Warning: Permanently added '[localhost]:64492' (ECDSA) to the list of known hosts. 2025/08/29 08:21:38 fuzzer started 2025/08/29 08:21:38 dialing manager at localhost:43077 syzkaller login: [ 58.521132] cgroup: Unknown subsys name 'net' [ 58.592941] cgroup: Unknown subsys name 'cpuset' [ 58.609264] cgroup: Unknown subsys name 'rlimit' 2025/08/29 08:21:49 syscalls: 2214 2025/08/29 08:21:49 code coverage: enabled 2025/08/29 08:21:49 comparison tracing: enabled 2025/08/29 08:21:49 extra coverage: enabled 2025/08/29 08:21:49 setuid sandbox: enabled 2025/08/29 08:21:49 namespace sandbox: enabled 2025/08/29 08:21:49 Android sandbox: enabled 2025/08/29 08:21:49 fault injection: enabled 2025/08/29 08:21:49 leak checking: enabled 2025/08/29 08:21:49 net packet injection: enabled 2025/08/29 08:21:49 net device setup: enabled 2025/08/29 08:21:49 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/08/29 08:21:49 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/08/29 08:21:49 USB emulation: enabled 2025/08/29 08:21:49 hci packet injection: enabled 2025/08/29 08:21:49 wifi device emulation: enabled 2025/08/29 08:21:49 802.15.4 emulation: enabled 2025/08/29 08:21:49 fetching corpus: 0, signal 0/2000 (executing program) 2025/08/29 08:21:49 fetching corpus: 50, signal 27811/30563 (executing program) 2025/08/29 08:21:49 fetching corpus: 100, signal 37132/40669 (executing program) 2025/08/29 08:21:49 fetching corpus: 150, signal 45800/49726 (executing program) 2025/08/29 08:21:49 fetching corpus: 200, signal 50484/54856 (executing program) 2025/08/29 08:21:49 fetching corpus: 250, signal 57406/61691 (executing program) 2025/08/29 08:21:49 fetching corpus: 300, signal 62394/66543 (executing program) 2025/08/29 08:21:50 fetching corpus: 350, signal 66345/70382 (executing program) 2025/08/29 08:21:50 fetching corpus: 400, signal 69991/73787 (executing program) 2025/08/29 08:21:50 fetching corpus: 450, signal 72859/76424 (executing program) 2025/08/29 08:21:50 fetching corpus: 500, signal 76044/79379 (executing program) 2025/08/29 08:21:50 fetching corpus: 550, signal 78845/81699 (executing program) 2025/08/29 08:21:50 fetching corpus: 600, signal 80811/83288 (executing program) 2025/08/29 08:21:51 fetching corpus: 650, signal 82496/84678 (executing program) 2025/08/29 08:21:51 fetching corpus: 700, signal 84074/85880 (executing program) 2025/08/29 08:21:51 fetching corpus: 750, signal 85277/86751 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/86997 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/87085 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/87180 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/87264 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/87367 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/87445 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/87525 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/87624 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/87711 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/87791 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/87879 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/87972 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/88055 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/88142 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/88231 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/88308 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/88403 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/88482 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/88568 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/88656 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/88747 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/88842 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/88934 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/89020 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/89105 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/89183 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/89264 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/89285 (executing program) 2025/08/29 08:21:51 fetching corpus: 760, signal 85471/89285 (executing program) 2025/08/29 08:21:53 starting 8 fuzzer processes 08:21:53 executing program 0: r0 = syz_mount_image$tmpfs(&(0x7f00000005c0), &(0x7f0000000600)='./file1\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000003c00)={[{@mpol={'mpol', 0x3d, {'prefer', '', @void}}}]}) mknodat$loop(r0, &(0x7f0000000000)='./file1\x00', 0x0, 0x1) 08:21:53 executing program 1: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000040)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x40}, [{}], "", ['\x00']}, 0x178) creat(&(0x7f0000000540)='./file0\x00', 0x42) 08:21:54 executing program 5: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) set_mempolicy(0x5, &(0x7f0000000040)=0x40205, 0x6) 08:21:54 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000740)={0xa, 0x4e23, 0x0, @empty}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000340)='\'', 0x1}], 0x1}}], 0x1, 0x1) poll(&(0x7f00000000c0)=[{r0}, {}], 0x2, 0x0) 08:21:54 executing program 3: creat(&(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000080)={0x0, 0xfffffffffffffff7, 0x10000}) 08:21:54 executing program 4: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000140), 0x1, 0x0) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000080)) close_range(r0, 0xffffffffffffffff, 0x0) [ 73.818301] audit: type=1400 audit(1756455714.120:7): avc: denied { execmem } for pid=274 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 08:21:54 executing program 7: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_buf(r0, 0x29, 0x35, 0x0, 0x0) 08:21:54 executing program 6: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = inotify_init() r1 = inotify_add_watch(r0, &(0x7f0000000000)='.\x00', 0xd4000a8b) inotify_rm_watch(r0, r1) lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', 0x0, 0x0, 0x0) [ 75.010711] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 75.014046] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 75.016469] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 75.018558] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 75.020759] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 75.022523] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 75.031279] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 75.033392] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 75.038037] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 75.041330] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 75.146568] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 75.151739] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 75.153464] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 75.158779] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 75.163668] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 75.210884] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 75.215722] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 75.217491] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 75.219533] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 75.222526] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 75.231146] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 75.236163] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 75.255615] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 75.262125] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 75.282226] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 75.330875] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 75.331091] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 75.342799] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 75.346542] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 75.347612] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 75.350264] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 75.352318] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 75.360808] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 75.370224] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 75.382753] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 75.387284] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 75.388461] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 75.391621] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 75.397603] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 75.402225] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 77.100403] Bluetooth: hci1: command tx timeout [ 77.101017] Bluetooth: hci0: command tx timeout [ 77.228967] Bluetooth: hci2: command tx timeout [ 77.292953] Bluetooth: hci3: command tx timeout [ 77.357012] Bluetooth: hci4: command tx timeout [ 77.485170] Bluetooth: hci7: command tx timeout [ 77.485736] Bluetooth: hci5: command tx timeout [ 77.548977] Bluetooth: hci6: command tx timeout [ 79.148969] Bluetooth: hci1: command tx timeout [ 79.149422] Bluetooth: hci0: command tx timeout [ 79.277003] Bluetooth: hci2: command tx timeout [ 79.341161] Bluetooth: hci3: command tx timeout [ 79.405340] Bluetooth: hci4: command tx timeout [ 79.533158] Bluetooth: hci7: command tx timeout [ 79.533574] Bluetooth: hci5: command tx timeout [ 79.597313] Bluetooth: hci6: command tx timeout [ 81.197071] Bluetooth: hci0: command tx timeout [ 81.197521] Bluetooth: hci1: command tx timeout [ 81.324984] Bluetooth: hci2: command tx timeout [ 81.390039] Bluetooth: hci3: command tx timeout [ 81.452987] Bluetooth: hci4: command tx timeout [ 81.581099] Bluetooth: hci7: command tx timeout [ 81.581519] Bluetooth: hci5: command tx timeout [ 81.645359] Bluetooth: hci6: command tx timeout [ 83.245015] Bluetooth: hci1: command tx timeout [ 83.245475] Bluetooth: hci0: command tx timeout [ 83.374946] Bluetooth: hci2: command tx timeout [ 83.437556] Bluetooth: hci3: command tx timeout [ 83.500949] Bluetooth: hci4: command tx timeout [ 83.628965] Bluetooth: hci7: command tx timeout [ 83.629399] Bluetooth: hci5: command tx timeout [ 83.692980] Bluetooth: hci6: command tx timeout [ 111.886308] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.886990] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.058748] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.059495] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.424423] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.425059] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.493926] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list 08:22:32 executing program 7: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_buf(r0, 0x29, 0x35, 0x0, 0x0) [ 112.573248] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.573838] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:22:32 executing program 7: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_buf(r0, 0x29, 0x35, 0x0, 0x0) 08:22:33 executing program 7: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_buf(r0, 0x29, 0x35, 0x0, 0x0) [ 112.715957] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.716506] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.828298] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.828869] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:22:33 executing program 7: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = timerfd_create(0x0, 0x0) ppoll(&(0x7f0000000100)=[{r0, 0x3742}], 0x1, 0x0, 0x0, 0x0) [ 112.897349] audit: type=1400 audit(1756455753.198:8): avc: denied { open } for pid=3817 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 112.905061] audit: type=1400 audit(1756455753.199:9): avc: denied { kernel } for pid=3817 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 112.997680] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.998634] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:22:33 executing program 4: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000140), 0x1, 0x0) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000080)) close_range(r0, 0xffffffffffffffff, 0x0) [ 113.132237] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.132873] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:22:33 executing program 3: creat(&(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000080)={0x0, 0xfffffffffffffff7, 0x10000}) 08:22:33 executing program 4: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000140), 0x1, 0x0) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000080)) close_range(r0, 0xffffffffffffffff, 0x0) 08:22:33 executing program 3: creat(&(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000080)={0x0, 0xfffffffffffffff7, 0x10000}) [ 113.229155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.229706] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.377971] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.378573] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.953397] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.954298] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.018286] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.018953] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.037420] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.038065] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.098300] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.098922] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.111177] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.111773] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.139567] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.140167] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.285039] audit: type=1400 audit(1756455754.581:10): avc: denied { watch_reads } for pid=3911 comm="syz-executor.6" path="/syzkaller-testdir861844259/syzkaller.j0mI3t/0" dev="sda" ino=15972 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=1 08:22:34 executing program 3: creat(&(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000080)={0x0, 0xfffffffffffffff7, 0x10000}) 08:22:34 executing program 6: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = inotify_init() r1 = inotify_add_watch(r0, &(0x7f0000000000)='.\x00', 0xd4000a8b) inotify_rm_watch(r0, r1) lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', 0x0, 0x0, 0x0) 08:22:34 executing program 5: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) set_mempolicy(0x5, &(0x7f0000000040)=0x40205, 0x6) 08:22:34 executing program 1: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000040)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x40}, [{}], "", ['\x00']}, 0x178) creat(&(0x7f0000000540)='./file0\x00', 0x42) 08:22:34 executing program 4: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000140), 0x1, 0x0) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000080)) close_range(r0, 0xffffffffffffffff, 0x0) 08:22:34 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000740)={0xa, 0x4e23, 0x0, @empty}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000340)='\'', 0x1}], 0x1}}], 0x1, 0x1) poll(&(0x7f00000000c0)=[{r0}, {}], 0x2, 0x0) 08:22:34 executing program 7: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = timerfd_create(0x0, 0x0) ppoll(&(0x7f0000000100)=[{r0, 0x3742}], 0x1, 0x0, 0x0, 0x0) 08:22:34 executing program 0: r0 = syz_mount_image$tmpfs(&(0x7f00000005c0), &(0x7f0000000600)='./file1\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000003c00)={[{@mpol={'mpol', 0x3d, {'prefer', '', @void}}}]}) mknodat$loop(r0, &(0x7f0000000000)='./file1\x00', 0x0, 0x1) [ 114.431381] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#1] SMP KASAN NOPTI [ 114.432297] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] [ 114.432911] CPU: 0 UID: 0 PID: 3925 Comm: syz-executor.5 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 114.436122] Tainted: [W]=WARN [ 114.437796] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 114.438454] RIP: 0010:perf_tp_event+0x175/0xe70 [ 114.438843] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 114.440278] RSP: 0018:ffff888043b5f780 EFLAGS: 00010012 [ 114.440710] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90004c1b000 [ 114.441277] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000000000191 [ 114.441844] RBP: ffff888043b5f9f0 R08: ffff88806ce31340 R09: ffffe8ffffc07620 [ 114.442408] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 114.442970] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 [ 114.443534] FS: 00007f1b12d73700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 114.444169] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 114.444638] CR2: 0000001b2d327000 CR3: 000000001edba000 CR4: 0000000000350ef0 [ 114.445205] Call Trace: [ 114.445415] [ 114.445606] ? merge_sched_in+0xcb/0x1810 [ 114.445942] ? __pfx_perf_tp_event+0x10/0x10 [ 114.446302] ? __asan_memcpy+0x3d/0x60 [ 114.446622] ? __pfx_visit_groups_merge.constprop.0.isra.0+0x10/0x10 [ 114.447130] ? lock_is_held_type+0x9e/0x120 [ 114.447483] ? perf_trace_lock+0xb5/0x5d0 [ 114.447822] ? css_rstat_updated+0x1b8/0x4d0 [ 114.448185] ? __pfx_css_rstat_updated+0x10/0x10 [ 114.448571] ? lock_is_held_type+0x9e/0x120 [ 114.448930] ? trace_pelt_se_tp+0xdf/0x130 [ 114.449271] ? perf_trace_run_bpf_submit+0xef/0x180 [ 114.449673] ? lock_is_held_type+0x9e/0x120 [ 114.450026] perf_trace_run_bpf_submit+0xef/0x180 [ 114.450420] perf_trace_preemptirq_template+0x259/0x430 [ 114.450856] ? __pfx_perf_trace_lock+0x10/0x10 [ 114.451222] ? __pfx_perf_trace_lock+0x10/0x10 [ 114.451596] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 114.452069] ? check_preempt_wakeup_fair+0x406/0x950 [ 114.452475] ? find_held_lock+0x2b/0x80 [ 114.452808] ? try_to_wake_up+0x8ae/0x11d0 [ 114.453155] ? _raw_spin_unlock_irqrestore+0x2c/0x50 [ 114.453566] trace_irq_enable.constprop.0+0xa6/0x100 [ 114.453970] trace_hardirqs_on+0x26/0x40 [ 114.454293] _raw_spin_unlock_irqrestore+0x2c/0x50 [ 114.454688] try_to_wake_up+0x8ae/0x11d0 [ 114.455023] ? __pfx_try_to_wake_up+0x10/0x10 [ 114.455386] ? plist_del+0x122/0x270 [ 114.455693] ? find_held_lock+0x2b/0x80 [ 114.456018] ? futex_wake+0x474/0x540 [ 114.456336] wake_up_q+0xa1/0x130 [ 114.456632] futex_wake+0x47e/0x540 [ 114.456932] ? __pfx_futex_wake+0x10/0x10 [ 114.457266] ? __do_sys_perf_event_open+0x44d/0x2c20 [ 114.457672] ? lock_release+0xc8/0x290 [ 114.457990] do_futex+0x26d/0x370 [ 114.458276] ? __pfx_do_futex+0x10/0x10 [ 114.458601] ? perf_trace_run_bpf_submit+0xef/0x180 [ 114.459007] __x64_sys_futex+0x1c9/0x4d0 [ 114.459336] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 114.459809] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 114.460280] ? __pfx___x64_sys_futex+0x10/0x10 [ 114.460660] do_syscall_64+0xbf/0x360 [ 114.460969] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.461379] RIP: 0033:0x7f1b157fdb19 [ 114.461678] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 114.463112] RSP: 002b:00007f1b12d73218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 114.463713] RAX: ffffffffffffffda RBX: 00007f1b15910f68 RCX: 00007f1b157fdb19 [ 114.464273] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1b15910f6c [ 114.464845] RBP: 00007f1b15910f60 R08: 000000000000000e R09: 0000000000000000 [ 114.465409] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f1b15910f6c [ 114.465973] R13: 00007ffdead4eb9f R14: 00007f1b12d73300 R15: 0000000000022000 [ 114.466542] [ 114.466731] Modules linked in: [ 114.466994] ---[ end trace 0000000000000000 ]--- [ 114.466997] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#2] SMP KASAN NOPTI [ 114.467362] RIP: 0010:perf_tp_event+0x175/0xe70 [ 114.468191] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197] [ 114.468552] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 114.469195] CPU: 1 UID: 0 PID: 3930 Comm: syz-executor.6 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 114.470609] RSP: 0018:ffff888043b5f780 EFLAGS: 00010012 [ 114.471506] Tainted: [D]=DIE, [W]=WARN [ 114.471918] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90004c1b000 [ 114.472212] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 114.472774] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000000000191 [ 114.473398] RIP: 0010:perf_tp_event+0x175/0xe70 [ 114.473951] RBP: ffff888043b5f9f0 R08: ffff88806ce31340 R09: ffffe8ffffc07620 [ 114.474307] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 114.474858] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 114.476234] RSP: 0018:ffff88800a49f780 EFLAGS: 00010012 [ 114.476789] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 [ 114.476802] FS: 00007f1b12d73700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 114.477195] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc90007c33000 [ 114.477749] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 114.478355] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 114.478907] CR2: 0000001b2d327000 CR3: 000000001edba000 CR4: 0000000000350ef0 [ 114.479343] RBP: ffff88800a49f9f0 R08: ffff88806cf31340 R09: ffffe8ffffd07620 [ 114.479898] note: syz-executor.5[3925] exited with irqs disabled [ 114.480433] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 [ 114.481987] R13: 0000000000000014 R14: ffff88806cf31340 R15: dffffc0000000000 [ 114.482536] FS: 00007f7d206e3700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000 [ 114.483149] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 114.483595] CR2: 00007f7d23281018 CR3: 0000000042870000 CR4: 0000000000350ef0 [ 114.484143] Call Trace: [ 114.484347] [ 114.484528] ? perf_trace_lock+0xb5/0x5d0 [ 114.484864] ? __pfx_perf_tp_event+0x10/0x10 [ 114.485216] ? visit_groups_merge.constprop.0.isra.0+0x6e7/0x1150 [ 114.485694] ? lock_release+0x1c7/0x290 [ 114.486008] ? __pfx_visit_groups_merge.constprop.0.isra.0+0x10/0x10 [ 114.486502] ? kvm_sched_clock_read+0x16/0x30 [ 114.486858] ? local_clock_noinstr+0xf/0xc0 [ 114.487199] ? perf_trace_lock+0xb5/0x5d0 [ 114.487524] ? perf_trace_lock+0xb5/0x5d0 [ 114.487850] ? __pfx_perf_trace_lock+0x10/0x10 [ 114.488208] ? __pfx_perf_trace_lock+0x10/0x10 [ 114.488572] ? perf_trace_run_bpf_submit+0xef/0x180 [ 114.488973] ? lock_release+0x1c7/0x290 [ 114.489288] perf_trace_run_bpf_submit+0xef/0x180 [ 114.489671] perf_trace_preemptirq_template+0x259/0x430 [ 114.490095] ? __pfx_perf_trace_lock+0x10/0x10 [ 114.490452] ? __pfx_perf_trace_lock+0x10/0x10 [ 114.490810] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 114.491270] ? __pfx___resched_curr+0x10/0x10 [ 114.491628] ? try_to_wake_up+0x8ae/0x11d0 [ 114.491963] ? _raw_spin_unlock_irqrestore+0x2c/0x50 [ 114.492360] trace_irq_enable.constprop.0+0xa6/0x100 [ 114.492759] trace_hardirqs_on+0x26/0x40 [ 114.493093] _raw_spin_unlock_irqrestore+0x2c/0x50 [ 114.493486] try_to_wake_up+0x8ae/0x11d0 [ 114.493810] ? __pfx_try_to_wake_up+0x10/0x10 [ 114.494172] ? plist_del+0x122/0x270 [ 114.494470] ? futex_wake+0x474/0x540 [ 114.494776] wake_up_q+0xa1/0x130 [ 114.495057] futex_wake+0x47e/0x540 [ 114.495349] ? __pfx_futex_wake+0x10/0x10 [ 114.495678] ? lock_release+0x1c7/0x290 [ 114.495989] ? fd_install+0x1f0/0x660 [ 114.496291] do_futex+0x26d/0x370 [ 114.496569] ? __pfx_do_futex+0x10/0x10 [ 114.496901] ? __pfx___do_sys_perf_event_open+0x10/0x10 [ 114.497315] ? handle_mm_fault+0x590/0x9b0 [ 114.497652] __x64_sys_futex+0x1c9/0x4d0 [ 114.497972] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 114.498431] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 114.498890] ? __pfx___x64_sys_futex+0x10/0x10 [ 114.499252] do_syscall_64+0xbf/0x360 [ 114.499550] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.499951] RIP: 0033:0x7f7d2316db19 [ 114.500243] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 114.501632] RSP: 002b:00007f7d206e3218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 114.502213] RAX: ffffffffffffffda RBX: 00007f7d23280f68 RCX: 00007f7d2316db19 [ 114.502759] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f7d23280f6c [ 114.503304] RBP: 00007f7d23280f60 R08: 000000000000000e R09: 0000000000000000 [ 114.503847] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f7d23280f6c [ 114.504394] R13: 00007ffd39da643f R14: 00007f7d206e3300 R15: 0000000000022000 [ 114.504948] [ 114.505134] Modules linked in: [ 114.505389] ---[ end trace 0000000000000000 ]--- [ 114.505390] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#3] SMP KASAN NOPTI [ 114.505752] RIP: 0010:perf_tp_event+0x175/0xe70 [ 114.506606] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] [ 114.506959] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 114.507544] CPU: 0 UID: 0 PID: 3925 Comm: syz-executor.5 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 114.508914] RSP: 0018:ffff888043b5f780 EFLAGS: 00010012 [ 114.509827] Tainted: [D]=DIE, [W]=WARN [ 114.510229] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90004c1b000 [ 114.510530] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 114.511069] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000000000191 [ 114.511703] RIP: 0010:perf_tp_event+0x175/0xe70 [ 114.512245] RBP: ffff888043b5f9f0 R08: ffff88806ce31340 R09: ffffe8ffffc07620 [ 114.512611] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 114.513157] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 114.514561] RSP: 0018:ffff88806ce08b80 EFLAGS: 00010012 [ 114.515100] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 [ 114.515511] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002 [ 114.516052] FS: 00007f7d206e3700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000 [ 114.516605] RDX: ffff8880165e0000 RSI: ffffffff818995b7 RDI: 0000000000000191 [ 114.517210] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 114.517761] RBP: ffff88806ce08df0 R08: ffff88806ce313e8 R09: ffffe8ffffc07620 [ 114.518203] CR2: 00007f7d23281018 CR3: 0000000042870000 CR4: 0000000000350ef0 [ 114.518753] R10: 0000000000000000 R11: ffff88801b60dc98 R12: dffffc0000000000 [ 114.519294] note: syz-executor.6[3930] exited with irqs disabled [ 114.519845] R13: 0000000000000014 R14: ffff88806ce313e8 R15: dffffc0000000000 [ 114.520864] FS: 00007f1b12d73700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 114.521496] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 114.521953] CR2: 0000001b2d327000 CR3: 000000001edba000 CR4: 0000000000350ef0 [ 114.522514] Call Trace: [ 114.522721] [ 114.522901] ? css_rstat_updated+0x1b8/0x4d0 [ 114.523261] ? __pfx_perf_tp_event+0x10/0x10 [ 114.523616] ? trace_pelt_se_tp+0xdf/0x130 [ 114.523950] ? __pfx_perf_trace_lock+0x10/0x10 [ 114.524317] ? __pfx_perf_trace_lock+0x10/0x10 [ 114.524693] ? __cgroup_account_cputime+0x31/0xc0 [ 114.525083] ? do_raw_spin_lock+0x123/0x260 [ 114.525432] ? try_to_wake_up+0x128/0x11d0 [ 114.525775] ? lock_release+0x1c7/0x290 [ 114.526095] ? do_raw_spin_unlock+0x53/0x220 [ 114.526454] ? _raw_spin_unlock_irqrestore+0x22/0x50 [ 114.526858] ? try_to_wake_up+0x128/0x11d0 [ 114.527198] ? perf_trace_lock+0xb5/0x5d0 [ 114.527533] ? do_raw_spin_lock+0x123/0x260 [ 114.527880] ? __pfx_perf_trace_lock+0x10/0x10 [ 114.528248] ? perf_trace_run_bpf_submit+0xef/0x180 [ 114.528655] perf_trace_run_bpf_submit+0xef/0x180 [ 114.529044] perf_trace_preemptirq_template+0x259/0x430 [ 114.529471] ? read_tsc+0x9/0x20 [ 114.529754] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 114.530228] ? clockevents_program_event+0x135/0x360 [ 114.530637] ? tick_program_event+0xac/0x140 [ 114.530991] ? handle_softirqs+0x16e/0x770 [ 114.531337] trace_irq_enable.constprop.0+0xa6/0x100 [ 114.531739] trace_hardirqs_on+0x26/0x40 [ 114.532061] handle_softirqs+0x16e/0x770 [ 114.532397] __irq_exit_rcu+0xc4/0x100 [ 114.532722] irq_exit_rcu+0x9/0x20 [ 114.533010] sysvec_apic_timer_interrupt+0x70/0x80 [ 114.533410] [ 114.533592] [ 114.533774] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 114.534190] RIP: 0010:make_task_dead+0xa2/0x3b0 [ 114.534569] Code: 38 00 85 db 0f 84 21 01 00 00 e8 d9 96 38 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 27 92 38 00 48 85 db 0f 84 17 01 00 00 b9 96 38 00 31 ff 65 8b 1d 60 df 48 06 81 e3 ff ff ff 7f 89 de [ 114.535984] RSP: 0018:ffff888043b5ff28 EFLAGS: 00000246 [ 114.536402] RAX: 0000000000000001 RBX: ffff8880165e0000 RCX: ffffffff817c2b86 [ 114.536965] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff813b5234 [ 114.537522] RBP: 000000000000000b R08: 0000000000000000 R09: 0000000000000000 [ 114.538080] R10: ffffffff8643ac57 R11: 3838666666662052 R12: ffff8880165e0000 [ 114.538637] R13: 0000000000000000 R14: dffffc0000000032 R15: 0000000000000000 [ 114.539198] ? trace_irq_enable.constprop.0+0x26/0x100 [ 114.539612] ? make_task_dead+0x214/0x3b0 [ 114.539946] ? make_task_dead+0x214/0x3b0 [ 114.540276] ? do_syscall_64+0xbf/0x360 [ 114.540604] rewind_stack_and_make_dead+0x16/0x20 [ 114.540992] RIP: 0033:0x7f1b157fdb19 [ 114.541289] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 114.542710] RSP: 002b:00007f1b12d73218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 114.543302] RAX: ffffffffffffffda RBX: 00007f1b15910f68 RCX: 00007f1b157fdb19 [ 114.543859] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1b15910f6c [ 114.544416] RBP: 00007f1b15910f60 R08: 000000000000000e R09: 0000000000000000 [ 114.544983] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f1b15910f6c [ 114.545542] R13: 00007ffdead4eb9f R14: 00007f1b12d73300 R15: 0000000000022000 [ 114.546110] [ 114.546299] Modules linked in: [ 114.546558] ---[ end trace 0000000000000000 ]--- [ 114.546559] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#4] SMP KASAN NOPTI [ 114.546927] RIP: 0010:perf_tp_event+0x175/0xe70 [ 114.547773] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197] [ 114.548142] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 114.548805] CPU: 1 UID: 0 PID: 3930 Comm: syz-executor.6 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 114.550210] RSP: 0018:ffff888043b5f780 EFLAGS: 00010012 [ 114.551114] Tainted: [D]=DIE, [W]=WARN [ 114.551528] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: ffffc90004c1b000 [ 114.551823] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 114.552379] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000000000191 [ 114.553007] RIP: 0010:perf_tp_event+0x175/0xe70 [ 114.553556] RBP: ffff888043b5f9f0 R08: ffff88806ce31340 R09: ffffe8ffffc07620 [ 114.553909] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 114.554459] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 114.555829] RSP: 0018:ffff88806cf08b80 EFLAGS: 00010012 [ 114.556390] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 [ 114.556812] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002 [ 114.557380] FS: 00007f1b12d73700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 114.557934] RDX: ffff888017108000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 114.558569] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 114.559123] RBP: ffff88806cf08df0 R08: ffff88806cf313e8 R09: ffffe8ffffd07620 [ 114.559589] CR2: 0000001b2d327000 CR3: 000000001edba000 CR4: 0000000000350ef0 [ 114.560147] R10: 0000000000000000 R11: ffff888018123898 R12: dffffc0000000000 [ 114.560720] Kernel panic - not syncing: Fatal exception in interrupt [ 115.607374] Shutting down cpus with NMI [ 115.608356] Kernel Offset: disabled [ 115.608655] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- VM DIAGNOSIS: 08:22:34 Registers: info registers vcpu 0 RAX=000000000000006c RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff828e32c5 RDI=ffffffff88724180 RBP=ffffffff88724140 RSP=ffff888043b5f0e0 R8 =0000000000000000 R9 =ffffed100164b046 R10=000000000000006c R11=552030203a555043 R12=000000000000006c R13=0000000000000010 R14=ffffffff88724140 R15=ffffffff828e32b0 RIP=ffffffff828e331d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f1b12d73700 00000000 00000000 GS =0000 ffff8880e55dd000 00000000 00000000 LDT=0000 fffffe0e00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000001b2d327000 CR3=000000001edba000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f1b158e47c000007f1b158e47c8 XMM02=00007f1b158e47e000007f1b158e47c0 XMM03=00007f1b158e47c800007f1b158e47c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=dffffc0000000000 RBX=ffff888015fdd280 RCX=000000000000000d RDX=0000000000000000 RSI=ffffffff81b5d6d1 RDI=ffff888015fdd67c RBP=ffff888015fdd280 RSP=ffff888017e7f940 R8 =ffffffff84c93ca0 R9 =ffff888017e7fa08 R10=000000000003be53 R11=000000000002f643 R12=0000000000000000 R13=ffff888017e7fa10 R14=ffff888015fdd280 R15=ffff888017e7f9c8 RIP=ffffffff815af927 RFL=00000217 [----APC] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f0dc18cb8c0 00000000 00000000 GS =0000 ffff8880e56dd000 00000000 00000000 LDT=0000 fffffe5000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000001b2ce24000 CR3=000000000cf07000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c XMM01=00000000ff0000000000000000000000 XMM02=00000000ff0000000000000000000000 XMM03=7269762f736563697665642f7379732f XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=000055816e3a8e80000055816e3c52d0 XMM06=000055816e39a0800000000300000002 XMM07=00000000000000000000000000000000 XMM08=703e2d73004c414954494e495f544e45 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000