Warning: Permanently added '[localhost]:14653' (ECDSA) to the list of known hosts.
2025/08/29 11:27:38 fuzzer started
2025/08/29 11:27:38 dialing manager at localhost:43077
syzkaller login: [   58.782685] cgroup: Unknown subsys name 'net'
[   58.840100] cgroup: Unknown subsys name 'cpuset'
[   58.850997] cgroup: Unknown subsys name 'rlimit'
2025/08/29 11:27:48 syscalls: 2214
2025/08/29 11:27:48 code coverage: enabled
2025/08/29 11:27:48 comparison tracing: enabled
2025/08/29 11:27:48 extra coverage: enabled
2025/08/29 11:27:48 setuid sandbox: enabled
2025/08/29 11:27:48 namespace sandbox: enabled
2025/08/29 11:27:48 Android sandbox: enabled
2025/08/29 11:27:48 fault injection: enabled
2025/08/29 11:27:48 leak checking: enabled
2025/08/29 11:27:48 net packet injection: enabled
2025/08/29 11:27:48 net device setup: enabled
2025/08/29 11:27:48 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2025/08/29 11:27:48 devlink PCI setup: PCI device 0000:00:10.0 is not available
2025/08/29 11:27:48 USB emulation: enabled
2025/08/29 11:27:48 hci packet injection: enabled
2025/08/29 11:27:48 wifi device emulation: enabled
2025/08/29 11:27:48 802.15.4 emulation: enabled
2025/08/29 11:27:48 fetching corpus: 0, signal 0/2000 (executing program)
2025/08/29 11:27:48 fetching corpus: 50, signal 24546/28040 (executing program)
2025/08/29 11:27:49 fetching corpus: 100, signal 33695/38624 (executing program)
2025/08/29 11:27:49 fetching corpus: 150, signal 43017/49179 (executing program)
2025/08/29 11:27:49 fetching corpus: 200, signal 50690/58008 (executing program)
2025/08/29 11:27:49 fetching corpus: 250, signal 56612/65003 (executing program)
2025/08/29 11:27:49 fetching corpus: 300, signal 60839/70314 (executing program)
2025/08/29 11:27:49 fetching corpus: 350, signal 66563/76935 (executing program)
2025/08/29 11:27:49 fetching corpus: 400, signal 70779/82051 (executing program)
2025/08/29 11:27:49 fetching corpus: 450, signal 73448/85657 (executing program)
2025/08/29 11:27:49 fetching corpus: 500, signal 74964/88217 (executing program)
2025/08/29 11:27:49 fetching corpus: 550, signal 78816/92868 (executing program)
2025/08/29 11:27:49 fetching corpus: 600, signal 81350/96217 (executing program)
2025/08/29 11:27:49 fetching corpus: 650, signal 83761/99461 (executing program)
2025/08/29 11:27:50 fetching corpus: 700, signal 87479/103713 (executing program)
2025/08/29 11:27:50 fetching corpus: 750, signal 89748/106665 (executing program)
2025/08/29 11:27:50 fetching corpus: 800, signal 91800/109379 (executing program)
2025/08/29 11:27:50 fetching corpus: 850, signal 94542/112605 (executing program)
2025/08/29 11:27:50 fetching corpus: 900, signal 96341/115025 (executing program)
2025/08/29 11:27:50 fetching corpus: 950, signal 97309/116764 (executing program)
2025/08/29 11:27:50 fetching corpus: 1000, signal 99259/119285 (executing program)
2025/08/29 11:27:50 fetching corpus: 1050, signal 100921/121493 (executing program)
2025/08/29 11:27:50 fetching corpus: 1100, signal 102787/123835 (executing program)
2025/08/29 11:27:50 fetching corpus: 1150, signal 104728/126181 (executing program)
2025/08/29 11:27:51 fetching corpus: 1200, signal 106239/128201 (executing program)
2025/08/29 11:27:51 fetching corpus: 1250, signal 107491/130023 (executing program)
2025/08/29 11:27:51 fetching corpus: 1300, signal 108888/131911 (executing program)
2025/08/29 11:27:51 fetching corpus: 1350, signal 109965/133515 (executing program)
2025/08/29 11:27:51 fetching corpus: 1400, signal 111223/135213 (executing program)
2025/08/29 11:27:51 fetching corpus: 1450, signal 112239/136713 (executing program)
2025/08/29 11:27:51 fetching corpus: 1500, signal 113354/138327 (executing program)
2025/08/29 11:27:51 fetching corpus: 1550, signal 114242/139710 (executing program)
2025/08/29 11:27:51 fetching corpus: 1600, signal 116101/141697 (executing program)
2025/08/29 11:27:52 fetching corpus: 1650, signal 117013/143039 (executing program)
2025/08/29 11:27:52 fetching corpus: 1700, signal 117902/144370 (executing program)
2025/08/29 11:27:52 fetching corpus: 1750, signal 118774/145646 (executing program)
2025/08/29 11:27:52 fetching corpus: 1800, signal 119878/147070 (executing program)
2025/08/29 11:27:52 fetching corpus: 1850, signal 121157/148548 (executing program)
2025/08/29 11:27:52 fetching corpus: 1900, signal 122094/149768 (executing program)
2025/08/29 11:27:52 fetching corpus: 1950, signal 123023/151020 (executing program)
2025/08/29 11:27:52 fetching corpus: 2000, signal 123598/152047 (executing program)
2025/08/29 11:27:52 fetching corpus: 2050, signal 124546/153361 (executing program)
2025/08/29 11:27:52 fetching corpus: 2100, signal 125611/154647 (executing program)
2025/08/29 11:27:52 fetching corpus: 2150, signal 126209/155738 (executing program)
2025/08/29 11:27:53 fetching corpus: 2200, signal 126933/156822 (executing program)
2025/08/29 11:27:53 fetching corpus: 2250, signal 128030/158016 (executing program)
2025/08/29 11:27:53 fetching corpus: 2300, signal 128666/158972 (executing program)
2025/08/29 11:27:53 fetching corpus: 2350, signal 129886/160240 (executing program)
2025/08/29 11:27:53 fetching corpus: 2400, signal 131017/161622 (executing program)
2025/08/29 11:27:53 fetching corpus: 2450, signal 131793/162578 (executing program)
2025/08/29 11:27:53 fetching corpus: 2500, signal 132530/163549 (executing program)
2025/08/29 11:27:53 fetching corpus: 2550, signal 133178/164456 (executing program)
2025/08/29 11:27:53 fetching corpus: 2600, signal 133907/165402 (executing program)
2025/08/29 11:27:53 fetching corpus: 2650, signal 134567/166286 (executing program)
2025/08/29 11:27:53 fetching corpus: 2700, signal 135268/167165 (executing program)
2025/08/29 11:27:54 fetching corpus: 2750, signal 136082/168046 (executing program)
2025/08/29 11:27:54 fetching corpus: 2800, signal 136770/168862 (executing program)
2025/08/29 11:27:54 fetching corpus: 2850, signal 137548/169687 (executing program)
2025/08/29 11:27:54 fetching corpus: 2900, signal 138538/170615 (executing program)
2025/08/29 11:27:54 fetching corpus: 2950, signal 139139/171400 (executing program)
2025/08/29 11:27:54 fetching corpus: 3000, signal 139872/172206 (executing program)
2025/08/29 11:27:54 fetching corpus: 3050, signal 140198/172862 (executing program)
2025/08/29 11:27:54 fetching corpus: 3100, signal 140978/173649 (executing program)
2025/08/29 11:27:54 fetching corpus: 3150, signal 141550/174353 (executing program)
2025/08/29 11:27:54 fetching corpus: 3200, signal 142066/175045 (executing program)
2025/08/29 11:27:55 fetching corpus: 3250, signal 142965/175810 (executing program)
2025/08/29 11:27:55 fetching corpus: 3300, signal 143561/176507 (executing program)
2025/08/29 11:27:55 fetching corpus: 3350, signal 144333/177243 (executing program)
2025/08/29 11:27:55 fetching corpus: 3400, signal 144778/177871 (executing program)
2025/08/29 11:27:55 fetching corpus: 3450, signal 145275/178473 (executing program)
2025/08/29 11:27:55 fetching corpus: 3500, signal 145808/179087 (executing program)
2025/08/29 11:27:55 fetching corpus: 3550, signal 146367/179691 (executing program)
2025/08/29 11:27:55 fetching corpus: 3600, signal 147112/180326 (executing program)
2025/08/29 11:27:55 fetching corpus: 3650, signal 147394/180843 (executing program)
2025/08/29 11:27:55 fetching corpus: 3700, signal 147845/181391 (executing program)
2025/08/29 11:27:55 fetching corpus: 3750, signal 148810/182113 (executing program)
2025/08/29 11:27:55 fetching corpus: 3800, signal 149377/182623 (executing program)
2025/08/29 11:27:55 fetching corpus: 3850, signal 150121/183229 (executing program)
2025/08/29 11:27:56 fetching corpus: 3900, signal 150720/183780 (executing program)
2025/08/29 11:27:56 fetching corpus: 3950, signal 151253/184278 (executing program)
2025/08/29 11:27:56 fetching corpus: 4000, signal 151759/184749 (executing program)
2025/08/29 11:27:56 fetching corpus: 4050, signal 152511/185298 (executing program)
2025/08/29 11:27:56 fetching corpus: 4100, signal 153006/185716 (executing program)
2025/08/29 11:27:56 fetching corpus: 4150, signal 153509/186190 (executing program)
2025/08/29 11:27:56 fetching corpus: 4200, signal 154179/186665 (executing program)
2025/08/29 11:27:56 fetching corpus: 4250, signal 154778/187100 (executing program)
2025/08/29 11:27:56 fetching corpus: 4300, signal 155305/187526 (executing program)
2025/08/29 11:27:56 fetching corpus: 4350, signal 155924/188166 (executing program)
2025/08/29 11:27:57 fetching corpus: 4400, signal 156378/188561 (executing program)
2025/08/29 11:27:57 fetching corpus: 4450, signal 156710/188950 (executing program)
2025/08/29 11:27:57 fetching corpus: 4500, signal 157326/189332 (executing program)
2025/08/29 11:27:57 fetching corpus: 4550, signal 157894/189721 (executing program)
2025/08/29 11:27:57 fetching corpus: 4600, signal 158411/189840 (executing program)
2025/08/29 11:27:57 fetching corpus: 4650, signal 158952/189844 (executing program)
2025/08/29 11:27:57 fetching corpus: 4700, signal 159640/189865 (executing program)
2025/08/29 11:27:57 fetching corpus: 4750, signal 160100/189875 (executing program)
2025/08/29 11:27:57 fetching corpus: 4800, signal 160601/189986 (executing program)
2025/08/29 11:27:57 fetching corpus: 4850, signal 161027/189997 (executing program)
2025/08/29 11:27:58 fetching corpus: 4900, signal 161424/190009 (executing program)
2025/08/29 11:27:58 fetching corpus: 4950, signal 161708/190022 (executing program)
2025/08/29 11:27:58 fetching corpus: 5000, signal 162173/190024 (executing program)
2025/08/29 11:27:58 fetching corpus: 5050, signal 162567/190048 (executing program)
2025/08/29 11:27:58 fetching corpus: 5100, signal 163187/190092 (executing program)
2025/08/29 11:27:58 fetching corpus: 5150, signal 163536/190092 (executing program)
2025/08/29 11:27:58 fetching corpus: 5200, signal 163967/190097 (executing program)
2025/08/29 11:27:58 fetching corpus: 5250, signal 164445/190098 (executing program)
2025/08/29 11:27:58 fetching corpus: 5300, signal 164787/190109 (executing program)
2025/08/29 11:27:59 fetching corpus: 5350, signal 165244/190110 (executing program)
2025/08/29 11:27:59 fetching corpus: 5400, signal 165556/190114 (executing program)
2025/08/29 11:27:59 fetching corpus: 5450, signal 165895/190127 (executing program)
2025/08/29 11:27:59 fetching corpus: 5500, signal 166328/190238 (executing program)
2025/08/29 11:27:59 fetching corpus: 5550, signal 166768/190239 (executing program)
2025/08/29 11:27:59 fetching corpus: 5600, signal 167254/190260 (executing program)
2025/08/29 11:27:59 fetching corpus: 5650, signal 168031/190269 (executing program)
2025/08/29 11:27:59 fetching corpus: 5700, signal 168359/190272 (executing program)
2025/08/29 11:27:59 fetching corpus: 5750, signal 168711/190275 (executing program)
2025/08/29 11:27:59 fetching corpus: 5800, signal 169116/190283 (executing program)
2025/08/29 11:27:59 fetching corpus: 5850, signal 169584/190308 (executing program)
2025/08/29 11:28:00 fetching corpus: 5900, signal 169889/190314 (executing program)
2025/08/29 11:28:00 fetching corpus: 5950, signal 170228/190343 (executing program)
2025/08/29 11:28:00 fetching corpus: 6000, signal 170556/190354 (executing program)
2025/08/29 11:28:00 fetching corpus: 6050, signal 170950/190354 (executing program)
2025/08/29 11:28:00 fetching corpus: 6100, signal 171300/190364 (executing program)
2025/08/29 11:28:00 fetching corpus: 6150, signal 171631/190392 (executing program)
2025/08/29 11:28:00 fetching corpus: 6200, signal 172053/190406 (executing program)
2025/08/29 11:28:00 fetching corpus: 6250, signal 172349/190426 (executing program)
2025/08/29 11:28:00 fetching corpus: 6300, signal 172871/190427 (executing program)
2025/08/29 11:28:00 fetching corpus: 6350, signal 173242/190431 (executing program)
2025/08/29 11:28:00 fetching corpus: 6400, signal 173540/190433 (executing program)
2025/08/29 11:28:00 fetching corpus: 6450, signal 173854/190435 (executing program)
2025/08/29 11:28:01 fetching corpus: 6500, signal 174222/190474 (executing program)
2025/08/29 11:28:01 fetching corpus: 6550, signal 174750/190474 (executing program)
2025/08/29 11:28:01 fetching corpus: 6600, signal 175112/190476 (executing program)
2025/08/29 11:28:01 fetching corpus: 6650, signal 175434/190511 (executing program)
2025/08/29 11:28:01 fetching corpus: 6700, signal 175701/190541 (executing program)
2025/08/29 11:28:01 fetching corpus: 6750, signal 176117/190541 (executing program)
2025/08/29 11:28:01 fetching corpus: 6800, signal 176544/190549 (executing program)
2025/08/29 11:28:01 fetching corpus: 6850, signal 177214/190581 (executing program)
2025/08/29 11:28:01 fetching corpus: 6900, signal 177722/190596 (executing program)
2025/08/29 11:28:01 fetching corpus: 6950, signal 178038/190610 (executing program)
2025/08/29 11:28:01 fetching corpus: 7000, signal 178293/190611 (executing program)
2025/08/29 11:28:01 fetching corpus: 7050, signal 178587/190614 (executing program)
2025/08/29 11:28:01 fetching corpus: 7100, signal 178849/190621 (executing program)
2025/08/29 11:28:02 fetching corpus: 7150, signal 179330/190674 (executing program)
2025/08/29 11:28:02 fetching corpus: 7200, signal 179596/190691 (executing program)
2025/08/29 11:28:02 fetching corpus: 7250, signal 179926/190691 (executing program)
2025/08/29 11:28:02 fetching corpus: 7300, signal 180192/190701 (executing program)
2025/08/29 11:28:02 fetching corpus: 7350, signal 180394/190711 (executing program)
2025/08/29 11:28:02 fetching corpus: 7400, signal 180617/190731 (executing program)
2025/08/29 11:28:02 fetching corpus: 7450, signal 180813/190745 (executing program)
2025/08/29 11:28:02 fetching corpus: 7500, signal 181206/190757 (executing program)
2025/08/29 11:28:02 fetching corpus: 7550, signal 181579/190765 (executing program)
2025/08/29 11:28:02 fetching corpus: 7600, signal 182051/190798 (executing program)
2025/08/29 11:28:02 fetching corpus: 7650, signal 182336/190824 (executing program)
2025/08/29 11:28:03 fetching corpus: 7700, signal 182824/190827 (executing program)
2025/08/29 11:28:03 fetching corpus: 7750, signal 183153/190837 (executing program)
2025/08/29 11:28:03 fetching corpus: 7800, signal 183432/190844 (executing program)
2025/08/29 11:28:03 fetching corpus: 7850, signal 183708/190855 (executing program)
2025/08/29 11:28:03 fetching corpus: 7900, signal 183968/190859 (executing program)
2025/08/29 11:28:03 fetching corpus: 7950, signal 184260/190862 (executing program)
2025/08/29 11:28:03 fetching corpus: 8000, signal 184555/190867 (executing program)
2025/08/29 11:28:03 fetching corpus: 8050, signal 184864/190867 (executing program)
2025/08/29 11:28:03 fetching corpus: 8100, signal 185158/190872 (executing program)
2025/08/29 11:28:03 fetching corpus: 8150, signal 185369/190887 (executing program)
2025/08/29 11:28:03 fetching corpus: 8200, signal 185786/190975 (executing program)
2025/08/29 11:28:03 fetching corpus: 8250, signal 186166/191003 (executing program)
2025/08/29 11:28:03 fetching corpus: 8300, signal 186508/191016 (executing program)
2025/08/29 11:28:04 fetching corpus: 8350, signal 186891/191024 (executing program)
2025/08/29 11:28:04 fetching corpus: 8400, signal 187154/191026 (executing program)
2025/08/29 11:28:04 fetching corpus: 8450, signal 187371/191026 (executing program)
2025/08/29 11:28:04 fetching corpus: 8500, signal 187773/191035 (executing program)
2025/08/29 11:28:04 fetching corpus: 8505, signal 187812/191035 (executing program)
2025/08/29 11:28:04 fetching corpus: 8505, signal 187812/191035 (executing program)
2025/08/29 11:28:06 starting 8 fuzzer processes
11:28:06 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='setgroups\x00')
write$P9_RVERSION(r0, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x0, 0x8, '9P2000.u'}, 0x15)

11:28:06 executing program 1:
unlinkat(0xffffffffffffff9c, 0x0, 0x0)

11:28:06 executing program 5:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x3}, 0x1c)
r1 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'syz_tun\x00', <r2=>0x0})
setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000180)={@dev, r2}, 0x14)

11:28:06 executing program 2:
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udplite(0xa, 0x2, 0x88)
sendmmsg$inet6(r0, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x28}}], 0x1, 0x0)
poll(0x0, 0x0, 0x0)

11:28:06 executing program 3:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000280)={@multicast1=0xe0000002, @local, @local}, 0xc)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/mcfilter\x00')
preadv(r1, &(0x7f0000000340)=[{&(0x7f0000000000)=""/136, 0x88}], 0x1, 0x2f, 0x0)

11:28:06 executing program 7:
get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x5)

11:28:06 executing program 6:
clock_adjtime(0x0, &(0x7f0000000b00)={0x97d0})

11:28:06 executing program 4:
r0 = getpid()
r1 = pidfd_open(r0, 0x0)
ioctl$FS_IOC_GETVERSION(r1, 0xff01, &(0x7f0000001000))

[   86.765978] audit: type=1400 audit(1756466886.748:7): avc:  denied  { execmem } for  pid=272 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
[   87.930341] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   87.932791] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   87.934911] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   87.941901] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   87.945119] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   88.000618] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   88.007383] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   88.009626] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   88.013952] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   88.019467] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   88.023651] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   88.025249] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   88.027219] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   88.054699] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   88.058332] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   88.060045] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   88.066313] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[   88.070028] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[   88.071342] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   88.075744] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   88.078273] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[   88.080002] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   88.088118] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   88.091702] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   88.096545] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   88.097872] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   88.098162] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   88.100813] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   88.100960] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   88.133283] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   88.134468] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[   88.135765] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   88.141222] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   88.151644] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   88.153179] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[   88.156764] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[   88.159809] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[   88.176640] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[   88.206955] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[   88.210084] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[   89.962779] Bluetooth: hci0: command tx timeout
[   90.090632] Bluetooth: hci1: command tx timeout
[   90.154500] Bluetooth: hci2: command tx timeout
[   90.218390] Bluetooth: hci5: command tx timeout
[   90.218452] Bluetooth: hci4: command tx timeout
[   90.219168] Bluetooth: hci3: command tx timeout
[   90.282760] Bluetooth: hci7: command tx timeout
[   90.284048] Bluetooth: hci6: command tx timeout
[   92.009941] Bluetooth: hci0: command tx timeout
[   92.139449] Bluetooth: hci1: command tx timeout
[   92.201532] Bluetooth: hci2: command tx timeout
[   92.265483] Bluetooth: hci3: command tx timeout
[   92.265970] Bluetooth: hci5: command tx timeout
[   92.266485] Bluetooth: hci4: command tx timeout
[   92.329617] Bluetooth: hci6: command tx timeout
[   92.329636] Bluetooth: hci7: command tx timeout
[   94.057579] Bluetooth: hci0: command tx timeout
[   94.185522] Bluetooth: hci1: command tx timeout
[   94.252549] Bluetooth: hci2: command tx timeout
[   94.313494] Bluetooth: hci5: command tx timeout
[   94.313559] Bluetooth: hci4: command tx timeout
[   94.313931] Bluetooth: hci3: command tx timeout
[   94.377477] Bluetooth: hci7: command tx timeout
[   94.377895] Bluetooth: hci6: command tx timeout
[   96.105582] Bluetooth: hci0: command tx timeout
[   96.235442] Bluetooth: hci1: command tx timeout
[   96.298025] Bluetooth: hci2: command tx timeout
[   96.361618] Bluetooth: hci3: command tx timeout
[   96.362013] Bluetooth: hci4: command tx timeout
[   96.362508] Bluetooth: hci5: command tx timeout
[   96.425464] Bluetooth: hci6: command tx timeout
[   96.425915] Bluetooth: hci7: command tx timeout
[  126.667972] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  126.668660] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  126.829608] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  126.830226] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  127.172931] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  127.173568] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:28:47 executing program 6:
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0)
syz_mount_image$iso9660(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0)
r1 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r1, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1)

[  127.319506] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  127.320099] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  127.358955] audit: type=1400 audit(1756466927.340:8): avc:  denied  { open } for  pid=3807 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[  127.376500] audit: type=1400 audit(1756466927.340:9): avc:  denied  { kernel } for  pid=3807 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[  127.387746] audit: type=1400 audit(1756466927.355:10): avc:  denied  { read } for  pid=3807 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[  127.401530] audit: type=1400 audit(1756466927.363:11): avc:  denied  { write } for  pid=3807 comm="syz-executor.6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
11:28:47 executing program 6:
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0)
syz_mount_image$iso9660(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0)
r1 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r1, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1)

11:28:47 executing program 6:
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0)
syz_mount_image$iso9660(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0)
r1 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r1, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1)

11:28:47 executing program 6:
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0)
syz_mount_image$iso9660(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0)
r1 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r1, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1)

[  127.693807] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  127.694963] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  127.732092] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
11:28:47 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0xeb, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000000), 0xffff, 0x2)
pwritev(r0, &(0x7f00000003c0)=[{&(0x7f0000000040)='~', 0x1}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0)

11:28:47 executing program 2:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
getsockopt$bt_BT_VOICE(r0, 0x112, 0xb, 0x0, &(0x7f0000000080))

11:28:47 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0xeb, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000000), 0xffff, 0x2)
pwritev(r0, &(0x7f00000003c0)=[{&(0x7f0000000040)='~', 0x1}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0)

[  127.842913] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  127.843592] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  127.906157] kmemleak: Found object by alias at 0x607f1a6395c4
[  127.906174] CPU: 1 UID: 0 PID: 3862 Comm: syz-executor.6 Tainted: G        W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  127.906191] Tainted: [W]=WARN
[  127.906195] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  127.906202] Call Trace:
[  127.906207]  <TASK>
[  127.906211]  dump_stack_lvl+0xca/0x120
[  127.906237]  __lookup_object+0x94/0xb0
[  127.906254]  delete_object_full+0x27/0x70
[  127.906270]  free_percpu+0x30/0x1160
[  127.906286]  ? arch_uprobe_clear_state+0x16/0x140
[  127.906306]  futex_hash_free+0x38/0xc0
[  127.906320]  mmput+0x2d3/0x390
[  127.906339]  do_exit+0x79d/0x2970
[  127.906352]  ? lock_release+0xc8/0x290
[  127.906369]  ? __pfx_do_exit+0x10/0x10
[  127.906383]  ? find_held_lock+0x2b/0x80
[  127.906405]  ? get_signal+0x835/0x2340
[  127.906425]  do_group_exit+0xd3/0x2a0
[  127.906443]  get_signal+0x2315/0x2340
[  127.906465]  ? __pfx_get_signal+0x10/0x10
[  127.906480]  ? do_futex+0x135/0x370
[  127.906494]  ? __pfx_do_futex+0x10/0x10
[  127.906508]  arch_do_signal_or_restart+0x80/0x790
[  127.906526]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[  127.906541]  ? __x64_sys_futex+0x1c9/0x4d0
[  127.906553]  ? __x64_sys_futex+0x1d2/0x4d0
[  127.906568]  ? __pfx___x64_sys_futex+0x10/0x10
[  127.906582]  ? __pfx_do_pwritev+0x10/0x10
[  127.906596]  exit_to_user_mode_loop+0x8b/0x110
[  127.906610]  do_syscall_64+0x2f7/0x360
[  127.906622]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  127.906634] RIP: 0033:0x7f0f091f7b19
[  127.906642] Code: Unable to access opcode bytes at 0x7f0f091f7aef.
[  127.906647] RSP: 002b:00007f0f0676d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  127.906658] RAX: fffffffffffffe00 RBX: 00007f0f0930af68 RCX: 00007f0f091f7b19
[  127.906666] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0f0930af68
[  127.906673] RBP: 00007f0f0930af60 R08: 0000000000000000 R09: 0000000000000000
[  127.906680] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0f0930af6c
[  127.906687] R13: 00007ffd539eacef R14: 00007f0f0676d300 R15: 0000000000022000
[  127.906702]  </TASK>
[  127.906706] kmemleak: Object (percpu) 0x607f1a6395c0 (size 8):
[  127.906713] kmemleak:   comm "syz-executor.0", pid 282, jiffies 4294794680
[  127.906720] kmemleak:   min_count = 1
[  127.906724] kmemleak:   count = 0
[  127.906727] kmemleak:   flags = 0x21
[  127.906731] kmemleak:   checksum = 0
[  127.906735] kmemleak:   backtrace:
[  127.906739]  pcpu_alloc_noprof+0x87a/0x1170
[  127.906753]  __alloc_workqueue+0x74b/0x1820
[  127.906770]  alloc_workqueue_noprof+0xc7/0x200
[  127.906779]  ieee80211_register_hw+0x1ec5/0x3e00
[  127.906791]  mac80211_hwsim_new_radio+0x2758/0x4ef0
[  127.906804]  hwsim_new_radio_nl+0xb0d/0x1250
[  127.906814]  genl_family_rcv_msg_doit+0x1fe/0x2f0
[  127.906825]  genl_rcv_msg+0x532/0x7e0
[  127.906834]  netlink_rcv_skb+0x147/0x430
[  127.906849]  genl_rcv+0x28/0x40
[  127.906857]  netlink_unicast+0x5a7/0x870
[  127.906872]  netlink_sendmsg+0x8ac/0xd80
[  127.906887]  __sys_sendto+0x506/0x570
[  127.906901]  __x64_sys_sendto+0xe1/0x1c0
[  127.906913]  do_syscall_64+0xbf/0x360
[  127.906922]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
11:28:47 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0xeb, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000000), 0xffff, 0x2)
pwritev(r0, &(0x7f00000003c0)=[{&(0x7f0000000040)='~', 0x1}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0)

[  127.992511] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  127.993140] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  128.039528] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  128.040144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  128.106295] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  128.107309] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  128.218871] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  128.219885] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  128.344453] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  128.345079] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  128.498095] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  128.498742] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  128.577780] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  128.578967] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  128.642607] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  128.643747] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  128.669512] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  128.670590] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  128.705927] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  128.706598] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
11:28:48 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='setgroups\x00')
write$P9_RVERSION(r0, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x0, 0x8, '9P2000.u'}, 0x15)

11:28:48 executing program 7:
get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x5)

11:28:48 executing program 3:
r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040))
r1 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x9)

11:28:48 executing program 5:
r0 = socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000080)="81", 0x1)

11:28:48 executing program 2:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40001)
r2 = dup2(r1, r0)
write$binfmt_aout(r2, &(0x7f0000000080)=ANY=[], 0x2e)
ioctl$SG_IO(r2, 0x2286, &(0x7f00000022c0)={0x0, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

11:28:48 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0xeb, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000000), 0xffff, 0x2)
pwritev(r0, &(0x7f00000003c0)=[{&(0x7f0000000040)='~', 0x1}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0)

11:28:48 executing program 1:
r0 = memfd_create(&(0x7f0000000000)=':^/\x00', 0x7)
fcntl$addseals(r0, 0x40a, 0x0)

11:28:48 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000480)=ANY=[@ANYBLOB="280000001100010000000000000000000700000001"], 0x28}], 0x1}, 0x0)

11:28:48 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000480)=ANY=[@ANYBLOB="280000001100010000000000000000000700000001"], 0x28}], 0x1}, 0x0)

11:28:48 executing program 1:
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000001b00))
syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_conn_request={{0x4, 0xa}, {@none, '-&&', 0x1}}}, 0xd)
syz_mount_image$iso9660(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
removexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='system.posix_acl_default\x00')
syz_emit_vhci(&(0x7f00000000c0)=@HCI_EVENT_PKT={0x4, @hci_ev_hardware_error={{0x10, 0x1}, {0x8}}}, 0x4)

11:28:49 executing program 7:
get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x5)

[  129.054932] Bluetooth: hci0: hardware error 0x08
11:28:49 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='setgroups\x00')
write$P9_RVERSION(r0, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x0, 0x8, '9P2000.u'}, 0x15)

11:28:49 executing program 5:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001a00), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000001a40)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_PAGE={0x5}, @NL802154_ATTR_CHANNEL={0x5}]}, 0x2c}}, 0x0)

11:28:49 executing program 6:
r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0)
ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000000000)={0x2e, 0x0, 0x0})

11:28:49 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000480)=ANY=[@ANYBLOB="280000001100010000000000000000000700000001"], 0x28}], 0x1}, 0x0)

11:28:49 executing program 3:
r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040))
r1 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x9)

11:28:49 executing program 7:
get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x5)

11:28:49 executing program 1:
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000001b00))
syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_conn_request={{0x4, 0xa}, {@none, '-&&', 0x1}}}, 0xd)
syz_mount_image$iso9660(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
removexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='system.posix_acl_default\x00')
syz_emit_vhci(&(0x7f00000000c0)=@HCI_EVENT_PKT={0x4, @hci_ev_hardware_error={{0x10, 0x1}, {0x8}}}, 0x4)

11:28:49 executing program 2:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40001)
r2 = dup2(r1, r0)
write$binfmt_aout(r2, &(0x7f0000000080)=ANY=[], 0x2e)
ioctl$SG_IO(r2, 0x2286, &(0x7f00000022c0)={0x0, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

11:28:49 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='setgroups\x00')
write$P9_RVERSION(r0, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x0, 0x8, '9P2000.u'}, 0x15)

11:28:49 executing program 1:
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000001b00))
syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_conn_request={{0x4, 0xa}, {@none, '-&&', 0x1}}}, 0xd)
syz_mount_image$iso9660(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
removexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='system.posix_acl_default\x00')
syz_emit_vhci(&(0x7f00000000c0)=@HCI_EVENT_PKT={0x4, @hci_ev_hardware_error={{0x10, 0x1}, {0x8}}}, 0x4)

[  129.275589] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#1] SMP KASAN NOPTI
[  129.276550] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[  129.277252] CPU: 1 UID: 0 PID: 3957 Comm: syz-executor.3 Tainted: G        W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  129.278527] Tainted: [W]=WARN
[  129.279182] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  129.280985] RIP: 0010:perf_tp_event+0x175/0xe70
[  129.281984] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  129.286089] RSP: 0018:ffff888013dff800 EFLAGS: 00010212
[  129.287281] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc90005e38000
[  129.287905] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190
[  129.288537] RBP: ffff888013dffa70 R08: ffff88806cf31340 R09: ffffe8ffffd15cf8
[  129.289131] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[  129.289747] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[  129.290366] FS:  00007fafda9de700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
[  129.291070] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  129.291559] CR2: 0000555555b36c18 CR3: 000000001c2ee000 CR4: 0000000000350ef0
[  129.292198] Call Trace:
[  129.292431]  <TASK>
[  129.292642]  ? __pfx_perf_tp_event+0x10/0x10
[  129.293047]  ? perf_trace_lock+0xb5/0x5d0
[  129.293418]  ? find_held_lock+0x2b/0x80
[  129.293777]  ? __pfx_perf_trace_lock+0x10/0x10
[  129.294185]  ? __virt_addr_valid+0x100/0x5d0
[  129.294590]  ? mark_held_locks+0x49/0x80
[  129.294953]  ? _raw_spin_unlock_irq+0x23/0x40
[  129.295355]  ? ext4_ind_migrate+0x53a/0x9f0
[  129.295744]  ? perf_trace_run_bpf_submit+0xef/0x180
[  129.296194]  perf_trace_run_bpf_submit+0xef/0x180
[  129.296637]  perf_trace_lock+0x337/0x5d0
[  129.296994]  ? __pfx_perf_trace_lock+0x10/0x10
[  129.297400]  ? lock_acquire+0x15e/0x2f0
[  129.297736]  ? futex_ref_get+0x48/0x300
[  129.298100]  ? futex_ref_get+0x114/0x300
[  129.298455]  ? futex_hash+0x15c/0x390
[  129.298803]  lock_release+0x1ab/0x290
[  129.299142]  ? futex_hash+0x15c/0x390
[  129.299486]  futex_ref_get+0x119/0x300
[  129.299836]  ? futex_hash+0x15c/0x390
[  129.300182]  futex_hash+0x70/0x390
[  129.300486]  futex_wake+0x143/0x540
[  129.300810]  ? ioctl_setflags+0x12b/0x1f0
[  129.301187]  ? __pfx_ioctl_setflags+0x10/0x10
[  129.301598]  ? __pfx_futex_wake+0x10/0x10
[  129.301957]  ? __pfx_avc_has_perm+0x10/0x10
[  129.302354]  ? do_vfs_ioctl+0x125/0x1470
[  129.302727]  do_futex+0x26d/0x370
[  129.303028]  ? __pfx_do_futex+0x10/0x10
[  129.303376]  ? file_has_perm+0x187/0x270
[  129.303737]  ? __fget_files+0x34/0x3b0
[  129.304092]  ? __pfx_file_has_perm+0x10/0x10
[  129.304475]  __x64_sys_futex+0x1c9/0x4d0
[  129.304851]  ? __pfx___x64_sys_futex+0x10/0x10
[  129.305252]  ? selinux_file_ioctl+0xb9/0x280
[  129.305627]  ? xfd_validate_state+0x55/0x180
[  129.306033]  do_syscall_64+0xbf/0x360
[  129.306386]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  129.306842] RIP: 0033:0x7fafdd468b19
[  129.307163] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  129.308739] RSP: 002b:00007fafda9de218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  129.309401] RAX: ffffffffffffffda RBX: 00007fafdd57bf68 RCX: 00007fafdd468b19
[  129.310025] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fafdd57bf6c
[  129.310639] RBP: 00007fafdd57bf60 R08: 000000000000000e R09: 0000000000000000
[  129.311264] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fafdd57bf6c
[  129.311901] R13: 00007ffd9a44913f R14: 00007fafda9de300 R15: 0000000000022000
[  129.312557]  </TASK>
[  129.312768] Modules linked in:
[  129.313179] ---[ end trace 0000000000000000 ]---
[  129.313656] RIP: 0010:perf_tp_event+0x175/0xe70
[  129.314087] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  129.315729] RSP: 0018:ffff888013dff800 EFLAGS: 00010212
[  129.316218] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc90005e38000
[  129.316926] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190
[  129.317632] RBP: ffff888013dffa70 R08: ffff88806cf31340 R09: ffffe8ffffd15cf8
[  129.318321] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[  129.319056] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[  129.319812] FS:  00007fafda9de700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
[  129.320568] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  129.321087] CR2: 0000555555b36c18 CR3: 000000001c2ee000 CR4: 0000000000350ef0
[  129.321727] note: syz-executor.3[3957] exited with preempt_count 1
[  129.322290] BUG: sleeping function called from invalid context at ./include/linux/percpu-rwsem.h:51
[  129.323093] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 3957, name: syz-executor.3
[  129.323820] preempt_count: 0, expected: 0
[  129.324185] RCU nest depth: 2, expected: 0
[  129.324577] INFO: lockdep is turned off.
[  129.324936] CPU: 1 UID: 0 PID: 3957 Comm: syz-executor.3 Tainted: G      D W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  129.324956] Tainted: [D]=DIE, [W]=WARN
[  129.324960] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  129.324966] Call Trace:
[  129.324970]  <TASK>
[  129.324975]  dump_stack_lvl+0xfa/0x120
[  129.324996]  __might_resched+0x2f3/0x510
[  129.325010]  exit_signals+0x25/0x940
[  129.325031]  do_exit+0x2db/0x2970
[  129.325050]  ? _printk+0xbe/0xf0
[  129.325070]  ? __pfx__printk+0x10/0x10
[  129.325089]  ? __pfx_do_exit+0x10/0x10
[  129.325104]  make_task_dead+0x174/0x3b0
[  129.325116]  ? do_syscall_64+0xbf/0x360
[  129.325126]  rewind_stack_and_make_dead+0x16/0x20
[  129.325141] RIP: 0033:0x7fafdd468b19
[  129.325150] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  129.325161] RSP: 002b:00007fafda9de218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  129.325172] RAX: ffffffffffffffda RBX: 00007fafdd57bf68 RCX: 00007fafdd468b19
[  129.325180] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fafdd57bf6c
[  129.325188] RBP: 00007fafdd57bf60 R08: 000000000000000e R09: 0000000000000000
[  129.325196] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fafdd57bf6c
[  129.325203] R13: 00007ffd9a44913f R14: 00007fafda9de300 R15: 0000000000022000
[  129.325214]  </TASK>
11:28:49 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000480)=ANY=[@ANYBLOB="280000001100010000000000000000000700000001"], 0x28}], 0x1}, 0x0)

11:28:50 executing program 4:
syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_si_security={{0x2, 0x7}}}, 0xa)

11:28:50 executing program 6:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40001)
r2 = dup2(r1, r0)
write$binfmt_aout(r2, &(0x7f0000000080)=ANY=[], 0x2e)
ioctl$SG_IO(r2, 0x2286, &(0x7f00000022c0)={0x0, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

11:28:50 executing program 0:
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)

11:28:50 executing program 2:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40001)
r2 = dup2(r1, r0)
write$binfmt_aout(r2, &(0x7f0000000080)=ANY=[], 0x2e)
ioctl$SG_IO(r2, 0x2286, &(0x7f00000022c0)={0x0, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

11:28:50 executing program 5:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40001)
r2 = dup2(r1, r0)
write$binfmt_aout(r2, &(0x7f0000000080)=ANY=[], 0x2e)
ioctl$SG_IO(r2, 0x2286, &(0x7f00000022c0)={0x0, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

11:28:50 executing program 1:
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000001b00))
syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_conn_request={{0x4, 0xa}, {@none, '-&&', 0x1}}}, 0xd)
syz_mount_image$iso9660(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
removexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='system.posix_acl_default\x00')
syz_emit_vhci(&(0x7f00000000c0)=@HCI_EVENT_PKT={0x4, @hci_ev_hardware_error={{0x10, 0x1}, {0x8}}}, 0x4)

11:28:50 executing program 3:
r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040))
r1 = creat(&(0x7f00000003c0)='./file0\x00', 0x0)
fallocate(r1, 0x0, 0x0, 0x9)

11:28:50 executing program 7:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
msgget$private(0x0, 0x0)
msgctl$IPC_STAT(0x0, 0x2, &(0x7f0000001340)=""/4096)

[  130.168527] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#2] SMP KASAN NOPTI
[  130.170223] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[  130.171487] CPU: 0 UID: 0 PID: 3977 Comm: syz-executor.3 Tainted: G      D W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  130.173244] Tainted: [D]=DIE, [W]=WARN
[  130.173802] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  130.174988] RIP: 0010:perf_tp_event+0x175/0xe70
[  130.175697] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  130.178348] RSP: 0018:ffff888015b17600 EFLAGS: 00010212
[  130.179139] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc90005e38000
[  130.180193] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190
[  130.181228] RBP: ffff888015b17870 R08: ffff88806ce31340 R09: ffffe8ffffc15cf8
[  130.182260] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
[  130.183293] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000
[  130.184351] FS:  00007fafda9de700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
[  130.185520] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  130.186382] CR2: 0000555555b35708 CR3: 000000001f21f000 CR4: 0000000000350ef0
[  130.187419] Call Trace:
[  130.187800]  <TASK>
[  130.188173]  ? __kernel_text_address+0xd/0x40
[  130.188852]  ? unwind_get_return_address+0x59/0xa0
[  130.189599]  ? __pfx_perf_tp_event+0x10/0x10
[  130.190278]  ? stack_trace_save+0x8e/0xc0
[  130.190888]  ? stack_depot_save_flags+0x2c/0xa20
[  130.191594]  ? do_raw_spin_lock+0x123/0x260
[  130.192270]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  130.192961]  ? lock_acquire+0x18c/0x2f0
[  130.193560]  ? path_openat+0x1c3f/0x2880
[  130.194171]  ? do_filp_open+0x1e8/0x450
[  130.194750]  ? __dquot_initialize+0x29d/0xcf0
[  130.195433]  ? lock_release+0x1c7/0x290
[  130.196039]  ? _raw_spin_unlock_irqrestore+0x2c/0x50
[  130.196820]  ? __pfx___dquot_initialize+0x10/0x10
[  130.197542]  ? do_raw_spin_lock+0x123/0x260
[  130.198197]  ? perf_trace_run_bpf_submit+0xef/0x180
[  130.198929]  ? lock_release+0x1c7/0x290
[  130.199519]  perf_trace_run_bpf_submit+0xef/0x180
[  130.200288]  perf_trace_lock+0x337/0x5d0
[  130.200899]  ? __pfx_perf_trace_lock+0x10/0x10
[  130.201583]  ? kernel_text_address+0x5b/0xc0
[  130.202244]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  130.203036]  ? get_futex_key+0x592/0x14a0
[  130.203656]  ? futex_ref_get+0x114/0x300
[  130.204353]  ? futex_hash+0x15c/0x390
[  130.204925]  lock_release+0x1ab/0x290
[  130.205504]  ? futex_hash+0x15c/0x390
[  130.206076]  futex_ref_get+0x119/0x300
[  130.206649]  ? futex_hash+0x15c/0x390
[  130.207216]  futex_hash+0x70/0x390
[  130.207743]  futex_wait_setup+0xae/0x550
[  130.208399]  __futex_wait+0x151/0x300
[  130.208968]  ? __pfx___futex_wait+0x10/0x10
[  130.209624]  ? perf_trace_lock+0xb5/0x5d0
[  130.210249]  ? trace_irq_enable.constprop.0+0xc2/0x100
[  130.211013]  ? __pfx_futex_wake_mark+0x10/0x10
[  130.211711]  ? perf_trace_lock+0xb5/0x5d0
[  130.212351]  ? __perf_event_task_sched_in+0x1e1/0x5e0
[  130.213118]  ? __pfx_perf_trace_lock+0x10/0x10
[  130.213804]  futex_wait+0xde/0x380
[  130.214351]  ? __pfx_futex_wait+0x10/0x10
[  130.214958]  ? finish_task_switch.isra.0+0x201/0x840
[  130.215719]  ? lock_release+0x1c7/0x290
[  130.216344]  ? trace_irq_enable.constprop.0+0xc2/0x100
[  130.217119]  ? finish_task_switch.isra.0+0x206/0x840
[  130.217867]  do_futex+0x2ee/0x370
[  130.218399]  ? __pfx_do_futex+0x10/0x10
[  130.218997]  ? __pfx___schedule+0x10/0x10
[  130.219624]  __x64_sys_futex+0x1c9/0x4d0
[  130.220268]  ? __pfx___x64_sys_futex+0x10/0x10
[  130.220948]  ? xfd_validate_state+0x55/0x180
[  130.221629]  do_syscall_64+0xbf/0x360
[  130.222205]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  130.222947] RIP: 0033:0x7fafdd468b19
[  130.223506] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  130.226129] RSP: 002b:00007fafda9de218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  130.227223] RAX: ffffffffffffffda RBX: 00007fafdd57bf68 RCX: 00007fafdd468b19
[  130.228278] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fafdd57bf68
[  130.229317] RBP: 00007fafdd57bf60 R08: 0000000000000000 R09: 0000000000000000
[  130.230352] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fafdd57bf6c
[  130.231378] R13: 00007ffd9a44913f R14: 00007fafda9de300 R15: 0000000000022000
[  130.232449]  </TASK>
[  130.232806] Modules linked in:
[  130.233309] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#3] SMP KASAN NOPTI
[  130.235243] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[  130.236527] CPU: 1 UID: 0 PID: 3979 Comm: syz-executor.5 Tainted: G      D W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  130.238528] Tainted: [D]=DIE, [W]=WARN
[  130.239172] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  130.240563] RIP: 0010:perf_tp_event+0x175/0xe70
[  130.241369] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  130.244383] RSP: 0018:ffff888045bff800 EFLAGS: 00010212
[  130.245271] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[  130.246465] RDX: ffff888043f95280 RSI: ffffffff818995b7 RDI: 0000000000000191
[  130.247656] RBP: ffff888045bffa70 R08: ffff88806cf31340 R09: ffffe8ffffd15cf8
[  130.248868] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
[  130.250045] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[  130.251246] FS:  0000555558976400(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000
[  130.252594] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  130.253566] CR2: 0000555558977c18 CR3: 0000000009d05000 CR4: 0000000000350ef0
[  130.254744] Call Trace:
[  130.255186]  <TASK>
[  130.255585]  ? arch_scale_cpu_capacity+0x17/0xa0
[  130.256424]  ? __pfx_perf_tp_event+0x10/0x10
[  130.257174]  ? __asan_memset+0x24/0x50
[  130.257860]  ? __pfx_perf_trace_lock+0x10/0x10
[  130.258634]  ? __pfx___mutex_lock+0x10/0x10
[  130.259374]  ? perf_trace_lock+0xb5/0x5d0
[  130.260093]  ? kvm_sched_clock_read+0x16/0x30
[  130.260865]  ? sched_clock+0x37/0x60
[  130.261505]  ? sched_clock_cpu+0x6c/0x4e0
[  130.262222]  ? perf_trace_run_bpf_submit+0xef/0x180
[  130.263060]  perf_trace_run_bpf_submit+0xef/0x180
[  130.263897]  perf_trace_lock+0x337/0x5d0
[  130.264605]  ? __pfx_perf_trace_lock+0x10/0x10
[  130.265389]  ? __pfx_perf_trace_lock+0x10/0x10
[  130.266170]  ? get_futex_key+0x592/0x14a0
[  130.266877]  ? futex_ref_get+0x114/0x300
[  130.267561]  ? futex_hash+0x15c/0x390
[  130.268233]  lock_release+0x1ab/0x290
[  130.268888]  ? futex_hash+0x15c/0x390
[  130.269542]  futex_ref_get+0x119/0x300
[  130.270204]  ? futex_hash+0x15c/0x390
[  130.270852]  futex_hash+0x70/0x390
[  130.271466]  futex_wake+0x143/0x540
[  130.272125]  ? put_pid+0x1f/0x30
[  130.272706]  ? kernel_clone+0x204/0x7f0
[  130.273395]  ? __pfx_futex_wake+0x10/0x10
[  130.274105]  ? __pfx_kernel_clone+0x10/0x10
[  130.274839]  ? perf_trace_lock+0xb5/0x5d0
[  130.275538]  ? __pfx___handle_mm_fault+0x10/0x10
[  130.276367]  do_futex+0x26d/0x370
[  130.276974]  ? __pfx_do_futex+0x10/0x10
[  130.277650]  ? __pfx___do_sys_clone+0x10/0x10
[  130.278409]  ? handle_mm_fault+0x590/0x9b0
[  130.279131]  __x64_sys_futex+0x1c9/0x4d0
[  130.279820]  ? __pfx___x64_sys_futex+0x10/0x10
[  130.280621]  ? trace_irq_enable.constprop.0+0xc2/0x100
[  130.281510]  do_syscall_64+0xbf/0x360
[  130.282164]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  130.283030] RIP: 0033:0x7fe7c7f80b19
[  130.283663] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  130.286666] RSP: 002b:00007fff86ceefa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  130.287949] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe7c7f80b19
[  130.289128] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe7c8093f68
[  130.290325] RBP: 00007fe7c8093f60 R08: 00007fe7c54f6700 R09: 0000000000000000
[  130.291509] R10: 00007fe7c54f6700 R11: 0000000000000246 R12: 00007fe7c8098a68
[  130.292707] R13: 00007fff86cef0b0 R14: 00007fe7c8093f60 R15: 000000000001fc10
[  130.293918]  </TASK>
[  130.294324] Modules linked in:
[  130.294886] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#4] SMP KASAN NOPTI
[  130.296582] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197]
[  130.297842] CPU: 0 UID: 0 PID: 3977 Comm: syz-executor.3 Tainted: G      D W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  130.299561] Tainted: [D]=DIE, [W]=WARN
[  130.300154] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  130.301397] RIP: 0010:perf_tp_event+0x175/0xe70
[  130.302136] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  130.304859] RSP: 0018:ffff88806ce08a80 EFLAGS: 00010012
[  130.305670] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002
[  130.306743] RDX: ffff88800f3ed280 RSI: ffffffff818995b7 RDI: 0000000100000190
[  130.307820] RBP: ffff88806ce08cf0 R08: ffff88806ce31490 R09: ffffe8ffffc15cf8
[  130.308916] R10: 0000000000000000 R11: ffff88806ce37018 R12: dffffc0000000000
[  130.309986] R13: 0000000000000024 R14: ffff88806ce31490 R15: dffffc0000000000
[  130.311059] FS:  00007fafda9de700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
[  130.312296] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  130.313187] CR2: 0000555555b35708 CR3: 000000001f21f000 CR4: 0000000000350ef0
[  130.314259] Call Trace:
[  130.314659]  <IRQ>
[  130.315009]  ? __pfx_perf_tp_event+0x10/0x10
[  130.315705]  ? perf_trace_lock+0xb5/0x5d0
[  130.316380]  ? perf_trace_lock+0xb5/0x5d0
[  130.317022]  ? stack_depot_save_flags+0x2c/0xa20
[  130.317754]  ? __pfx_perf_trace_lock+0x10/0x10
[  130.318461]  ? trace_softirq_raise+0xbe/0x100
[  130.319179]  ? kvm_sched_clock_read+0x16/0x30
[  130.319864]  ? sched_clock+0x37/0x60
[  130.320479]  ? select_task_rq_fair+0x48c/0x38b0
[  130.321201]  ? perf_trace_lock+0xb5/0x5d0
[  130.321839]  ? __pfx_perf_trace_lock+0x10/0x10
[  130.322535]  ? __smp_call_single_queue+0x15b/0x2f0
[  130.323289]  ? perf_trace_run_bpf_submit+0xef/0x180
[  130.324072]  perf_trace_run_bpf_submit+0xef/0x180
[  130.324839]  perf_trace_lock+0x337/0x5d0
[  130.325473]  ? place_entity+0x300/0x410
[  130.326094]  ? kvm_sched_clock_read+0x16/0x30
[  130.326786]  ? __pfx_perf_trace_lock+0x10/0x10
[  130.327491]  ? check_preempt_wakeup_fair+0x6e/0x950
[  130.328279]  ? lock_release+0x1c7/0x290
[  130.328871]  ? sched_ttwu_pending+0x2e0/0x4a0
[  130.329579]  lock_release+0x1ab/0x290
[  130.330173]  ? ttwu_do_activate+0x1a4/0x8a0
[  130.330838]  _raw_spin_unlock+0x16/0x40
[  130.331458]  sched_ttwu_pending+0x2e0/0x4a0
[  130.332155]  ? __pfx_sched_ttwu_pending+0x10/0x10
[  130.332898]  ? hrtimer_interrupt+0x652/0x830
[  130.333588]  __flush_smp_call_function_queue+0x434/0x740
[  130.334426]  __sysvec_call_function_single+0x6d/0x370
[  130.335225]  sysvec_call_function_single+0xa1/0xc0
[  130.336004]  </IRQ>
[  130.336373]  <TASK>
[  130.336721]  asm_sysvec_call_function_single+0x1a/0x20
[  130.337520] RIP: 0010:oops_exit+0x0/0x50
[  130.338151] Code: f1 39 00 be ff ff ff ff 48 c7 c7 50 ac 43 86 e8 c6 0f f9 ff 5b e9 20 f1 39 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <66> 0f 1f 00 53 e8 06 f1 39 00 8b 1d c0 ed 4e 06 31 ff 89 de e8 27
[  130.340853] RSP: 0018:ffff888015b17490 EFLAGS: 00000202
[  130.341666] RAX: 0000000000036338 RBX: 0000000000000206 RCX: ffffc90005e38000
[  130.342733] RDX: 0000000000040000 RSI: ffffffff812a3dca RDI: 0000000000000007
[  130.343816] RBP: 000000000000000b R08: 0000000000000001 R09: fffffbfff0f11c90
[  130.344896] R10: 0000000000000000 R11: 0000000000000001 R12: ffff888015b17558
[  130.345966] R13: 0000000000000000 R14: dffffc0020000032 R15: 0000000000000000
[  130.347035]  ? oops_end+0x4a/0xe0
[  130.347606]  oops_end+0x65/0xe0
[  130.348161]  exc_general_protection+0x1a2/0x330
[  130.348891]  asm_exc_general_protection+0x26/0x30
[  130.349615] RIP: 0010:perf_tp_event+0x175/0xe70
[  130.350327] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  130.353029] RSP: 0018:ffff888015b17600 EFLAGS: 00010212
[  130.353823] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc90005e38000
[  130.354892] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190
[  130.355975] RBP: ffff888015b17870 R08: ffff88806ce31340 R09: ffffe8ffffc15cf8
[  130.357062] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
[  130.358151] R13: 000000000000002c R14: ffff88806ce31340 R15: dffffc0000000000
[  130.359228]  ? perf_tp_event+0x167/0xe70
[  130.359938]  ? __kernel_text_address+0xd/0x40
[  130.360794]  ? unwind_get_return_address+0x59/0xa0
[  130.361640]  ? __pfx_perf_tp_event+0x10/0x10
[  130.362343]  ? stack_trace_save+0x8e/0xc0
[  130.362976]  ? stack_depot_save_flags+0x2c/0xa20
[  130.363698]  ? do_raw_spin_lock+0x123/0x260
[  130.364400]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  130.365133]  ? lock_acquire+0x18c/0x2f0
[  130.365739]  ? path_openat+0x1c3f/0x2880
[  130.366372]  ? do_filp_open+0x1e8/0x450
[  130.366980]  ? __dquot_initialize+0x29d/0xcf0
[  130.367677]  ? lock_release+0x1c7/0x290
[  130.368299]  ? _raw_spin_unlock_irqrestore+0x2c/0x50
[  130.369092]  ? __pfx___dquot_initialize+0x10/0x10
[  130.369836]  ? do_raw_spin_lock+0x123/0x260
[  130.370504]  ? perf_trace_run_bpf_submit+0xef/0x180
[  130.371273]  ? lock_release+0x1c7/0x290
[  130.371878]  perf_trace_run_bpf_submit+0xef/0x180
[  130.372633]  perf_trace_lock+0x337/0x5d0
[  130.373286]  ? __pfx_perf_trace_lock+0x10/0x10
[  130.373982]  ? kernel_text_address+0x5b/0xc0
[  130.374663]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  130.375500]  ? get_futex_key+0x592/0x14a0
[  130.376160]  ? futex_ref_get+0x114/0x300
[  130.376764]  ? futex_hash+0x15c/0x390
[  130.377371]  lock_release+0x1ab/0x290
[  130.377954]  ? futex_hash+0x15c/0x390
[  130.378541]  futex_ref_get+0x119/0x300
[  130.379145]  ? futex_hash+0x15c/0x390
[  130.379704]  futex_hash+0x70/0x390
[  130.380285]  futex_wait_setup+0xae/0x550
[  130.380920]  __futex_wait+0x151/0x300
[  130.381528]  ? __pfx___futex_wait+0x10/0x10
[  130.382200]  ? perf_trace_lock+0xb5/0x5d0
[  130.382822]  ? trace_irq_enable.constprop.0+0xc2/0x100
[  130.383626]  ? __pfx_futex_wake_mark+0x10/0x10
[  130.384362]  ? perf_trace_lock+0xb5/0x5d0
[  130.384996]  ? __perf_event_task_sched_in+0x1e1/0x5e0
[  130.385773]  ? __pfx_perf_trace_lock+0x10/0x10
[  130.386486]  futex_wait+0xde/0x380
[  130.387053]  ? __pfx_futex_wait+0x10/0x10
[  130.387700]  ? finish_task_switch.isra.0+0x201/0x840
[  130.388493]  ? lock_release+0x1c7/0x290
[  130.389131]  ? trace_irq_enable.constprop.0+0xc2/0x100
[  130.389915]  ? finish_task_switch.isra.0+0x206/0x840
[  130.390699]  do_futex+0x2ee/0x370
[  130.391246]  ? __pfx_do_futex+0x10/0x10
[  130.391868]  ? __pfx___schedule+0x10/0x10
[  130.392522]  __x64_sys_futex+0x1c9/0x4d0
[  130.393165]  ? __pfx___x64_sys_futex+0x10/0x10
[  130.393866]  ? xfd_validate_state+0x55/0x180
[  130.394555]  do_syscall_64+0xbf/0x360
[  130.395125]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  130.395866] RIP: 0033:0x7fafdd468b19
[  130.396447] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[  130.399107] RSP: 002b:00007fafda9de218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  130.400230] RAX: ffffffffffffffda RBX: 00007fafdd57bf68 RCX: 00007fafdd468b19
[  130.401275] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fafdd57bf68
[  130.402333] RBP: 00007fafdd57bf60 R08: 0000000000000000 R09: 0000000000000000
[  130.403362] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fafdd57bf6c
[  130.404421] R13: 00007ffd9a44913f R14: 00007fafda9de300 R15: 0000000000022000
[  130.405480]  </TASK>
[  130.405829] Modules linked in:
[  130.406330] ---[ end trace 0000000000000000 ]---
[  130.406339] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#5] SMP KASAN NOPTI
[  130.407002] RIP: 0010:perf_tp_event+0x175/0xe70
[  130.408768] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[  130.409466] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  130.410600] CPU: 1 UID: 0 PID: 3979 Comm: syz-executor.5 Tainted: G      D W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
[  130.413227] RSP: 0018:ffff888013dff800 EFLAGS: 00010212
[  130.414996] Tainted: [D]=DIE, [W]=WARN
[  130.415007] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[  130.415764] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc90005e38000
[  130.416360] RIP: 0010:perf_tp_event+0x175/0xe70
[  130.417585] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190
[  130.418678] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[  130.419355] RBP: ffff888013dffa70 R08: ffff88806cf31340 R09: ffffe8ffffd15cf8
[  130.420452] RSP: 0018:ffff88806cf08a80 EFLAGS: 00010012
[  130.423156] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[  130.424255] 
[  130.425031] R13: 000000000000002c R14: ffff88806cf31340 R15: dffffc0000000000
[  130.426126] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[  130.426384] FS:  00007fafda9de700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
[  130.427480] RDX: ffff888043f95280 RSI: ffffffff818995b7 RDI: 0000000000000191
[  130.428567] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  130.429790] RBP: ffff88806cf08cf0 R08: ffff88806cf31490 R09: ffffe8ffffd15cf8
[  130.430846] CR2: 0000555555b35708 CR3: 000000001f21f000 CR4: 0000000000350ef0
[  130.431726] R10: 0000000000000000 R11: 746e756f63716573 R12: dffffc0000000000
[  130.432794] Kernel panic - not syncing: Fatal exception in interrupt
[  131.541445] Shutting down cpus with NMI
[  131.544253] Kernel Offset: disabled
[  131.544775] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

VM DIAGNOSIS:
11:28:49  Registers:
info registers vcpu 0
RAX=00007f3150612f58 RBX=00007f3150612a18 RCX=ffffffff81852512 RDX=ffffffff81852512
RSI=00007f3150612a20 RDI=ffffffff8185251f RBP=00007f31506128e0 RSP=00007ffc38c5cff0
R8 =00007f3150613360 R9 =0000001b2d322d98 R10=000000000000188c R11=000000008bccd890
R12=00007f31506128d8 R13=00007f3150612a18 R14=00007f31506128d0 R15=0000000000000015
RIP=00007f31507ff9cd RFL=00000287 [--S--PC] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0033 0000000000000000 ffffffff 00a0fb00 DPL=3 CS64 [-RA]
SS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00005555686f4400 00000000 00000000
GS =0000 0000000000000000 00000000 00000000
LDT=0000 fffffe5e00000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b2d324000 CR3=000000000da45000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000ff00000000000000000000 XMM01=616e65706f007366636f72702474616e
XMM02=00000000000000000000000000000000 XMM03=00007f31509387c800007f31509387c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=0000000000000064 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff828e32c5 RDI=ffffffff88724180 RBP=ffffffff88724140 RSP=ffff888013dff170
R8 =0000000000000000 R9 =ffffed10013bf046 R10=0000000000000064 R11=313030203a505352
R12=0000000000000064 R13=0000000000000010 R14=ffffffff88724140 R15=ffffffff828e32b0
RIP=ffffffff828e331d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007fafda9de700 00000000 00000000
GS =0000 ffff8880e56dd000 00000000 00000000
LDT=0000 fffffe7c00000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000555555b36c18 CR3=000000001c2ee000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00007fafdd54f7c000007fafdd54f7c8
XMM02=00007fafdd54f7e000007fafdd54f7c0 XMM03=00007fafdd54f7c800007fafdd54f7c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000