcdQ\xde\xc5r\xfc\xacV4\x0f?p\xab\fp\fe\x17*\x8b#\xc4\xac\xc7\x99\xf1R8)\x94\xa1%\x82y;\x9akr:]D\xb8~{\xce\xb0,q\xe9l\x94\xa8\x9c\x87\'u\b!\xcc\xb5m\x84\xbb\xde8s}\x8a::\xf7n\x1a\xd6\x91o\xad}\xc8}\xa2\xfa\xe9/\xe5t\xeew\xb4a\xd3\xa6\x94\xc2/\x83\x1dA\xdd\xd3\xf0\t)\xe8\x14,\x7f\xa1\xca\n\xe8\x1fo9\x1b\xeb\x83U`\xf5a\xce\xdc\xb6\"$\xf1e\xc5\xbb\xf9\x95(\x96\xeb=\x94\xf3\x96\xf5\x95\x8a\xce\x93/\xba\x8e\x93\x97[p\xf5t\x0f\xad\x1e\xd6\x831}\x18\x00\x7f\x8b\xa1\xf9\a~\x84\xd1=\xb87\xfd\xa9I\a3\xe4K\xa6azB\x95!\x99\x01\xa2\x1c\xec&\xfb\x7f3\x14\x89\x9bR\xbb\xc0\xb9\x1b\x10\xca\x19\x84\x90n\v\x83\x10'})
08:19:41 executing program 5:
prctl$PR_SET_IO_FLUSHER(0x39, 0x1)
socket$packet(0x11, 0x2, 0x300)
08:19:41 executing program 6:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000740)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000001c0)="db", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000300)="ea", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000080)='m', 0x1}], 0x1}}], 0x3, 0x44894)
sendmmsg$inet6(r0, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000340)='\'', 0x1}], 0x1}}], 0x1, 0x1)
[ 67.464880] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 67.467193] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 67.469217] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 67.473830] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 67.476474] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 67.515832] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 67.520499] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 67.525016] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 67.533180] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 67.536402] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 67.577065] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 67.585920] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 67.587823] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 67.589589] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 67.592867] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 67.593878] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 67.596469] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 67.603241] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 67.607771] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 67.612818] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 67.661112] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[ 67.667984] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[ 67.669145] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 67.684950] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[ 67.687595] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 67.692721] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 67.700098] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 67.703193] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 67.737670] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[ 67.742751] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[ 67.744026] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[ 67.745569] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[ 67.749272] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[ 67.753928] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[ 67.753945] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[ 67.756019] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[ 67.759113] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[ 67.775461] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[ 67.776610] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[ 67.800324] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[ 69.488262] Bluetooth: hci0: command tx timeout
[ 69.551643] Bluetooth: hci1: command tx timeout
[ 69.679800] Bluetooth: hci3: command tx timeout
[ 69.679815] Bluetooth: hci2: command tx timeout
[ 69.744052] Bluetooth: hci4: command tx timeout
[ 69.807930] Bluetooth: hci5: command tx timeout
[ 69.871900] Bluetooth: hci6: command tx timeout
[ 69.872966] Bluetooth: hci7: command tx timeout
[ 71.535716] Bluetooth: hci0: command tx timeout
[ 71.599604] Bluetooth: hci1: command tx timeout
[ 71.727830] Bluetooth: hci2: command tx timeout
[ 71.729000] Bluetooth: hci3: command tx timeout
[ 71.791681] Bluetooth: hci4: command tx timeout
[ 71.855711] Bluetooth: hci5: command tx timeout
[ 71.920284] Bluetooth: hci7: command tx timeout
[ 71.921139] Bluetooth: hci6: command tx timeout
[ 73.584045] Bluetooth: hci0: command tx timeout
[ 73.647571] Bluetooth: hci1: command tx timeout
[ 73.776709] Bluetooth: hci3: command tx timeout
[ 73.776801] Bluetooth: hci2: command tx timeout
[ 73.840582] Bluetooth: hci4: command tx timeout
[ 73.905044] Bluetooth: hci5: command tx timeout
[ 73.967685] Bluetooth: hci7: command tx timeout
[ 73.969706] Bluetooth: hci6: command tx timeout
[ 75.632703] Bluetooth: hci0: command tx timeout
[ 75.696656] Bluetooth: hci1: command tx timeout
[ 75.823673] Bluetooth: hci2: command tx timeout
[ 75.825027] Bluetooth: hci3: command tx timeout
[ 75.887834] Bluetooth: hci4: command tx timeout
[ 75.951630] Bluetooth: hci5: command tx timeout
[ 76.016257] Bluetooth: hci6: command tx timeout
[ 76.016283] Bluetooth: hci7: command tx timeout
[ 108.738357] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.739239] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 108.915112] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 108.915723] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 109.048461] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.049289] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 109.182012] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.183271] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 109.583247] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow
[ 109.681916] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.682727] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:20:24 executing program 3:
r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0)
ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f0000000000)=0x2)
08:20:25 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)={0x14, 0x31, 0x1, 0x0, 0x0, "", [@generic="80"]}, 0x14}], 0x1}, 0x0)
[ 109.939495] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow
[ 109.967560] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 109.968199] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 110.113930] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.114504] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 110.180828] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.181445] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:20:25 executing program 3:
r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0)
ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f0000000000)=0x2)
[ 110.226345] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow
[ 110.251580] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.252113] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:20:25 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)={0x14, 0x31, 0x1, 0x0, 0x0, "", [@generic="80"]}, 0x14}], 0x1}, 0x0)
08:20:25 executing program 7:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa006}, 0x4)
syz_emit_ethernet(0x3e, &(0x7f0000000280)={@local, @remote, @val={@void}, {@ipv4={0x800, @tipc={{0x5, 0x2, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @dev}, @payload_conn={{{0x18, 0x0, 0x0, 0x0, 0x0, 0x6}}}}}}}, 0x0)
[ 110.408916] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.409621] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 110.482149] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.482815] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:20:25 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)={0x14, 0x31, 0x1, 0x0, 0x0, "", [@generic="80"]}, 0x14}], 0x1}, 0x0)
08:20:25 executing program 3:
r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0)
ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f0000000000)=0x2)
08:20:25 executing program 7:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa006}, 0x4)
syz_emit_ethernet(0x3e, &(0x7f0000000280)={@local, @remote, @val={@void}, {@ipv4={0x800, @tipc={{0x5, 0x2, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @dev}, @payload_conn={{{0x18, 0x0, 0x0, 0x0, 0x0, 0x6}}}}}}}, 0x0)
[ 110.566251] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow
[ 110.605129] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.606583] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 110.649988] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.650636] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 110.831248] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 110.832111] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 111.272684] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 111.273318] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 111.320064] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 111.321737] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
08:20:26 executing program 1:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_IPV6_ADDRFORM(r0, 0x3a, 0x7, 0x0, 0x0)
08:20:26 executing program 0:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa006}, 0x4)
syz_emit_ethernet(0x3e, &(0x7f0000000280)={@local, @remote, @val={@void}, {@ipv4={0x800, @tipc={{0x5, 0x2, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @dev}, @payload_conn={{{0x18, 0x0, 0x0, 0x0, 0x0, 0x6}}}}}}}, 0x0)
08:20:26 executing program 7:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa006}, 0x4)
syz_emit_ethernet(0x3e, &(0x7f0000000280)={@local, @remote, @val={@void}, {@ipv4={0x800, @tipc={{0x5, 0x2, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @dev}, @payload_conn={{{0x18, 0x0, 0x0, 0x0, 0x0, 0x6}}}}}}}, 0x0)
08:20:26 executing program 5:
prctl$PR_SET_IO_FLUSHER(0x39, 0x1)
socket$packet(0x11, 0x2, 0x300)
08:20:26 executing program 4:
fremovexattr(0xffffffffffffffff, &(0x7f0000000080)=@random={'trusted.', 'k\xc1\xb3\xc7\x92\xd9 \x87j\x89\xe7xR\x84\x8e\x01\xff\xd9\xe5\xe6y\\\xceC\x80\v\xc8\xf7\xc2#\xdf\x8e\rdl\xbbu\xc4\xacd\x13\xf7v\x85\xe2\xcf\xf1\xe5%\xfd?e\x04\xb0$s726\xdf\xc7\xaf\xb0`\n\xea\r\x04;\xbb\x9e\x9es\xaa*<\xd83\xf0k\xcfcbD\x81\xf3Q\x8e\x1e\x9d\x0fru\x95\xad\xb9\x04%\xbf\x10\xbf\x15\xad\xdd\\\xb3\xa9\x17\x92]\xb4\xa8Y\xbf\xc0\xdf\xba\x15\xe8\xeb\xd7x\xeb\xd9\x9f:+\xd7\xbb\xbe\x95\x1e+\x11\xdc\xc2\xd3?\xdf/\xef\xad\x88\xedyW\xc6\xccP\xc9\x83\x95\xde\xe8\xe9\x84\xaf\xb8\xa8\x1b\x05\xc8\xb9Rh\xb1{\x95\xdf[\x11!\xe8\x92p\xbfm\xbb\xa5\xdc\x81\xc2&3Lg4\'\\\xf7B\xedZ\xcd\xca\x97\xa5\x149\xaf\x9a\xfd\x02\xc2o\xf66\x85\xf8\xf8OJ\xaf\'d\x99\x17\xb4\xcdQ\xde\xc5r\xfc\xacV4\x0f?p\xab\fp\fe\x17*\x8b#\xc4\xac\xc7\x99\xf1R8)\x94\xa1%\x82y;\x9akr:]D\xb8~{\xce\xb0,q\xe9l\x94\xa8\x9c\x87\'u\b!\xcc\xb5m\x84\xbb\xde8s}\x8a::\xf7n\x1a\xd6\x91o\xad}\xc8}\xa2\xfa\xe9/\xe5t\xeew\xb4a\xd3\xa6\x94\xc2/\x83\x1dA\xdd\xd3\xf0\t)\xe8\x14,\x7f\xa1\xca\n\xe8\x1fo9\x1b\xeb\x83U`\xf5a\xce\xdc\xb6\"$\xf1e\xc5\xbb\xf9\x95(\x96\xeb=\x94\xf3\x96\xf5\x95\x8a\xce\x93/\xba\x8e\x93\x97[p\xf5t\x0f\xad\x1e\xd6\x831}\x18\x00\x7f\x8b\xa1\xf9\a~\x84\xd1=\xb87\xfd\xa9I\a3\xe4K\xa6azB\x95!\x99\x01\xa2\x1c\xec&\xfb\x7f3\x14\x89\x9bR\xbb\xc0\xb9\x1b\x10\xca\x19\x84\x90n\v\x83\x10'})
08:20:26 executing program 3:
r0 = add_key$keyring(&(0x7f0000000500), &(0x7f0000000540)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$restrict_keyring(0xa, r0, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180)='e\xf87Z)\x95\xa0\x9f\xfc\x84\xcf')
08:20:26 executing program 2:
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @hci_ev_user_passkey_req={{0x34, 0x6}, {@fixed}}}, 0x9)
syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0xa}, @l2cap_cid_le_signaling={{0x6}, @l2cap_cmd_rej_unk={{0x1, 0x5, 0x2}}}}, 0xf)
08:20:26 executing program 6:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000740)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000001c0)="db", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000300)="ea", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000080)='m', 0x1}], 0x1}}], 0x3, 0x44894)
sendmmsg$inet6(r0, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000340)='\'', 0x1}], 0x1}}], 0x1, 0x1)
[ 111.557631] kmemleak: Found object by alias at 0x607f1a639e3c
[ 111.557651] CPU: 1 UID: 0 PID: 3918 Comm: syz-executor.5 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
[ 111.557669] Tainted: [W]=WARN
[ 111.557672] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 111.557679] Call Trace:
[ 111.557684]
[ 111.557688] dump_stack_lvl+0xca/0x120
[ 111.557712] __lookup_object+0x94/0xb0
[ 111.557728] delete_object_full+0x27/0x70
[ 111.557744] free_percpu+0x30/0x1160
[ 111.557760] ? arch_uprobe_clear_state+0x16/0x140
[ 111.557780] futex_hash_free+0x38/0xc0
[ 111.557794] mmput+0x2d3/0x390
[ 111.557812] do_exit+0x79d/0x2970
[ 111.557825] ? lock_release+0xc8/0x290
[ 111.557841] ? __pfx_do_exit+0x10/0x10
[ 111.557854] ? find_held_lock+0x2b/0x80
[ 111.557871] ? get_signal+0x835/0x2340
[ 111.557890] do_group_exit+0xd3/0x2a0
[ 111.557905] get_signal+0x2315/0x2340
[ 111.557927] ? __pfx_get_signal+0x10/0x10
[ 111.557942] ? do_futex+0x135/0x370
[ 111.557955] ? __pfx_do_futex+0x10/0x10
[ 111.557970] arch_do_signal_or_restart+0x80/0x790
[ 111.557987] ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 111.558003] ? __x64_sys_futex+0x1c9/0x4d0
[ 111.558014] ? __x64_sys_futex+0x1d2/0x4d0
[ 111.558027] ? __sys_socket+0x9f/0x260
[ 111.558042] ? __pfx___x64_sys_futex+0x10/0x10
[ 111.558055] ? xfd_validate_state+0x55/0x180
[ 111.558070] ? __pfx___do_sys_prctl+0x10/0x10
[ 111.558088] exit_to_user_mode_loop+0x8b/0x110
[ 111.558101] do_syscall_64+0x2f7/0x360
[ 111.558113] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 111.558124] RIP: 0033:0x7fc4605a1b19
[ 111.558133] Code: Unable to access opcode bytes at 0x7fc4605a1aef.
[ 111.558138] RSP: 002b:00007fc45db17218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 111.558149] RAX: fffffffffffffe00 RBX: 00007fc4606b4f68 RCX: 00007fc4605a1b19
[ 111.558157] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc4606b4f68
[ 111.558163] RBP: 00007fc4606b4f60 R08: 0000000000000000 R09: 0000000000000000
[ 111.558170] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc4606b4f6c
[ 111.558177] R13: 00007ffd119ea12f R14: 00007fc45db17300 R15: 0000000000022000
[ 111.558192]
[ 111.558196] kmemleak: Object (percpu) 0x607f1a639e38 (size 8):
[ 111.558202] kmemleak: comm "syz-executor.6", pid 286, jiffies 4294777777
[ 111.558209] kmemleak: min_count = 1
[ 111.558212] kmemleak: count = 0
[ 111.558216] kmemleak: flags = 0x21
[ 111.558220] kmemleak: checksum = 0
[ 111.558223] kmemleak: backtrace:
[ 111.558227] pcpu_alloc_noprof+0x87a/0x1170
[ 111.558241] percpu_ref_init+0x37/0x400
[ 111.558258] cgroup_apply_control_enable+0x4a6/0x9f0
[ 111.558271] cgroup_mkdir+0x86e/0x1110
[ 111.558283] kernfs_iop_mkdir+0x111/0x190
[ 111.558298] vfs_mkdir+0x59a/0x8d0
[ 111.558313] do_mkdirat+0x19f/0x3d0
[ 111.558322] __x64_sys_mkdir+0xf3/0x140
[ 111.558333] do_syscall_64+0xbf/0x360
[ 111.558341] entry_SYSCALL_64_after_hwframe+0x77/0x7f
08:20:26 executing program 5:
prctl$PR_SET_IO_FLUSHER(0x39, 0x1)
socket$packet(0x11, 0x2, 0x300)
08:20:26 executing program 2:
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @hci_ev_user_passkey_req={{0x34, 0x6}, {@fixed}}}, 0x9)
syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0xa}, @l2cap_cid_le_signaling={{0x6}, @l2cap_cmd_rej_unk={{0x1, 0x5, 0x2}}}}, 0xf)
[ 111.660790] kmemleak: Found object by alias at 0x607f1a639e3c
[ 111.660812] CPU: 1 UID: 0 PID: 3933 Comm: syz-executor.5 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
[ 111.660830] Tainted: [W]=WARN
[ 111.660834] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 111.660841] Call Trace:
[ 111.660845]
[ 111.660849] dump_stack_lvl+0xca/0x120
[ 111.660873] __lookup_object+0x94/0xb0
[ 111.660890] delete_object_full+0x27/0x70
[ 111.660905] free_percpu+0x30/0x1160
[ 111.660922] ? arch_uprobe_clear_state+0x16/0x140
[ 111.660942] futex_hash_free+0x38/0xc0
[ 111.660956] mmput+0x2d3/0x390
[ 111.660974] do_exit+0x79d/0x2970
[ 111.660987] ? lock_release+0xc8/0x290
[ 111.661003] ? __pfx_do_exit+0x10/0x10
[ 111.661017] ? find_held_lock+0x2b/0x80
[ 111.661034] ? get_signal+0x835/0x2340
[ 111.661053] do_group_exit+0xd3/0x2a0
[ 111.661068] get_signal+0x2315/0x2340
[ 111.661090] ? __pfx_get_signal+0x10/0x10
[ 111.661105] ? do_futex+0x135/0x370
[ 111.661119] ? __pfx_do_futex+0x10/0x10
[ 111.661133] arch_do_signal_or_restart+0x80/0x790
[ 111.661151] ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 111.661166] ? __x64_sys_futex+0x1c9/0x4d0
[ 111.661178] ? __x64_sys_futex+0x1d2/0x4d0
[ 111.661191] ? __sys_socket+0x9f/0x260
[ 111.661206] ? __pfx___x64_sys_futex+0x10/0x10
[ 111.661219] ? xfd_validate_state+0x55/0x180
[ 111.661234] ? __pfx___do_sys_prctl+0x10/0x10
[ 111.661253] exit_to_user_mode_loop+0x8b/0x110
[ 111.661265] do_syscall_64+0x2f7/0x360
[ 111.661278] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 111.661290] RIP: 0033:0x7fc4605a1b19
[ 111.661298] Code: Unable to access opcode bytes at 0x7fc4605a1aef.
[ 111.661303] RSP: 002b:00007fc45db17218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 111.661315] RAX: fffffffffffffe00 RBX: 00007fc4606b4f68 RCX: 00007fc4605a1b19
[ 111.661322] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc4606b4f68
[ 111.661329] RBP: 00007fc4606b4f60 R08: 0000000000000000 R09: 0000000000000000
[ 111.661335] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc4606b4f6c
[ 111.661342] R13: 00007ffd119ea12f R14: 00007fc45db17300 R15: 0000000000022000
[ 111.661357]
[ 111.661361] kmemleak: Object (percpu) 0x607f1a639e38 (size 8):
[ 111.661368] kmemleak: comm "syz-executor.6", pid 286, jiffies 4294777777
[ 111.661375] kmemleak: min_count = 1
[ 111.661378] kmemleak: count = 0
[ 111.661382] kmemleak: flags = 0x21
[ 111.661386] kmemleak: checksum = 0
[ 111.661389] kmemleak: backtrace:
[ 111.661393] pcpu_alloc_noprof+0x87a/0x1170
[ 111.661407] percpu_ref_init+0x37/0x400
[ 111.661425] cgroup_apply_control_enable+0x4a6/0x9f0
[ 111.661437] cgroup_mkdir+0x86e/0x1110
[ 111.661449] kernfs_iop_mkdir+0x111/0x190
[ 111.661463] vfs_mkdir+0x59a/0x8d0
[ 111.661478] do_mkdirat+0x19f/0x3d0
[ 111.661488] __x64_sys_mkdir+0xf3/0x140
[ 111.661498] do_syscall_64+0xbf/0x360
[ 111.661506] entry_SYSCALL_64_after_hwframe+0x77/0x7f
08:20:26 executing program 1:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_IPV6_ADDRFORM(r0, 0x3a, 0x7, 0x0, 0x0)
08:20:26 executing program 2:
syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @hci_ev_user_passkey_req={{0x34, 0x6}, {@fixed}}}, 0x9)
syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0xa}, @l2cap_cid_le_signaling={{0x6}, @l2cap_cmd_rej_unk={{0x1, 0x5, 0x2}}}}, 0xf)
08:20:26 executing program 3:
r0 = add_key$keyring(&(0x7f0000000500), &(0x7f0000000540)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$restrict_keyring(0xa, r0, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180)='e\xf87Z)\x95\xa0\x9f\xfc\x84\xcf')
08:20:26 executing program 6:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000740)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000001c0)="db", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000300)="ea", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000080)='m', 0x1}], 0x1}}], 0x3, 0x44894)
sendmmsg$inet6(r0, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000340)='\'', 0x1}], 0x1}}], 0x1, 0x1)
08:20:26 executing program 4:
fremovexattr(0xffffffffffffffff, &(0x7f0000000080)=@random={'trusted.', 'k\xc1\xb3\xc7\x92\xd9 \x87j\x89\xe7xR\x84\x8e\x01\xff\xd9\xe5\xe6y\\\xceC\x80\v\xc8\xf7\xc2#\xdf\x8e\rdl\xbbu\xc4\xacd\x13\xf7v\x85\xe2\xcf\xf1\xe5%\xfd?e\x04\xb0$s726\xdf\xc7\xaf\xb0`\n\xea\r\x04;\xbb\x9e\x9es\xaa*<\xd83\xf0k\xcfcbD\x81\xf3Q\x8e\x1e\x9d\x0fru\x95\xad\xb9\x04%\xbf\x10\xbf\x15\xad\xdd\\\xb3\xa9\x17\x92]\xb4\xa8Y\xbf\xc0\xdf\xba\x15\xe8\xeb\xd7x\xeb\xd9\x9f:+\xd7\xbb\xbe\x95\x1e+\x11\xdc\xc2\xd3?\xdf/\xef\xad\x88\xedyW\xc6\xccP\xc9\x83\x95\xde\xe8\xe9\x84\xaf\xb8\xa8\x1b\x05\xc8\xb9Rh\xb1{\x95\xdf[\x11!\xe8\x92p\xbfm\xbb\xa5\xdc\x81\xc2&3Lg4\'\\\xf7B\xedZ\xcd\xca\x97\xa5\x149\xaf\x9a\xfd\x02\xc2o\xf66\x85\xf8\xf8OJ\xaf\'d\x99\x17\xb4\xcdQ\xde\xc5r\xfc\xacV4\x0f?p\xab\fp\fe\x17*\x8b#\xc4\xac\xc7\x99\xf1R8)\x94\xa1%\x82y;\x9akr:]D\xb8~{\xce\xb0,q\xe9l\x94\xa8\x9c\x87\'u\b!\xcc\xb5m\x84\xbb\xde8s}\x8a::\xf7n\x1a\xd6\x91o\xad}\xc8}\xa2\xfa\xe9/\xe5t\xeew\xb4a\xd3\xa6\x94\xc2/\x83\x1dA\xdd\xd3\xf0\t)\xe8\x14,\x7f\xa1\xca\n\xe8\x1fo9\x1b\xeb\x83U`\xf5a\xce\xdc\xb6\"$\xf1e\xc5\xbb\xf9\x95(\x96\xeb=\x94\xf3\x96\xf5\x95\x8a\xce\x93/\xba\x8e\x93\x97[p\xf5t\x0f\xad\x1e\xd6\x831}\x18\x00\x7f\x8b\xa1\xf9\a~\x84\xd1=\xb87\xfd\xa9I\a3\xe4K\xa6azB\x95!\x99\x01\xa2\x1c\xec&\xfb\x7f3\x14\x89\x9bR\xbb\xc0\xb9\x1b\x10\xca\x19\x84\x90n\v\x83\x10'})
08:20:26 executing program 0:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa006}, 0x4)
syz_emit_ethernet(0x3e, &(0x7f0000000280)={@local, @remote, @val={@void}, {@ipv4={0x800, @tipc={{0x5, 0x2, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @dev}, @payload_conn={{{0x18, 0x0, 0x0, 0x0, 0x0, 0x6}}}}}}}, 0x0)
08:20:26 executing program 5:
prctl$PR_SET_IO_FLUSHER(0x39, 0x1)
socket$packet(0x11, 0x2, 0x300)
08:20:26 executing program 7:
r0 = add_key$keyring(&(0x7f0000000500), &(0x7f0000000540)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$restrict_keyring(0xa, r0, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180)='e\xf87Z)\x95\xa0\x9f\xfc\x84\xcf')
08:20:26 executing program 1:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$inet6_IPV6_ADDRFORM(r0, 0x3a, 0x7, 0x0, 0x0)
08:20:26 executing program 7:
r0 = add_key$keyring(&(0x7f0000000500), &(0x7f0000000540)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$restrict_keyring(0xa, r0, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180)='e\xf87Z)\x95\xa0\x9f\xfc\x84\xcf')
08:20:26 executing program 2:
prctl$PR_SET_IO_FLUSHER(0x39, 0x1)
socket$packet(0x11, 0x2, 0x300)
08:20:26 executing program 3:
r0 = add_key$keyring(&(0x7f0000000500), &(0x7f0000000540)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$restrict_keyring(0xa, r0, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180)='e\xf87Z)\x95\xa0\x9f\xfc\x84\xcf')
08:20:26 executing program 2:
prctl$PR_SET_IO_FLUSHER(0x39, 0x1)
socket$packet(0x11, 0x2, 0x300)
08:20:26 executing program 6:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000740)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000001c0)="db", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000300)="ea", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000080)='m', 0x1}], 0x1}}], 0x3, 0x44894)
sendmmsg$inet6(r0, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000340)='\'', 0x1}], 0x1}}], 0x1, 0x1)
08:20:26 executing program 5:
clock_adjtime(0x0, &(0x7f0000000000)={0x72e0a26d0})
08:20:26 executing program 1:
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/key-users\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0x5)
setuid(r1)
syz_mount_image$iso9660(&(0x7f0000000000), 0x0, 0x0, 0x0, 0x0, 0xa00000, 0x0)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
ioctl$TCSETSF2(r2, 0x5423, &(0x7f0000000080)={0x2, 0x0, 0x0, 0x0, 0x0, "f2f3e2a9286b6a770ff8c2b978657df3480824"})
[ 112.003637] audit: type=1400 audit(1756455627.048:8): avc: denied { open } for pid=3965 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[ 112.009042] audit: type=1400 audit(1756455627.049:9): avc: denied { kernel } for pid=3965 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
08:20:27 executing program 0:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa006}, 0x4)
syz_emit_ethernet(0x3e, &(0x7f0000000280)={@local, @remote, @val={@void}, {@ipv4={0x800, @tipc={{0x5, 0x2, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @dev}, @payload_conn={{{0x18, 0x0, 0x0, 0x0, 0x0, 0x6}}}}}}}, 0x0)
08:20:27 executing program 4:
fremovexattr(0xffffffffffffffff, &(0x7f0000000080)=@random={'trusted.', 'k\xc1\xb3\xc7\x92\xd9 \x87j\x89\xe7xR\x84\x8e\x01\xff\xd9\xe5\xe6y\\\xceC\x80\v\xc8\xf7\xc2#\xdf\x8e\rdl\xbbu\xc4\xacd\x13\xf7v\x85\xe2\xcf\xf1\xe5%\xfd?e\x04\xb0$s726\xdf\xc7\xaf\xb0`\n\xea\r\x04;\xbb\x9e\x9es\xaa*<\xd83\xf0k\xcfcbD\x81\xf3Q\x8e\x1e\x9d\x0fru\x95\xad\xb9\x04%\xbf\x10\xbf\x15\xad\xdd\\\xb3\xa9\x17\x92]\xb4\xa8Y\xbf\xc0\xdf\xba\x15\xe8\xeb\xd7x\xeb\xd9\x9f:+\xd7\xbb\xbe\x95\x1e+\x11\xdc\xc2\xd3?\xdf/\xef\xad\x88\xedyW\xc6\xccP\xc9\x83\x95\xde\xe8\xe9\x84\xaf\xb8\xa8\x1b\x05\xc8\xb9Rh\xb1{\x95\xdf[\x11!\xe8\x92p\xbfm\xbb\xa5\xdc\x81\xc2&3Lg4\'\\\xf7B\xedZ\xcd\xca\x97\xa5\x149\xaf\x9a\xfd\x02\xc2o\xf66\x85\xf8\xf8OJ\xaf\'d\x99\x17\xb4\xcdQ\xde\xc5r\xfc\xacV4\x0f?p\xab\fp\fe\x17*\x8b#\xc4\xac\xc7\x99\xf1R8)\x94\xa1%\x82y;\x9akr:]D\xb8~{\xce\xb0,q\xe9l\x94\xa8\x9c\x87\'u\b!\xcc\xb5m\x84\xbb\xde8s}\x8a::\xf7n\x1a\xd6\x91o\xad}\xc8}\xa2\xfa\xe9/\xe5t\xeew\xb4a\xd3\xa6\x94\xc2/\x83\x1dA\xdd\xd3\xf0\t)\xe8\x14,\x7f\xa1\xca\n\xe8\x1fo9\x1b\xeb\x83U`\xf5a\xce\xdc\xb6\"$\xf1e\xc5\xbb\xf9\x95(\x96\xeb=\x94\xf3\x96\xf5\x95\x8a\xce\x93/\xba\x8e\x93\x97[p\xf5t\x0f\xad\x1e\xd6\x831}\x18\x00\x7f\x8b\xa1\xf9\a~\x84\xd1=\xb87\xfd\xa9I\a3\xe4K\xa6azB\x95!\x99\x01\xa2\x1c\xec&\xfb\x7f3\x14\x89\x9bR\xbb\xc0\xb9\x1b\x10\xca\x19\x84\x90n\v\x83\x10'})
08:20:27 executing program 2:
prctl$PR_SET_IO_FLUSHER(0x39, 0x1)
socket$packet(0x11, 0x2, 0x300)
08:20:27 executing program 7:
r0 = add_key$keyring(&(0x7f0000000500), &(0x7f0000000540)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$restrict_keyring(0xa, r0, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180)='e\xf87Z)\x95\xa0\x9f\xfc\x84\xcf')
08:20:27 executing program 3:
r0 = add_key$keyring(&(0x7f0000000500), &(0x7f0000000540)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff)
keyctl$restrict_keyring(0xa, r0, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180)='e\xf87Z)\x95\xa0\x9f\xfc\x84\xcf')
08:20:27 executing program 5:
clock_adjtime(0x0, &(0x7f0000000000)={0x72e0a26d0})
08:20:27 executing program 6:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
r1 = dup(r0)
recvmsg$unix(r1, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x40010140)
08:20:27 executing program 1:
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/key-users\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0x5)
setuid(r1)
syz_mount_image$iso9660(&(0x7f0000000000), 0x0, 0x0, 0x0, 0x0, 0xa00000, 0x0)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
ioctl$TCSETSF2(r2, 0x5423, &(0x7f0000000080)={0x2, 0x0, 0x0, 0x0, 0x0, "f2f3e2a9286b6a770ff8c2b978657df3480824"})
[ 112.173645] kmemleak: Found object by alias at 0x607f1a639e3c
[ 112.173666] CPU: 1 UID: 0 PID: 3976 Comm: syz-executor.5 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
[ 112.173684] Tainted: [W]=WARN
[ 112.173687] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 112.173695] Call Trace:
[ 112.173699]
[ 112.173703] dump_stack_lvl+0xca/0x120
[ 112.173728] __lookup_object+0x94/0xb0
[ 112.173745] delete_object_full+0x27/0x70
[ 112.173761] free_percpu+0x30/0x1160
[ 112.173777] ? arch_uprobe_clear_state+0x16/0x140
[ 112.173797] futex_hash_free+0x38/0xc0
[ 112.173811] mmput+0x2d3/0x390
[ 112.173830] do_exit+0x79d/0x2970
[ 112.173848] ? __pfx_do_exit+0x10/0x10
[ 112.173862] ? find_held_lock+0x2b/0x80
[ 112.173880] ? get_signal+0x835/0x2340
[ 112.173900] do_group_exit+0xd3/0x2a0
[ 112.173915] get_signal+0x2315/0x2340
[ 112.173932] ? trace_irq_enable.constprop.0+0xc2/0x100
[ 112.173949] ? __pfx_get_signal+0x10/0x10
[ 112.173965] ? __schedule+0xe91/0x3590
[ 112.173985] arch_do_signal_or_restart+0x80/0x790
[ 112.174002] ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 112.174018] ? __x64_sys_futex+0x1c9/0x4d0
[ 112.174030] ? __x64_sys_futex+0x1d2/0x4d0
[ 112.174045] ? __pfx___x64_sys_futex+0x10/0x10
[ 112.174065] exit_to_user_mode_loop+0x8b/0x110
[ 112.174078] do_syscall_64+0x2f7/0x360
[ 112.174090] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 112.174102] RIP: 0033:0x7fc4605a1b19
[ 112.174110] Code: Unable to access opcode bytes at 0x7fc4605a1aef.
[ 112.174115] RSP: 002b:00007fc45db17218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 112.174126] RAX: 0000000000000001 RBX: 00007fc4606b4f68 RCX: 00007fc4605a1b19
[ 112.174134] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fc4606b4f6c
[ 112.174141] RBP: 00007fc4606b4f60 R08: 000000000000000e R09: 0000000000000000
[ 112.174147] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc4606b4f6c
[ 112.174154] R13: 00007ffd119ea12f R14: 00007fc45db17300 R15: 0000000000022000
[ 112.174171]
[ 112.174175] kmemleak: Object (percpu) 0x607f1a639e38 (size 8):
[ 112.174181] kmemleak: comm "syz-executor.6", pid 3981, jiffies 4294779065
[ 112.174188] kmemleak: min_count = 1
[ 112.174192] kmemleak: count = 0
[ 112.174195] kmemleak: flags = 0x21
[ 112.174199] kmemleak: checksum = 0
[ 112.174202] kmemleak: backtrace:
[ 112.174206] pcpu_alloc_noprof+0x87a/0x1170
[ 112.174220] perf_trace_event_init+0x366/0xa10
[ 112.174233] perf_trace_init+0x1a4/0x2f0
[ 112.174245] perf_tp_event_init+0xa6/0x120
[ 112.174260] perf_try_init_event+0x140/0x9f0
[ 112.174273] perf_event_alloc.part.0+0x118e/0x45f0
[ 112.174288] __do_sys_perf_event_open+0x719/0x2c20
[ 112.174301] do_syscall_64+0xbf/0x360
[ 112.174309] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 112.198682] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#1] SMP KASAN NOPTI
[ 112.199582] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[ 112.200289] CPU: 1 UID: 0 PID: 3983 Comm: syz-executor.4 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
[ 112.202423] Tainted: [W]=WARN
[ 112.203042] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 112.204661] RIP: 0010:perf_tp_event+0x175/0xe70
[ 112.205977] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 112.209199] RSP: 0018:ffff888042867600 EFLAGS: 00010212
[ 112.209631] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc9000a039000
[ 112.210207] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190
[ 112.210775] RBP: ffff888042867870 R08: ffff88806cf31340 R09: ffffe8ffffd16308
[ 112.211342] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 112.211914] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[ 112.212482] FS: 00007f1dc4c05700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
[ 112.213120] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 112.213585] CR2: 00005555810c1c18 CR3: 000000001e352000 CR4: 0000000000350ef0
[ 112.214154] Call Trace:
[ 112.214364]
[ 112.214554] ? __pfx_perf_tp_event+0x10/0x10
[ 112.214939] ? perf_trace_run_bpf_submit+0xef/0x180
[ 112.215346] perf_trace_run_bpf_submit+0xef/0x180
[ 112.215742] perf_trace_lock+0x337/0x5d0
[ 112.216092] ? __pfx_perf_trace_lock+0x10/0x10
[ 112.216473] ? lock_acquire+0x15e/0x2f0
[ 112.216797] ? futex_ref_get+0x48/0x300
[ 112.217119] ? futex_ref_get+0x114/0x300
[ 112.217443] ? futex_hash+0x15c/0x390
[ 112.217754] lock_release+0x1ab/0x290
[ 112.218064] ? futex_hash+0x15c/0x390
[ 112.218374] futex_ref_get+0x119/0x300
[ 112.218690] ? futex_hash+0x15c/0x390
[ 112.219006] futex_hash+0x70/0x390
[ 112.219299] futex_wait_setup+0xae/0x550
[ 112.219639] __futex_wait+0x151/0x300
[ 112.219960] ? __pfx___futex_wait+0x10/0x10
[ 112.220322] ? __pfx_futex_wake_mark+0x10/0x10
[ 112.220703] futex_wait+0xde/0x380
[ 112.220997] ? __pfx_futex_wait+0x10/0x10
[ 112.221335] ? perf_trace_lock+0xb5/0x5d0
[ 112.221677] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 112.222101] do_futex+0x2ee/0x370
[ 112.222387] ? __pfx_do_futex+0x10/0x10
[ 112.222712] ? do_raw_spin_lock+0x123/0x260
[ 112.223068] __x64_sys_futex+0x1c9/0x4d0
[ 112.223399] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 112.223882] ? trace_irq_enable.constprop.0+0xc2/0x100
[ 112.224305] ? __pfx___x64_sys_futex+0x10/0x10
[ 112.224676] ? kcov_ioctl+0x386/0x6c0
[ 112.224994] do_syscall_64+0xbf/0x360
[ 112.225305] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 112.225721] RIP: 0033:0x7f1dc768fb19
[ 112.226020] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 112.227461] RSP: 002b:00007f1dc4c05218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 112.228077] RAX: ffffffffffffffda RBX: 00007f1dc77a2f68 RCX: 00007f1dc768fb19
[ 112.228644] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1dc77a2f68
[ 112.229214] RBP: 00007f1dc77a2f60 R08: 00007f1dc4c05700 R09: 0000000000000000
[ 112.229784] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1dc77a2f6c
[ 112.230357] R13: 00007ffd096d826f R14: 00007f1dc4c05300 R15: 0000000000022000
[ 112.230929]
[ 112.231122] Modules linked in:
[ 112.231394] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#2] SMP KASAN NOPTI
[ 112.233120] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[ 112.234285] CPU: 0 UID: 0 PID: 3982 Comm: syz-executor.7 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
[ 112.236064] Tainted: [D]=DIE, [W]=WARN
[ 112.236654] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 112.237903] RIP: 0010:perf_tp_event+0x175/0xe70
[ 112.238659] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 112.241413] RSP: 0018:ffff888015f17780 EFLAGS: 00010012
[ 112.242224] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90007c27000
[ 112.243294] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000000000191
[ 112.244354] RBP: ffff888015f179f0 R08: ffff88806ce31340 R09: ffffe8ffffc16e38
[ 112.245382] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
[ 112.246422] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000
[ 112.247456] FS: 00007f219d922700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
[ 112.248630] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 112.249481] CR2: 0000555564473c18 CR3: 0000000041417000 CR4: 0000000000350ef0
[ 112.250521] Call Trace:
[ 112.250909]
[ 112.251259] ? __is_insn_slot_addr+0x136/0x290
[ 112.251952] ? __pfx_perf_tp_event+0x10/0x10
[ 112.252623] ? kernel_text_address+0x5b/0xc0
[ 112.253288] ? perf_trace_lock+0xb5/0x5d0
[ 112.253894] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 112.254712] ? perf_trace_lock+0xb5/0x5d0
[ 112.255342] ? perf_trace_lock+0xb5/0x5d0
[ 112.255960] ? perf_trace_lock+0xb5/0x5d0
[ 112.256587] ? perf_trace_lock+0xb5/0x5d0
[ 112.257208] ? __pfx_perf_trace_lock+0x10/0x10
[ 112.257878] ? __pfx_perf_trace_lock+0x10/0x10
[ 112.258564] ? __pfx_perf_trace_lock+0x10/0x10
[ 112.259263] ? unwind_next_frame+0x3b2/0x2540
[ 112.259955] ? css_rstat_updated+0x1b8/0x4d0
[ 112.260623] ? __pfx_css_rstat_updated+0x10/0x10
[ 112.261338] ? __pfx_perf_trace_lock+0x10/0x10
[ 112.262006] ? perf_trace_run_bpf_submit+0xef/0x180
[ 112.262747] perf_trace_run_bpf_submit+0xef/0x180
[ 112.263481] perf_trace_preemptirq_template+0x259/0x430
[ 112.264305] ? __pfx_perf_trace_lock+0x10/0x10
[ 112.264989] ? __pfx_perf_trace_lock+0x10/0x10
[ 112.265673] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 112.266545] ? check_preempt_wakeup_fair+0x406/0x950
[ 112.267308] ? try_to_wake_up+0x8ae/0x11d0
[ 112.267948] ? _raw_spin_unlock_irqrestore+0x2c/0x50
[ 112.268707] trace_irq_enable.constprop.0+0xa6/0x100
[ 112.269479] trace_hardirqs_on+0x26/0x40
[ 112.270068] _raw_spin_unlock_irqrestore+0x2c/0x50
[ 112.270797] try_to_wake_up+0x8ae/0x11d0
[ 112.271411] ? __pfx_try_to_wake_up+0x10/0x10
[ 112.272091] ? plist_del+0x122/0x270
[ 112.272659] ? futex_wake+0x474/0x540
[ 112.273244] wake_up_q+0xa1/0x130
[ 112.273776] futex_wake+0x47e/0x540
[ 112.274337] ? __pfx_futex_wake+0x10/0x10
[ 112.274945] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 112.275826] ? lock_release+0x1c7/0x290
[ 112.276434] do_futex+0x26d/0x370
[ 112.276947] ? __pfx_do_futex+0x10/0x10
[ 112.277546] ? kasan_quarantine_put+0x84/0x1e0
[ 112.278242] ? kfree+0x281/0x550
[ 112.278764] __x64_sys_futex+0x1c9/0x4d0
[ 112.279385] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 112.280283] ? __pfx___x64_sys_futex+0x10/0x10
[ 112.281029] ? xfd_validate_state+0x55/0x180
[ 112.281699] do_syscall_64+0xbf/0x360
[ 112.282267] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 112.283014] RIP: 0033:0x7f21a03acb19
[ 112.283573] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 112.286228] RSP: 002b:00007f219d922218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 112.287314] RAX: ffffffffffffffda RBX: 00007f21a04bff68 RCX: 00007f21a03acb19
[ 112.288353] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f21a04bff6c
[ 112.289394] RBP: 00007f21a04bff60 R08: 000000000000000e R09: 0000000000000000
[ 112.290430] R10: 000000001e686bb3 R11: 0000000000000246 R12: 00007f21a04bff6c
[ 112.291454] R13: 00007ffcd886d4ef R14: 00007f219d922300 R15: 0000000000022000
[ 112.292501]
[ 112.292843] Modules linked in:
[ 112.293355] ---[ end trace 0000000000000000 ]---
[ 112.293356] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#3] SMP KASAN NOPTI
[ 112.293372] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[ 112.294026] RIP: 0010:perf_tp_event+0x175/0xe70
[ 112.294876] CPU: 1 UID: 0 PID: 3983 Comm: syz-executor.4 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
[ 112.296137] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 112.296508] Tainted: [D]=DIE, [W]=WARN
[ 112.298242] RSP: 0018:ffff888042867600 EFLAGS: 00010212
[ 112.299664] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 112.300258]
[ 112.300675] RIP: 0010:perf_tp_event+0x175/0xe70
[ 112.301873] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc9000a039000
[ 112.302010] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 112.302692] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190
[ 112.303250] RSP: 0018:ffff88806cf08a80 EFLAGS: 00010012
[ 112.305921] RBP: ffff888042867870 R08: ffff88806cf31340 R09: ffffe8ffffd16308
[ 112.306483] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002
[ 112.307262] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 112.307830] RDX: ffff888019311b80 RSI: ffffffff818995b7 RDI: 0000000100000190
[ 112.308883] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[ 112.309444] RBP: ffff88806cf08cf0 R08: ffff88806cf31490 R09: ffffe8ffffd16308
[ 112.310485] FS: 00007f219d922700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
[ 112.311039] R10: 0000000000000000 R11: 746e756f63716573 R12: dffffc0000000000
[ 112.312091] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 112.312719] R13: 000000000000002c R14: ffff88806cf31490 R15: dffffc0000000000
[ 112.314008] CR2: 0000555564473c18 CR3: 0000000041417000 CR4: 0000000000350ef0
[ 112.314463] FS: 00007f1dc4c05700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
[ 112.315644] note: syz-executor.7[3982] exited with irqs disabled
[ 112.316203] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 112.316212] CR2: 00005555810c1c18 CR3: 000000001e352000 CR4: 0000000000350ef0
[ 112.318878] Call Trace:
[ 112.319091]
[ 112.319276] ? __pfx_perf_tp_event+0x10/0x10
[ 112.319639] ? perf_trace_lock+0xb5/0x5d0
[ 112.319988] ? __pfx_perf_trace_lock+0x10/0x10
[ 112.320362] ? trace_rcu_utilization+0x26/0x190
[ 112.320748] ? rcu_sched_clock_irq+0x7a0/0x2b40
[ 112.321131] ? perf_trace_lock+0xb5/0x5d0
[ 112.321476] ? __pfx_perf_trace_lock+0x10/0x10
[ 112.321852] ? lock_acquire+0x15e/0x2f0
[ 112.322184] ? perf_trace_run_bpf_submit+0xef/0x180
[ 112.322595] perf_trace_run_bpf_submit+0xef/0x180
[ 112.322990] perf_trace_lock+0x337/0x5d0
[ 112.323329] ? __pfx_perf_trace_lock+0x10/0x10
[ 112.323704] ? find_held_lock+0x2b/0x80
[ 112.324043] ? hrtimer_interrupt+0x114/0x830
[ 112.324404] lock_release+0x1ab/0x290
[ 112.324716] ktime_get_update_offsets_now+0xab/0x3c0
[ 112.325132] ? hrtimer_interrupt+0x114/0x830
[ 112.325488] ? __pfx_lapic_next_deadline+0x10/0x10
[ 112.325890] hrtimer_interrupt+0x114/0x830
[ 112.326237] __sysvec_apic_timer_interrupt+0xbb/0x330
[ 112.326656] sysvec_apic_timer_interrupt+0x6b/0x80
[ 112.327056]
[ 112.327241]
[ 112.327425] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 112.327856] RIP: 0010:oops_exit+0x0/0x50
[ 112.328190] Code: f1 39 00 be ff ff ff ff 48 c7 c7 50 ac 43 86 e8 c6 0f f9 ff 5b e9 20 f1 39 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 53 e8 06 f1 39 00 8b 1d c0 ed 4e 06 31 ff 89 de e8 27
[ 112.329642] RSP: 0018:ffff888042867490 EFLAGS: 00000202
[ 112.330068] RAX: 0000000000026378 RBX: 0000000000000216 RCX: ffffc9000a039000
[ 112.330635] RDX: 0000000000040000 RSI: ffffffff812a3dca RDI: 0000000000000007
[ 112.331209] RBP: 000000000000000b R08: 0000000000000001 R09: fffffbfff0f11c90
[ 112.331773] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888042867558
[ 112.332347] R13: 0000000000000000 R14: dffffc0020000032 R15: 0000000000000000
[ 112.332917] ? oops_end+0x4a/0xe0
[ 112.333214] oops_end+0x65/0xe0
[ 112.333491] exc_general_protection+0x1a2/0x330
[ 112.333877] asm_exc_general_protection+0x26/0x30
[ 112.334267] RIP: 0010:perf_tp_event+0x175/0xe70
[ 112.334651] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 112.336113] RSP: 0018:ffff888042867600 EFLAGS: 00010212
[ 112.336538] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc9000a039000
[ 112.337109] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190
[ 112.337679] RBP: ffff888042867870 R08: ffff88806cf31340 R09: ffffe8ffffd16308
[ 112.338250] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 112.338820] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[ 112.339397] ? perf_tp_event+0x167/0xe70
[ 112.339735] ? __pfx_perf_tp_event+0x10/0x10
[ 112.340128] ? perf_trace_run_bpf_submit+0xef/0x180
[ 112.340535] perf_trace_run_bpf_submit+0xef/0x180
[ 112.340931] perf_trace_lock+0x337/0x5d0
[ 112.341264] ? __pfx_perf_trace_lock+0x10/0x10
[ 112.341638] ? lock_acquire+0x15e/0x2f0
[ 112.341964] ? futex_ref_get+0x48/0x300
[ 112.342287] ? futex_ref_get+0x114/0x300
[ 112.342613] ? futex_hash+0x15c/0x390
[ 112.342921] lock_release+0x1ab/0x290
[ 112.343234] ? futex_hash+0x15c/0x390
[ 112.343545] futex_ref_get+0x119/0x300
[ 112.343869] ? futex_hash+0x15c/0x390
[ 112.344178] futex_hash+0x70/0x390
[ 112.344470] futex_wait_setup+0xae/0x550
[ 112.344807] __futex_wait+0x151/0x300
[ 112.345124] ? __pfx___futex_wait+0x10/0x10
[ 112.345480] ? __pfx_futex_wake_mark+0x10/0x10
[ 112.345864] futex_wait+0xde/0x380
[ 112.346159] ? __pfx_futex_wait+0x10/0x10
[ 112.346498] ? perf_trace_lock+0xb5/0x5d0
[ 112.346837] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 112.347258] do_futex+0x2ee/0x370
[ 112.347550] ? __pfx_do_futex+0x10/0x10
[ 112.347880] ? do_raw_spin_lock+0x123/0x260
[ 112.348234] __x64_sys_futex+0x1c9/0x4d0
[ 112.348567] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 112.349044] ? trace_irq_enable.constprop.0+0xc2/0x100
[ 112.349469] ? __pfx___x64_sys_futex+0x10/0x10
[ 112.349842] ? kcov_ioctl+0x386/0x6c0
[ 112.350158] do_syscall_64+0xbf/0x360
[ 112.350471] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 112.350886] RIP: 0033:0x7f1dc768fb19
[ 112.351190] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 112.352651] RSP: 002b:00007f1dc4c05218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 112.353260] RAX: ffffffffffffffda RBX: 00007f1dc77a2f68 RCX: 00007f1dc768fb19
[ 112.353827] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1dc77a2f68
[ 112.354397] RBP: 00007f1dc77a2f60 R08: 00007f1dc4c05700 R09: 0000000000000000
[ 112.354967] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1dc77a2f6c
[ 112.355533] R13: 00007ffd096d826f R14: 00007f1dc4c05300 R15: 0000000000022000
[ 112.356121]
[ 112.356310] Modules linked in:
[ 112.356575] ---[ end trace 0000000000000000 ]---
[ 112.356578] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#4] SMP KASAN NOPTI
[ 112.356950] RIP: 0010:perf_tp_event+0x175/0xe70
[ 112.358558] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[ 112.358923] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 112.360026] CPU: 0 UID: 0 PID: 3982 Comm: syz-executor.7 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
[ 112.361442] RSP: 0018:ffff888042867600 EFLAGS: 00010212
[ 112.363156] Tainted: [D]=DIE, [W]=WARN
[ 112.363562] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc9000a039000
[ 112.364132] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 112.364698] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190
[ 112.365888] RIP: 0010:perf_tp_event+0x175/0xe70
[ 112.366448] RBP: ffff888042867870 R08: ffff88806cf31340 R09: ffffe8ffffd16308
[ 112.367098] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 112.367650] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 112.370213] RSP: 0018:ffff88806ce08b80 EFLAGS: 00010012
[ 112.370767] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[ 112.370772]
[ 112.370781] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[ 112.371188] FS: 00007f1dc4c05700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
[ 112.372194] RDX: ffff8880433dd280 RSI: ffffffff818995b7 RDI: 0000000000000191
[ 112.372332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 112.373336] RBP: ffff88806ce08df0 R08: ffff88806ce313e8 R09: ffffe8ffffc16e38
[ 112.373960] CR2: 00005555810c1c18 CR3: 000000001e352000 CR4: 0000000000350ef0
[ 112.374954] R10: 0000000000000000 R11: 0000000000155cc0 R12: dffffc0000000000
[ 112.375412] Kernel panic - not syncing: Fatal exception in interrupt
[ 113.417152] Shutting down cpus with NMI
[ 113.419335] Kernel Offset: disabled
[ 113.419632] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
VM DIAGNOSIS:
08:20:27 Registers:
info registers vcpu 0
RAX=0000000000000001 RBX=0000000000000001 RCX=ffffffff84bdec0e RDX=fffffbfff0f0ec09
RSI=0000000000000004 RDI=ffffffff87876044 RBP=ffffffff87876044 RSP=ffff888015f17530
R8 =0000000000000000 R9 =fffffbfff0f0ec08 R10=ffffffff87876047 R11=202c746c75616620
R12=1ffff11002be2ea7 R13=0000000000000007 R14=fffffbfff0f0ec08 R15=ffff888015f17568
RIP=ffffffff84bdeda0 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f219d922700 00000000 00000000
GS =0000 ffff8880e55dd000 00000000 00000000
LDT=0000 fffffe1900000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=0000555564473c18 CR3=0000000041417000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007f21a04937c000007f21a04937c8
XMM02=00007f21a04937e000007f21a04937c0 XMM03=00007f21a04937c800007f21a04937c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=0000000000000030 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff828e32c5 RDI=ffffffff88724180 RBP=ffffffff88724140 RSP=ffff888042866ef0
R8 =0000000000000000 R9 =ffffed10013ab046 R10=0000000000000030 R11=0000000065646f43
R12=0000000000000030 R13=0000000000000010 R14=ffffffff88724140 R15=ffffffff828e32b0
RIP=ffffffff828e331d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f1dc4c05700 00000000 00000000
GS =0000 ffff8880e56dd000 00000000 00000000
LDT=0000 fffffe4900000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00005555810c1c18 CR3=000000001e352000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007f1dc77767c000007f1dc77767c8
XMM02=00007f1dc77767e000007f1dc77767c0 XMM03=00007f1dc77767c800007f1dc77767c0
XMM04=018e845278e7896a8720d992c7b3c16b XMM05=10830b6e908419ca101bb9c0bb529b89
XMM06=14337ffb26ec1ca201992195427a61a6 XMM07=4be4330749a9fd37b83dd1847e07f9a1
XMM08=8b7f00187d3183d61ead0f74f5705b97 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000