Warning: Permanently added '[localhost]:40430' (ECDSA) to the list of known hosts. 2025/08/29 08:21:53 fuzzer started 2025/08/29 08:21:53 dialing manager at localhost:43077 syzkaller login: [ 51.731621] cgroup: Unknown subsys name 'net' [ 51.804793] cgroup: Unknown subsys name 'cpuset' [ 51.819507] cgroup: Unknown subsys name 'rlimit' 2025/08/29 08:22:03 syscalls: 2214 2025/08/29 08:22:03 code coverage: enabled 2025/08/29 08:22:03 comparison tracing: enabled 2025/08/29 08:22:03 extra coverage: enabled 2025/08/29 08:22:03 setuid sandbox: enabled 2025/08/29 08:22:03 namespace sandbox: enabled 2025/08/29 08:22:03 Android sandbox: enabled 2025/08/29 08:22:03 fault injection: enabled 2025/08/29 08:22:03 leak checking: enabled 2025/08/29 08:22:03 net packet injection: enabled 2025/08/29 08:22:03 net device setup: enabled 2025/08/29 08:22:03 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/08/29 08:22:03 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/08/29 08:22:03 USB emulation: enabled 2025/08/29 08:22:03 hci packet injection: enabled 2025/08/29 08:22:03 wifi device emulation: enabled 2025/08/29 08:22:03 802.15.4 emulation: enabled 2025/08/29 08:22:03 fetching corpus: 0, signal 0/2000 (executing program) 2025/08/29 08:22:04 fetching corpus: 50, signal 27560/30272 (executing program) 2025/08/29 08:22:04 fetching corpus: 100, signal 39140/42374 (executing program) 2025/08/29 08:22:04 fetching corpus: 150, signal 45575/49308 (executing program) 2025/08/29 08:22:04 fetching corpus: 200, signal 51965/56047 (executing program) 2025/08/29 08:22:04 fetching corpus: 250, signal 56716/61019 (executing program) 2025/08/29 08:22:04 fetching corpus: 300, signal 60142/64633 (executing program) 2025/08/29 08:22:04 fetching corpus: 350, signal 62417/67202 (executing program) 2025/08/29 08:22:05 fetching corpus: 400, signal 66480/71078 (executing program) 2025/08/29 08:22:05 fetching corpus: 450, signal 68200/72911 (executing program) 2025/08/29 08:22:05 fetching corpus: 500, signal 70154/74892 (executing program) 2025/08/29 08:22:05 fetching corpus: 550, signal 72608/77181 (executing program) 2025/08/29 08:22:05 fetching corpus: 600, signal 76784/80490 (executing program) 2025/08/29 08:22:05 fetching corpus: 650, signal 79142/82378 (executing program) 2025/08/29 08:22:05 fetching corpus: 700, signal 82333/84721 (executing program) 2025/08/29 08:22:05 fetching corpus: 750, signal 85166/86641 (executing program) 2025/08/29 08:22:05 fetching corpus: 760, signal 85471/86921 (executing program) 2025/08/29 08:22:05 fetching corpus: 760, signal 85471/87012 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/87102 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/87178 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/87269 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/87354 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/87436 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/87527 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/87613 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/87686 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/87783 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/87857 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/87954 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/88068 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/88152 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/88243 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/88338 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/88421 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/88511 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/88617 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/88709 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/88803 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/88888 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/88973 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/89069 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/89148 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/89250 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/89285 (executing program) 2025/08/29 08:22:06 fetching corpus: 760, signal 85471/89285 (executing program) 2025/08/29 08:22:08 starting 8 fuzzer processes 08:22:08 executing program 0: ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000100)={{{@in=@multicast1, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000200)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x7, &(0x7f0000000240)={@empty, @local, r1}, 0xc) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='net/sockstat\x00') r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000000)={r3, 0x1, 0x6, @link_local}, 0x10) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000100)={r6, 0x1, 0x6, @multicast}, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000002c0)={'wg1\x00', 0x0}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x54, 0x0, 0x200, 0x6, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7f}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r1}]}]}, 0x54}, 0x1, 0x0, 0x0, 0xc4}, 0x8845) 08:22:08 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x25}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x30}}, 0x0) 08:22:08 executing program 6: setreuid(0x0, 0xee00) setresuid(0x0, 0x0, 0xee01) 08:22:08 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x4840, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 08:22:08 executing program 7: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x0) 08:22:08 executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_buf(r0, 0x107, 0xb, &(0x7f00000000c0)=""/97, &(0x7f0000000140)=0x4) 08:22:08 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000140)=0x40) [ 66.799207] audit: type=1400 audit(1756455728.579:7): avc: denied { execmem } for pid=273 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 08:22:08 executing program 5: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_VOICE(r0, 0x112, 0xf, 0x0, &(0x7f0000000080)) [ 68.133492] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 68.137376] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 68.139963] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 68.142993] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 68.152992] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 68.168215] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 68.169785] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 68.171113] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 68.174921] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 68.176105] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 68.178112] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 68.180020] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 68.182232] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 68.183554] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 68.187409] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 68.190041] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 68.192069] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 68.193432] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 68.196273] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 68.198878] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 68.202087] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 68.203817] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 68.205131] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 68.205868] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 68.207488] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 68.211613] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 68.213868] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 68.214708] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 68.215102] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 68.217985] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 68.219165] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 68.231144] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 68.233527] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 68.238930] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 68.248778] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 68.252430] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 68.260857] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 68.267799] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 68.270912] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 68.286648] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 70.274229] Bluetooth: hci7: command tx timeout [ 70.274916] Bluetooth: hci5: command tx timeout [ 70.275095] Bluetooth: hci0: command tx timeout [ 70.336685] Bluetooth: hci4: command tx timeout [ 70.336710] Bluetooth: hci3: command tx timeout [ 70.337630] Bluetooth: hci6: command tx timeout [ 70.338289] Bluetooth: hci2: command tx timeout [ 70.400663] Bluetooth: hci1: command tx timeout [ 72.320870] Bluetooth: hci0: command tx timeout [ 72.321340] Bluetooth: hci7: command tx timeout [ 72.321391] Bluetooth: hci5: command tx timeout [ 72.384660] Bluetooth: hci3: command tx timeout [ 72.384695] Bluetooth: hci2: command tx timeout [ 72.385122] Bluetooth: hci6: command tx timeout [ 72.385527] Bluetooth: hci4: command tx timeout [ 72.448790] Bluetooth: hci1: command tx timeout [ 74.368669] Bluetooth: hci7: command tx timeout [ 74.370600] Bluetooth: hci5: command tx timeout [ 74.370995] Bluetooth: hci0: command tx timeout [ 74.434589] Bluetooth: hci6: command tx timeout [ 74.435027] Bluetooth: hci2: command tx timeout [ 74.435407] Bluetooth: hci3: command tx timeout [ 74.435822] Bluetooth: hci4: command tx timeout [ 74.498784] Bluetooth: hci1: command tx timeout [ 76.416630] Bluetooth: hci5: command tx timeout [ 76.417078] Bluetooth: hci0: command tx timeout [ 76.417451] Bluetooth: hci7: command tx timeout [ 76.481609] Bluetooth: hci4: command tx timeout [ 76.482056] Bluetooth: hci3: command tx timeout [ 76.482426] Bluetooth: hci2: command tx timeout [ 76.482848] Bluetooth: hci6: command tx timeout [ 76.544702] Bluetooth: hci1: command tx timeout [ 106.064339] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.065111] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.182434] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.183082] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.440404] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.441089] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.519393] audit: type=1400 audit(1756455768.298:8): avc: denied { open } for pid=3812 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 106.526367] audit: type=1400 audit(1756455768.299:9): avc: denied { kernel } for pid=3812 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 106.533911] audit: type=1400 audit(1756455768.314:10): avc: denied { write } for pid=3812 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 106.579117] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.580196] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:22:48 executing program 7: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x0) 08:22:48 executing program 7: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x0) [ 106.830104] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.830832] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:22:48 executing program 7: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x0) 08:22:48 executing program 5: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_VOICE(r0, 0x112, 0xf, 0x0, &(0x7f0000000080)) [ 107.018487] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.019106] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:22:48 executing program 5: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_VOICE(r0, 0x112, 0xf, 0x0, &(0x7f0000000080)) 08:22:48 executing program 7: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_VOICE(r0, 0x112, 0xf, 0x0, &(0x7f0000000080)) 08:22:48 executing program 7: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_VOICE(r0, 0x112, 0xf, 0x0, &(0x7f0000000080)) 08:22:48 executing program 5: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_VOICE(r0, 0x112, 0xf, 0x0, &(0x7f0000000080)) [ 107.250401] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.251318] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.368727] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.370773] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.421636] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.422259] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.555121] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.556601] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.659830] syz_tun: entered promiscuous mode [ 107.670649] mac80211_hwsim hwsim10 wlan1: entered promiscuous mode [ 107.689273] mac80211_hwsim hwsim10 wlan1: left promiscuous mode [ 107.691333] syz_tun: left promiscuous mode [ 107.701907] mac80211_hwsim hwsim10 wlan1: entered promiscuous mode [ 107.703632] syz_tun: entered promiscuous mode [ 107.704356] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.705674] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.719842] syz_tun: left promiscuous mode [ 107.720321] mac80211_hwsim hwsim10 wlan1: left promiscuous mode [ 107.788364] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.789005] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.953740] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.955541] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.011131] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 108.015715] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 108.030353] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.031518] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.561224] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.562456] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.603865] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.605561] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 08:22:50 executing program 6: setreuid(0x0, 0xee00) setresuid(0x0, 0x0, 0xee01) 08:22:50 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x4840, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 08:22:50 executing program 0: ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000100)={{{@in=@multicast1, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000200)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x7, &(0x7f0000000240)={@empty, @local, r1}, 0xc) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='net/sockstat\x00') r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000000)={r3, 0x1, 0x6, @link_local}, 0x10) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000100)={r6, 0x1, 0x6, @multicast}, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000002c0)={'wg1\x00', 0x0}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x54, 0x0, 0x200, 0x6, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7f}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r1}]}]}, 0x54}, 0x1, 0x0, 0x0, 0xc4}, 0x8845) 08:22:50 executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_buf(r0, 0x107, 0xb, &(0x7f00000000c0)=""/97, &(0x7f0000000140)=0x4) 08:22:50 executing program 7: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_VOICE(r0, 0x112, 0xf, 0x0, &(0x7f0000000080)) 08:22:50 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/rpc\x00') getdents64(r0, &(0x7f0000000f00)=""/4096, 0x18) 08:22:50 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000140)=0x40) 08:22:50 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x25}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x30}}, 0x0) [ 108.788256] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 08:22:50 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x25}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x30}}, 0x0) [ 108.847377] syz_tun: entered promiscuous mode [ 108.854106] mac80211_hwsim hwsim10 wlan1: entered promiscuous mode [ 108.874348] mac80211_hwsim hwsim10 wlan1: left promiscuous mode [ 108.875535] syz_tun: left promiscuous mode [ 108.920547] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 08:22:50 executing program 6: setreuid(0x0, 0xee00) setresuid(0x0, 0x0, 0xee01) 08:22:50 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/rpc\x00') getdents64(r0, &(0x7f0000000f00)=""/4096, 0x18) 08:22:50 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x4840, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 08:22:50 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000140)=0x40) 08:22:50 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x25}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x30}}, 0x0) 08:22:50 executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_buf(r0, 0x107, 0xb, &(0x7f00000000c0)=""/97, &(0x7f0000000140)=0x4) 08:22:50 executing program 0: ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000100)={{{@in=@multicast1, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000200)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x7, &(0x7f0000000240)={@empty, @local, r1}, 0xc) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='net/sockstat\x00') r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000000)={r3, 0x1, 0x6, @link_local}, 0x10) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000100)={r6, 0x1, 0x6, @multicast}, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000002c0)={'wg1\x00', 0x0}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x54, 0x0, 0x200, 0x6, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7f}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r1}]}]}, 0x54}, 0x1, 0x0, 0x0, 0xc4}, 0x8845) 08:22:50 executing program 7: ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000100)={{{@in=@multicast1, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000200)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x7, &(0x7f0000000240)={@empty, @local, r1}, 0xc) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='net/sockstat\x00') r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000000)={r3, 0x1, 0x6, @link_local}, 0x10) setsockopt$packet_add_memb(r4, 0x107, 0x1, &(0x7f0000000100)={r6, 0x1, 0x6, @multicast}, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000002c0)={'wg1\x00', 0x0}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x54, 0x0, 0x200, 0x6, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r6}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7f}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r1}]}]}, 0x54}, 0x1, 0x0, 0x0, 0xc4}, 0x8845) [ 109.028212] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#1] SMP KASAN NOPTI [ 109.029985] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197] [ 109.031633] CPU: 0 UID: 0 PID: 3949 Comm: syz-executor.4 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 109.034093] Tainted: [W]=WARN [ 109.034889] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 109.036590] RIP: 0010:perf_tp_event+0x175/0xe70 [ 109.037789] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 08:22:50 executing program 6: setreuid(0x0, 0xee00) setresuid(0x0, 0x0, 0xee01) [ 109.041513] RSP: 0018:ffff888043fff780 EFLAGS: 00010012 [ 109.042817] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc90003a1e000 [ 109.044913] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 109.046873] RBP: ffff888043fff9f0 R08: ffff88806ce31340 R09: ffffe8ffffc15828 [ 109.048588] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 109.050157] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 08:22:50 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/rpc\x00') getdents64(r0, &(0x7f0000000f00)=""/4096, 0x18) [ 109.051208] FS: 00007f3fc359b700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 109.052435] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 109.053267] CR2: 00007f3fc6139018 CR3: 0000000009ca9000 CR4: 0000000000350ef0 [ 109.054306] Call Trace: [ 109.054682] [ 109.055028] ? lock_release+0xc8/0x290 [ 109.055620] ? __pfx_perf_tp_event+0x10/0x10 [ 109.056283] ? unwind_get_return_address+0x59/0xa0 [ 109.056809] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 109.057017] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 109.058484] ? arch_stack_walk+0x9c/0xf0 [ 109.059102] ? __lock_acquire+0x694/0x1b70 [ 109.059764] ? __lock_acquire+0x694/0x1b70 [ 109.060396] ? lock_acquire+0x15e/0x2f0 [ 109.060973] ? __is_insn_slot_addr+0x2e/0x290 [ 109.061649] ? find_held_lock+0x2b/0x80 [ 109.062261] ? __is_insn_slot_addr+0x136/0x290 [ 109.062944] ? perf_trace_run_bpf_submit+0xef/0x180 [ 109.063684] perf_trace_run_bpf_submit+0xef/0x180 [ 109.064416] perf_trace_preemptirq_template+0x259/0x430 [ 109.065218] ? trace_sched_set_need_resched_tp+0xd4/0x110 [ 109.066048] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 109.066915] ? __pfx___resched_curr+0x10/0x10 [ 109.067600] ? find_held_lock+0x2b/0x80 [ 109.068222] ? try_to_wake_up+0x8ae/0x11d0 [ 109.068849] ? _raw_spin_unlock_irqrestore+0x2c/0x50 [ 109.069594] trace_irq_enable.constprop.0+0xa6/0x100 [ 109.070349] trace_hardirqs_on+0x26/0x40 [ 109.070943] _raw_spin_unlock_irqrestore+0x2c/0x50 [ 109.071690] try_to_wake_up+0x8ae/0x11d0 [ 109.072305] ? __pfx_try_to_wake_up+0x10/0x10 [ 109.072969] ? plist_del+0x122/0x270 [ 109.073542] ? find_held_lock+0x2b/0x80 [ 109.074166] ? futex_wake+0x474/0x540 [ 109.074755] wake_up_q+0xa1/0x130 [ 109.075299] futex_wake+0x47e/0x540 [ 109.075858] ? __pfx_futex_wake+0x10/0x10 [ 109.076492] ? __lock_acquire+0x694/0x1b70 [ 109.077131] ? file_init_path+0x506/0x770 [ 109.077774] do_futex+0x26d/0x370 [ 109.078323] ? __pfx_do_futex+0x10/0x10 [ 109.078933] ? lock_release+0xc8/0x290 [ 109.079533] __x64_sys_futex+0x1c9/0x4d0 [ 109.080144] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 109.081015] ? __pfx___x64_sys_futex+0x10/0x10 [ 109.081706] do_syscall_64+0xbf/0x360 [ 109.082298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.083072] RIP: 0033:0x7f3fc6025b19 [ 109.083648] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 109.086294] RSP: 002b:00007f3fc359b218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 109.087409] RAX: ffffffffffffffda RBX: 00007f3fc6138f68 RCX: 00007f3fc6025b19 [ 109.088469] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f3fc6138f6c [ 109.089507] RBP: 00007f3fc6138f60 R08: 000000000000000e R09: 0000000000000000 [ 109.090557] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f3fc6138f6c [ 109.091649] R13: 00007ffd75b3909f R14: 00007f3fc359b300 R15: 0000000000022000 [ 109.092684] [ 109.093040] Modules linked in: [ 109.093613] ---[ end trace 0000000000000000 ]--- [ 109.094310] RIP: 0010:perf_tp_event+0x175/0xe70 [ 109.094996] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 109.097582] RSP: 0018:ffff888043fff780 EFLAGS: 00010012 [ 109.098362] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc90003a1e000 [ 109.099442] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 109.100461] RBP: ffff888043fff9f0 R08: ffff88806ce31340 R09: ffffe8ffffc15828 [ 109.101476] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 109.102524] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 [ 109.103543] FS: 00007f3fc359b700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 109.104705] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 109.105546] CR2: 00007f3fc6139018 CR3: 0000000009ca9000 CR4: 0000000000350ef0 [ 109.106578] note: syz-executor.4[3949] exited with irqs disabled [ 109.107548] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#2] SMP KASAN NOPTI [ 109.109136] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197] [ 109.110395] CPU: 0 UID: 0 PID: 3949 Comm: syz-executor.4 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 109.112111] Tainted: [D]=DIE, [W]=WARN [ 109.112663] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 109.113828] RIP: 0010:perf_tp_event+0x175/0xe70 [ 109.114544] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 109.117121] RSP: 0018:ffff88806ce08b80 EFLAGS: 00010012 [ 109.117890] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002 [ 109.118903] RDX: ffff8880183c0000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 109.119912] RBP: ffff88806ce08df0 R08: ffff88806ce313e8 R09: ffffe8ffffc15828 [ 109.120926] R10: 0000000000000000 R11: ffff88806ce37018 R12: dffffc0000000000 [ 109.121953] R13: 0000000000000014 R14: ffff88806ce313e8 R15: dffffc0000000000 [ 109.122973] FS: 00007f3fc359b700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 109.124134] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 109.124966] CR2: 00007f3fc6139018 CR3: 0000000009ca9000 CR4: 0000000000350ef0 [ 109.126000] Call Trace: [ 109.126377] [ 109.126703] ? __pfx_perf_tp_event+0x10/0x10 [ 109.127354] ? enqueue_task_fair+0xded/0x1e00 [ 109.128014] ? do_raw_spin_lock+0x123/0x260 [ 109.128645] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 109.129327] ? lock_acquire+0x18c/0x2f0 [ 109.129914] ? lock_release+0x1c7/0x290 [ 109.130504] ? do_raw_spin_unlock+0x53/0x220 [ 109.131161] ? _raw_spin_unlock_irqrestore+0x22/0x50 [ 109.131901] ? try_to_wake_up+0x128/0x11d0 [ 109.132527] ? do_raw_spin_lock+0x123/0x260 [ 109.133158] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 109.133848] ? perf_trace_run_bpf_submit+0xef/0x180 [ 109.134580] perf_trace_run_bpf_submit+0xef/0x180 [ 109.135300] perf_trace_preemptirq_template+0x259/0x430 [ 109.136088] ? read_tsc+0x9/0x20 [ 109.136592] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 109.137447] ? clockevents_program_event+0x135/0x360 [ 109.138197] ? tick_program_event+0xac/0x140 [ 109.138849] ? handle_softirqs+0x16e/0x770 [ 109.139484] trace_irq_enable.constprop.0+0xa6/0x100 [ 109.140209] trace_hardirqs_on+0x26/0x40 [ 109.140796] handle_softirqs+0x16e/0x770 [ 109.141397] __irq_exit_rcu+0xc4/0x100 [ 109.141983] irq_exit_rcu+0x9/0x20 [ 109.142509] sysvec_apic_timer_interrupt+0x70/0x80 [ 109.143224] 08:22:50 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/rpc\x00') getdents64(r0, &(0x7f0000000f00)=""/4096, 0x18) [ 109.143554] [ 109.143962] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 109.144914] RIP: 0010:make_task_dead+0xa2/0x3b0 [ 109.145607] Code: 38 00 85 db 0f 84 21 01 00 00 e8 d9 96 38 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 27 92 38 00 48 85 db 0f 84 17 01 00 00 b9 96 38 00 31 ff 65 8b 1d 60 df 48 06 81 e3 ff ff ff 7f 89 de [ 109.148167] RSP: 0018:ffff888043ffff28 EFLAGS: 00000246 [ 109.148922] RAX: 0000000000000001 RBX: ffff8880183c0000 RCX: ffffffff817c2b86 [ 109.149945] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff813b5234 [ 109.150974] RBP: 000000000000000b R08: 0000000000000000 R09: 0000000000000000 [ 109.151981] R10: ffffffff8643ac57 R11: 0000000000000001 R12: ffff8880183c0000 [ 109.152999] R13: 0000000000000000 R14: dffffc0020000032 R15: 0000000000000000 [ 109.154032] ? trace_irq_enable.constprop.0+0x26/0x100 [ 109.154788] ? make_task_dead+0x214/0x3b0 [ 109.155403] ? make_task_dead+0x214/0x3b0 [ 109.156009] ? do_syscall_64+0xbf/0x360 [ 109.156583] rewind_stack_and_make_dead+0x16/0x20 [ 109.157294] RIP: 0033:0x7f3fc6025b19 [ 109.157830] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 109.160422] RSP: 002b:00007f3fc359b218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 109.161516] RAX: ffffffffffffffda RBX: 00007f3fc6138f68 RCX: 00007f3fc6025b19 [ 109.162548] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f3fc6138f6c [ 109.163560] RBP: 00007f3fc6138f60 R08: 000000000000000e R09: 0000000000000000 [ 109.164579] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f3fc6138f6c [ 109.165590] R13: 00007ffd75b3909f R14: 00007f3fc359b300 R15: 0000000000022000 [ 109.166621] [ 109.166963] Modules linked in: [ 109.167430] ---[ end trace 0000000000000000 ]--- [ 109.168111] RIP: 0010:perf_tp_event+0x175/0xe70 [ 109.168793] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 109.171368] RSP: 0018:ffff888043fff780 EFLAGS: 00010012 [ 109.172138] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc90003a1e000 [ 109.173152] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 109.174177] RBP: ffff888043fff9f0 R08: ffff88806ce31340 R09: ffffe8ffffc15828 [ 109.175198] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 109.176215] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 [ 109.177246] FS: 00007f3fc359b700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 109.178410] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 109.179252] CR2: 00007f3fc6139018 CR3: 0000000009ca9000 CR4: 0000000000350ef0 [ 109.180285] Kernel panic - not syncing: Fatal exception in interrupt [ 109.181418] Kernel Offset: disabled [ 109.181939] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- VM DIAGNOSIS: 08:22:50 Registers: info registers vcpu 0 RAX=dffffc0000000005 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9 RSI=ffffffff828e3230 RDI=ffffffff88724180 RBP=ffffffff88724140 RSP=ffff888043fff0f8 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000000 R11=3030303030302052 R12=0000000000000051 R13=ffffffff88724190 R14=ffffffff88724140 R15=ffffffff88724400 RIP=ffffffff828e3285 RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f3fc359b700 00000000 00000000 GS =0000 ffff8880e55dd000 00000000 00000000 LDT=0000 fffffe7c00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f3fc6139018 CR3=0000000009ca9000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f3fc610c7c000007f3fc610c7c8 XMM02=00007f3fc610c7e000007f3fc610c7c0 XMM03=00007f3fc610c7c800007f3fc610c7c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000000 RBX=ffff8880170c7f30 RCX=0000000000000001 RDX=0000000000000000 RSI=ffffffff81358702 RDI=0000000000000000 RBP=ffff8880162dd280 RSP=ffff8880170c6b58 R8 =0000000000000001 R9 =ffff8880170c6c38 R10=000000000003be53 R11=000000000000ade4 R12=ffff8880170c6c01 R13=ffff8880170c6c40 R14=ffff8880170c7f00 R15=ffff8880170c6bf8 RIP=ffffffff815beab4 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e56dd000 00000000 00000000 LDT=0000 fffffe2c00000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f4432303541 CR3=0000000040055000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=ff00000000ff000000000000000000ff XMM01=25252525252525252525252525252525 XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000