Warning: Permanently added '[localhost]:20972' (ECDSA) to the list of known hosts. 2025/08/29 09:11:01 fuzzer started 2025/08/29 09:11:02 dialing manager at localhost:43077 syzkaller login: [ 59.451740] cgroup: Unknown subsys name 'net' [ 59.538383] cgroup: Unknown subsys name 'cpuset' [ 59.552797] cgroup: Unknown subsys name 'rlimit' 2025/08/29 09:11:12 syscalls: 2214 2025/08/29 09:11:12 code coverage: enabled 2025/08/29 09:11:12 comparison tracing: enabled 2025/08/29 09:11:12 extra coverage: enabled 2025/08/29 09:11:12 setuid sandbox: enabled 2025/08/29 09:11:12 namespace sandbox: enabled 2025/08/29 09:11:12 Android sandbox: enabled 2025/08/29 09:11:12 fault injection: enabled 2025/08/29 09:11:12 leak checking: enabled 2025/08/29 09:11:12 net packet injection: enabled 2025/08/29 09:11:12 net device setup: enabled 2025/08/29 09:11:12 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/08/29 09:11:12 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/08/29 09:11:12 USB emulation: enabled 2025/08/29 09:11:12 hci packet injection: enabled 2025/08/29 09:11:12 wifi device emulation: enabled 2025/08/29 09:11:12 802.15.4 emulation: enabled 2025/08/29 09:11:12 fetching corpus: 0, signal 0/2000 (executing program) 2025/08/29 09:11:12 fetching corpus: 50, signal 22663/26007 (executing program) 2025/08/29 09:11:13 fetching corpus: 100, signal 37140/41470 (executing program) 2025/08/29 09:11:13 fetching corpus: 150, signal 47497/52632 (executing program) 2025/08/29 09:11:13 fetching corpus: 200, signal 55654/61469 (executing program) 2025/08/29 09:11:13 fetching corpus: 250, signal 59918/66464 (executing program) 2025/08/29 09:11:13 fetching corpus: 300, signal 66613/73607 (executing program) 2025/08/29 09:11:13 fetching corpus: 350, signal 70223/77837 (executing program) 2025/08/29 09:11:13 fetching corpus: 400, signal 72967/81116 (executing program) 2025/08/29 09:11:13 fetching corpus: 450, signal 74878/83653 (executing program) 2025/08/29 09:11:13 fetching corpus: 500, signal 78178/87335 (executing program) 2025/08/29 09:11:13 fetching corpus: 550, signal 80759/90393 (executing program) 2025/08/29 09:11:14 fetching corpus: 600, signal 83137/93148 (executing program) 2025/08/29 09:11:14 fetching corpus: 650, signal 85336/95695 (executing program) 2025/08/29 09:11:14 fetching corpus: 700, signal 87097/97787 (executing program) 2025/08/29 09:11:14 fetching corpus: 750, signal 89881/100569 (executing program) 2025/08/29 09:11:14 fetching corpus: 800, signal 91183/102193 (executing program) 2025/08/29 09:11:14 fetching corpus: 850, signal 92584/103871 (executing program) 2025/08/29 09:11:14 fetching corpus: 900, signal 94133/105624 (executing program) 2025/08/29 09:11:14 fetching corpus: 950, signal 96119/107674 (executing program) 2025/08/29 09:11:14 fetching corpus: 1000, signal 98101/109548 (executing program) 2025/08/29 09:11:15 fetching corpus: 1050, signal 99504/111038 (executing program) 2025/08/29 09:11:15 fetching corpus: 1100, signal 100792/112443 (executing program) 2025/08/29 09:11:15 fetching corpus: 1150, signal 102629/114114 (executing program) 2025/08/29 09:11:15 fetching corpus: 1200, signal 103831/115361 (executing program) 2025/08/29 09:11:15 fetching corpus: 1250, signal 105502/116854 (executing program) 2025/08/29 09:11:15 fetching corpus: 1300, signal 106902/118162 (executing program) 2025/08/29 09:11:15 fetching corpus: 1350, signal 107888/119138 (executing program) 2025/08/29 09:11:15 fetching corpus: 1400, signal 108794/120137 (executing program) 2025/08/29 09:11:16 fetching corpus: 1450, signal 109870/121133 (executing program) 2025/08/29 09:11:16 fetching corpus: 1500, signal 110917/122072 (executing program) 2025/08/29 09:11:16 fetching corpus: 1550, signal 111809/122875 (executing program) 2025/08/29 09:11:16 fetching corpus: 1600, signal 112848/123771 (executing program) 2025/08/29 09:11:16 fetching corpus: 1650, signal 114141/124756 (executing program) 2025/08/29 09:11:16 fetching corpus: 1700, signal 115996/125916 (executing program) 2025/08/29 09:11:16 fetching corpus: 1750, signal 117469/126856 (executing program) 2025/08/29 09:11:17 fetching corpus: 1800, signal 118466/127542 (executing program) 2025/08/29 09:11:17 fetching corpus: 1850, signal 119942/128422 (executing program) 2025/08/29 09:11:17 fetching corpus: 1900, signal 120681/129025 (executing program) 2025/08/29 09:11:17 fetching corpus: 1950, signal 121407/129540 (executing program) 2025/08/29 09:11:17 fetching corpus: 2000, signal 122332/130104 (executing program) 2025/08/29 09:11:17 fetching corpus: 2050, signal 123669/130816 (executing program) 2025/08/29 09:11:17 fetching corpus: 2100, signal 124654/131330 (executing program) 2025/08/29 09:11:17 fetching corpus: 2150, signal 125416/131745 (executing program) 2025/08/29 09:11:17 fetching corpus: 2200, signal 127358/132567 (executing program) 2025/08/29 09:11:18 fetching corpus: 2250, signal 127889/132822 (executing program) 2025/08/29 09:11:18 fetching corpus: 2300, signal 128876/133408 (executing program) 2025/08/29 09:11:18 fetching corpus: 2350, signal 129456/133669 (executing program) 2025/08/29 09:11:18 fetching corpus: 2400, signal 130105/133947 (executing program) 2025/08/29 09:11:18 fetching corpus: 2450, signal 130754/134165 (executing program) 2025/08/29 09:11:18 fetching corpus: 2500, signal 131591/134501 (executing program) 2025/08/29 09:11:18 fetching corpus: 2550, signal 132204/134703 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132792/134854 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/134876 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/134914 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/134964 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/134988 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/135038 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/135085 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/135117 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/135159 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/135204 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/135254 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/135295 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/135344 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/135358 (executing program) 2025/08/29 09:11:18 fetching corpus: 2576, signal 132793/135358 (executing program) 2025/08/29 09:11:20 starting 8 fuzzer processes 09:11:20 executing program 0: syz_emit_ethernet(0x83, &(0x7f0000000400)={@link_local, @broadcast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "409d26", 0x4d, 0x88, 0x0, @private0, @mcast2, {[], {0x0, 0x0, 0x4d, 0x0, @gue={{0x2}, "37020e94febd24d51dc3e7aa99f4babd49c5a89bb9076365751d31e1db2d9f4806589ffa8c4e0ff7a2172b76deba9435db55aa771dff42662679ca3f79"}}}}}}}, 0x0) 09:11:20 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x1d, &(0x7f0000000000), 0x4) 09:11:20 executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0080}]}) vmsplice(r0, 0x0, 0x0, 0x0) 09:11:20 executing program 6: syz_emit_ethernet(0x1265, 0x0, 0x0) 09:11:20 executing program 4: syz_mount_image$msdos(0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)) [ 77.997928] audit: type=1400 audit(1756458680.949:7): avc: denied { execmem } for pid=276 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 09:11:20 executing program 5: r0 = fsopen(&(0x7f0000000040)='debugfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000080)='\x00', 0x0, 0x0) 09:11:20 executing program 2: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4442, 0x0) writev(r0, &(0x7f0000001640)=[{&(0x7f0000000080)="b9", 0x1}, {0x0, 0x800000}, {&(0x7f0000001580)}], 0x3) 09:11:20 executing program 7: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f00000000c0), 0x10) [ 79.157534] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 79.161896] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 79.164472] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 79.168249] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 79.170291] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 79.173779] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 79.176808] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 79.184599] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 79.189785] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 79.200915] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 79.279100] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 79.282400] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 79.284169] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 79.297984] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 79.300272] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 79.356608] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 79.373067] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 79.374929] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 79.378835] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 79.380939] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 79.382739] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 79.384278] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 79.386052] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 79.387643] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 79.390486] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 79.391793] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 79.392969] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 79.394921] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 79.396296] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 79.397855] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 79.405276] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 79.412993] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 79.444707] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 79.446138] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 79.452953] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 79.455109] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 79.456706] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 79.462237] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 79.474584] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 79.483724] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 81.250728] Bluetooth: hci0: command tx timeout [ 81.251417] Bluetooth: hci1: command tx timeout [ 81.378382] Bluetooth: hci2: command tx timeout [ 81.442410] Bluetooth: hci6: command tx timeout [ 81.506488] Bluetooth: hci3: command tx timeout [ 81.570509] Bluetooth: hci7: command tx timeout [ 81.571516] Bluetooth: hci5: command tx timeout [ 81.634369] Bluetooth: hci4: command tx timeout [ 83.298403] Bluetooth: hci1: command tx timeout [ 83.298847] Bluetooth: hci0: command tx timeout [ 83.426469] Bluetooth: hci2: command tx timeout [ 83.490384] Bluetooth: hci6: command tx timeout [ 83.554421] Bluetooth: hci3: command tx timeout [ 83.618566] Bluetooth: hci5: command tx timeout [ 83.619015] Bluetooth: hci7: command tx timeout [ 83.682500] Bluetooth: hci4: command tx timeout [ 85.347779] Bluetooth: hci1: command tx timeout [ 85.348238] Bluetooth: hci0: command tx timeout [ 85.474405] Bluetooth: hci2: command tx timeout [ 85.540411] Bluetooth: hci6: command tx timeout [ 85.602362] Bluetooth: hci3: command tx timeout [ 85.666395] Bluetooth: hci5: command tx timeout [ 85.666952] Bluetooth: hci7: command tx timeout [ 85.730396] Bluetooth: hci4: command tx timeout [ 87.394406] Bluetooth: hci1: command tx timeout [ 87.394856] Bluetooth: hci0: command tx timeout [ 87.522417] Bluetooth: hci2: command tx timeout [ 87.586453] Bluetooth: hci6: command tx timeout [ 87.650479] Bluetooth: hci3: command tx timeout [ 87.714396] Bluetooth: hci7: command tx timeout [ 87.714800] Bluetooth: hci5: command tx timeout [ 87.778485] Bluetooth: hci4: command tx timeout [ 117.503000] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.503693] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.758770] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.759405] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.106483] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.107134] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.176488] audit: type=1400 audit(1756458721.123:8): avc: denied { open } for pid=3792 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 118.182408] audit: type=1400 audit(1756458721.124:9): avc: denied { kernel } for pid=3792 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 118.262839] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.263480] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 09:12:01 executing program 2: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4442, 0x0) writev(r0, &(0x7f0000001640)=[{&(0x7f0000000080)="b9", 0x1}, {0x0, 0x800000}, {&(0x7f0000001580)}], 0x3) 09:12:01 executing program 2: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4442, 0x0) writev(r0, &(0x7f0000001640)=[{&(0x7f0000000080)="b9", 0x1}, {0x0, 0x800000}, {&(0x7f0000001580)}], 0x3) 09:12:01 executing program 5: r0 = fsopen(&(0x7f0000000040)='debugfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000080)='\x00', 0x0, 0x0) 09:12:01 executing program 2: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4442, 0x0) writev(r0, &(0x7f0000001640)=[{&(0x7f0000000080)="b9", 0x1}, {0x0, 0x800000}, {&(0x7f0000001580)}], 0x3) 09:12:01 executing program 5: r0 = fsopen(&(0x7f0000000040)='debugfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000080)='\x00', 0x0, 0x0) [ 118.785582] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.786173] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 09:12:01 executing program 5: r0 = fsopen(&(0x7f0000000040)='debugfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000080)='\x00', 0x0, 0x0) 09:12:01 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@link_local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "708329", 0x14, 0x2b, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) [ 118.932803] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.933434] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 09:12:01 executing program 5: sendmsg$ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x24044081) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan0\x00'}) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000005880)={0x64060100, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) [ 118.989126] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.989749] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.090661] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.091296] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.190411] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.191029] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.263927] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.264534] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.348889] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.350116] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.457163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.457790] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.662880] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.663519] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.692254] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.692857] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.723130] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.723749] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.743731] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.744289] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 09:12:02 executing program 5: sendmsg$ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x24044081) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan0\x00'}) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000005880)={0x64060100, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 09:12:02 executing program 6: syz_emit_ethernet(0x1265, 0x0, 0x0) 09:12:02 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0, 0x9) 09:12:02 executing program 0: syz_emit_ethernet(0x83, &(0x7f0000000400)={@link_local, @broadcast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "409d26", 0x4d, 0x88, 0x0, @private0, @mcast2, {[], {0x0, 0x0, 0x4d, 0x0, @gue={{0x2}, "37020e94febd24d51dc3e7aa99f4babd49c5a89bb9076365751d31e1db2d9f4806589ffa8c4e0ff7a2172b76deba9435db55aa771dff42662679ca3f79"}}}}}}}, 0x0) 09:12:02 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@link_local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "708329", 0x14, 0x2b, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 09:12:02 executing program 4: syz_mount_image$msdos(0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)) 09:12:02 executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0080}]}) vmsplice(r0, 0x0, 0x0, 0x0) 09:12:02 executing program 7: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f00000000c0), 0x10) 09:12:02 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@link_local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "708329", 0x14, 0x2b, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 09:12:02 executing program 4: syz_mount_image$msdos(0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)) 09:12:02 executing program 0: syz_emit_ethernet(0x83, &(0x7f0000000400)={@link_local, @broadcast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "409d26", 0x4d, 0x88, 0x0, @private0, @mcast2, {[], {0x0, 0x0, 0x4d, 0x0, @gue={{0x2}, "37020e94febd24d51dc3e7aa99f4babd49c5a89bb9076365751d31e1db2d9f4806589ffa8c4e0ff7a2172b76deba9435db55aa771dff42662679ca3f79"}}}}}}}, 0x0) 09:12:02 executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0080}]}) vmsplice(r0, 0x0, 0x0, 0x0) 09:12:02 executing program 6: syz_emit_ethernet(0x1265, 0x0, 0x0) 09:12:03 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@link_local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "708329", 0x14, 0x2b, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) 09:12:03 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0, 0x9) 09:12:03 executing program 4: syz_mount_image$msdos(0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)) 09:12:03 executing program 5: sendmsg$ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x24044081) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan0\x00'}) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000005880)={0x64060100, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 09:12:03 executing program 4: r0 = io_uring_setup(0x5053, &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x22, &(0x7f0000000580)=[0xffffffffffffffff, 0xffffffffffffffff], 0x2) 09:12:03 executing program 2: r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0) fadvise64(r0, 0xc000000000000000, 0x65, 0x0) 09:12:03 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0, 0x9) 09:12:03 executing program 0: syz_emit_ethernet(0x83, &(0x7f0000000400)={@link_local, @broadcast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "409d26", 0x4d, 0x88, 0x0, @private0, @mcast2, {[], {0x0, 0x0, 0x4d, 0x0, @gue={{0x2}, "37020e94febd24d51dc3e7aa99f4babd49c5a89bb9076365751d31e1db2d9f4806589ffa8c4e0ff7a2172b76deba9435db55aa771dff42662679ca3f79"}}}}}}}, 0x0) 09:12:03 executing program 7: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f00000000c0), 0x10) 09:12:03 executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0080}]}) vmsplice(r0, 0x0, 0x0, 0x0) 09:12:03 executing program 6: syz_emit_ethernet(0x1265, 0x0, 0x0) [ 120.282439] kmemleak: Found object by alias at 0x607f1a639c14 [ 120.282460] CPU: 1 UID: 0 PID: 3951 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 120.282479] Tainted: [W]=WARN [ 120.282482] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 120.282490] Call Trace: [ 120.282494] [ 120.282499] dump_stack_lvl+0xca/0x120 [ 120.282525] __lookup_object+0x94/0xb0 [ 120.282542] delete_object_full+0x27/0x70 [ 120.282558] free_percpu+0x30/0x1160 [ 120.282574] ? arch_uprobe_clear_state+0x16/0x140 [ 120.282595] futex_hash_free+0x38/0xc0 [ 120.282610] mmput+0x2d3/0x390 [ 120.282629] do_exit+0x79d/0x2970 [ 120.282643] ? signal_wake_up_state+0x85/0x120 [ 120.282659] ? zap_other_threads+0x2b9/0x3a0 [ 120.282675] ? __pfx_do_exit+0x10/0x10 [ 120.282688] ? do_group_exit+0x1c3/0x2a0 [ 120.282701] ? lock_release+0xc8/0x290 [ 120.282719] do_group_exit+0xd3/0x2a0 [ 120.282734] __x64_sys_exit_group+0x3e/0x50 [ 120.282748] x64_sys_call+0x18c5/0x18d0 [ 120.282763] do_syscall_64+0xbf/0x360 [ 120.282775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.282786] RIP: 0033:0x7f4ccbe02b19 [ 120.282795] Code: Unable to access opcode bytes at 0x7f4ccbe02aef. [ 120.282800] RSP: 002b:00007fff49a52308 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 120.282812] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f4ccbe02b19 [ 120.282819] RDX: 00007f4ccbdb572b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 120.282826] RBP: 0000000000000000 R08: 0000001b2d921f2c R09: 0000000000000000 [ 120.282833] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 120.282840] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fff49a523f0 [ 120.282857] [ 120.282861] kmemleak: Object (percpu) 0x607f1a639c08 (size 16): [ 120.282868] kmemleak: comm "syz-executor.3", pid 291, jiffies 4294786809 [ 120.282875] kmemleak: min_count = 1 [ 120.282878] kmemleak: count = 0 [ 120.282882] kmemleak: flags = 0x21 [ 120.282886] kmemleak: checksum = 0 [ 120.282889] kmemleak: backtrace: [ 120.282893] pcpu_alloc_noprof+0x87a/0x1170 [ 120.282907] mm_init+0x99b/0x1170 [ 120.282915] copy_process+0x3ab7/0x73c0 [ 120.282925] kernel_clone+0xea/0x7f0 [ 120.282935] __do_sys_clone+0xce/0x120 [ 120.282945] do_syscall_64+0xbf/0x360 [ 120.282953] entry_SYSCALL_64_after_hwframe+0x77/0x7f 09:12:03 executing program 2: r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0) fadvise64(r0, 0xc000000000000000, 0x65, 0x0) 09:12:03 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)={0x20, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x4}]]}, 0x20}}, 0x0) 09:12:03 executing program 4: r0 = io_uring_setup(0x5053, &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x22, &(0x7f0000000580)=[0xffffffffffffffff, 0xffffffffffffffff], 0x2) 09:12:03 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0, 0x9) 09:12:03 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = fork() ptrace(0x10, r0) ptrace(0x8, r0) wait4(r0, &(0x7f0000000240), 0x8, &(0x7f0000000280)) [ 120.408678] kmemleak: Found object by alias at 0x607f1a639c10 [ 120.408696] CPU: 1 UID: 0 PID: 3970 Comm: syz-executor.4 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 120.408714] Tainted: [W]=WARN [ 120.408718] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 120.408725] Call Trace: [ 120.408729] [ 120.408734] dump_stack_lvl+0xca/0x120 [ 120.408763] __lookup_object+0x94/0xb0 [ 120.408781] delete_object_full+0x27/0x70 [ 120.408798] free_percpu+0x30/0x1160 [ 120.408814] ? arch_uprobe_clear_state+0x16/0x140 [ 120.408835] futex_hash_free+0x38/0xc0 [ 120.408850] mmput+0x2d3/0x390 [ 120.408869] do_exit+0x79d/0x2970 [ 120.408883] ? signal_wake_up_state+0x85/0x120 [ 120.408900] ? zap_other_threads+0x2b9/0x3a0 [ 120.408916] ? __pfx_do_exit+0x10/0x10 [ 120.408928] ? do_group_exit+0x1c3/0x2a0 [ 120.408945] ? lock_release+0xc8/0x290 [ 120.408964] do_group_exit+0xd3/0x2a0 [ 120.408979] __x64_sys_exit_group+0x3e/0x50 [ 120.408992] x64_sys_call+0x18c5/0x18d0 [ 120.409008] do_syscall_64+0xbf/0x360 [ 120.409020] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.409032] RIP: 0033:0x7f2addc21b19 [ 120.409041] Code: Unable to access opcode bytes at 0x7f2addc21aef. [ 120.409046] RSP: 002b:00007ffd65a32e18 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 120.409057] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f2addc21b19 [ 120.409065] RDX: 00007f2addbd472b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 120.409072] RBP: 0000000000000000 R08: 0000001b2d8229b8 R09: 0000000000000000 [ 120.409079] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 120.409086] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffd65a32f00 [ 120.409103] [ 120.409107] kmemleak: Object (percpu) 0x607f1a639c08 (size 16): [ 120.409114] kmemleak: comm "syz-executor.2", pid 288, jiffies 4294786922 [ 120.409121] kmemleak: min_count = 1 [ 120.409125] kmemleak: count = 0 [ 120.409129] kmemleak: flags = 0x21 [ 120.409133] kmemleak: checksum = 0 [ 120.409136] kmemleak: backtrace: [ 120.409140] pcpu_alloc_noprof+0x87a/0x1170 [ 120.409155] mm_init+0x99b/0x1170 [ 120.409163] copy_process+0x3ab7/0x73c0 [ 120.409173] kernel_clone+0xea/0x7f0 [ 120.409183] __do_sys_clone+0xce/0x120 [ 120.409193] do_syscall_64+0xbf/0x360 [ 120.409201] entry_SYSCALL_64_after_hwframe+0x77/0x7f 09:12:03 executing program 7: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f00000000c0), 0x10) 09:12:03 executing program 4: r0 = io_uring_setup(0x5053, &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x22, &(0x7f0000000580)=[0xffffffffffffffff, 0xffffffffffffffff], 0x2) 09:12:03 executing program 2: r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x0) fadvise64(r0, 0xc000000000000000, 0x65, 0x0) [ 120.454808] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#1] SMP KASAN NOPTI [ 120.455711] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197] [ 120.456395] CPU: 1 UID: 0 PID: 3972 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 120.457965] Tainted: [W]=WARN [ 120.458837] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 120.460661] RIP: 0010:perf_tp_event+0x175/0xe70 [ 120.461717] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 120.466253] RSP: 0018:ffff888044f57780 EFLAGS: 00010012 [ 120.466700] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc9000a085000 [ 120.467292] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 120.467890] RBP: ffff888044f579f0 R08: ffff88806cf31340 R09: ffffe8ffffd16c10 [ 120.468476] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 120.469065] R13: 0000000000000014 R14: ffff88806cf31340 R15: dffffc0000000000 [ 120.469656] FS: 00007f4cc9378700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000 [ 120.470326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 120.470809] CR2: 00007f9525c03018 CR3: 0000000013f1b000 CR4: 0000000000350ef0 [ 120.471395] Call Trace: [ 120.471615] [ 120.471808] ? __pfx_perf_tp_event+0x10/0x10 [ 120.472182] ? perf_trace_lock+0xb5/0x5d0 [ 120.472536] ? perf_trace_lock+0xb5/0x5d0 [ 120.472882] ? __mutex_add_waiter+0x202/0x220 [ 120.473264] ? __pfx_perf_trace_lock+0x10/0x10 [ 120.473654] ? lock_acquire+0x15e/0x2f0 [ 120.473990] ? __is_insn_slot_addr+0x2e/0x290 [ 120.474376] ? find_held_lock+0x2b/0x80 [ 120.474717] ? perf_trace_lock+0xb5/0x5d0 [ 120.475065] ? __pfx_perf_trace_lock+0x10/0x10 [ 120.475457] ? kernel_text_address+0x5b/0xc0 [ 120.475842] ? perf_trace_run_bpf_submit+0xef/0x180 [ 120.476263] ? find_held_lock+0x2b/0x80 [ 120.476609] perf_trace_run_bpf_submit+0xef/0x180 [ 120.477024] perf_trace_preemptirq_template+0x259/0x430 [ 120.477476] ? __pfx_perf_trace_lock+0x10/0x10 [ 120.477863] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 120.478362] ? __pfx___smp_call_single_queue+0x10/0x10 [ 120.478813] ? find_held_lock+0x2b/0x80 [ 120.479154] ? try_to_wake_up+0x8ae/0x11d0 [ 120.479518] ? _raw_spin_unlock_irqrestore+0x2c/0x50 [ 120.479966] trace_irq_enable.constprop.0+0xa6/0x100 [ 120.480403] trace_hardirqs_on+0x26/0x40 [ 120.480747] _raw_spin_unlock_irqrestore+0x2c/0x50 [ 120.481167] try_to_wake_up+0x8ae/0x11d0 [ 120.481514] ? __pfx_try_to_wake_up+0x10/0x10 [ 120.481903] ? plist_del+0x122/0x270 [ 120.482231] ? find_held_lock+0x2b/0x80 [ 120.482572] ? futex_wake+0x474/0x540 [ 120.482900] wake_up_q+0xa1/0x130 [ 120.483199] futex_wake+0x47e/0x540 [ 120.483521] ? __pfx_futex_wake+0x10/0x10 [ 120.483884] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 120.484324] ? finish_task_switch.isra.0+0x206/0x840 [ 120.484764] do_futex+0x26d/0x370 [ 120.485061] ? __pfx_do_futex+0x10/0x10 [ 120.485400] ? __pfx___schedule+0x10/0x10 [ 120.485751] __x64_sys_futex+0x1c9/0x4d0 [ 120.486095] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 120.486599] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 120.487090] ? __pfx___x64_sys_futex+0x10/0x10 [ 120.487472] ? __pfx_fput_close_sync+0x10/0x10 [ 120.487861] ? dnotify_flush+0x79/0x4c0 [ 120.488186] ? xfd_validate_state+0x55/0x180 [ 120.488560] do_syscall_64+0xbf/0x360 [ 120.488875] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.489293] RIP: 0033:0x7f4ccbe02b19 [ 120.489600] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 120.491062] RSP: 002b:00007f4cc9378218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 120.491767] RAX: ffffffffffffffda RBX: 00007f4ccbf15f68 RCX: 00007f4ccbe02b19 [ 120.492344] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f4ccbf15f6c [ 120.492918] RBP: 00007f4ccbf15f60 R08: 000000000000000e R09: 0000000000000000 [ 120.493485] R10: 000000000000001e R11: 0000000000000246 R12: 00007f4ccbf15f6c [ 120.494053] R13: 00007fff49a520df R14: 00007f4cc9378300 R15: 0000000000022000 [ 120.494633] [ 120.494828] Modules linked in: [ 120.495095] ---[ end trace 0000000000000000 ]--- [ 120.495476] RIP: 0010:perf_tp_event+0x175/0xe70 [ 120.495871] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 120.497332] RSP: 0018:ffff888044f57780 EFLAGS: 00010012 [ 120.497761] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc9000a085000 [ 120.498334] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 120.498907] RBP: ffff888044f579f0 R08: ffff88806cf31340 R09: ffffe8ffffd16c10 [ 120.499487] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 120.500067] R13: 0000000000000014 R14: ffff88806cf31340 R15: dffffc0000000000 [ 120.500655] FS: 00007f4cc9378700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000 [ 120.501322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 120.501798] CR2: 00007f9525c03018 CR3: 0000000013f1b000 CR4: 0000000000350ef0 [ 120.502378] note: syz-executor.3[3972] exited with irqs disabled [ 120.502931] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#2] SMP KASAN NOPTI [ 120.503828] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197] [ 120.504526] CPU: 1 UID: 0 PID: 3972 Comm: syz-executor.3 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 120.505477] Tainted: [D]=DIE, [W]=WARN [ 120.505786] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 120.506446] RIP: 0010:perf_tp_event+0x175/0xe70 [ 120.506834] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 120.508282] RSP: 0018:ffff88806cf08b80 EFLAGS: 00010012 [ 120.508705] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002 [ 120.509264] RDX: ffff88800f2b0000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 120.509827] RBP: ffff88806cf08df0 R08: ffff88806cf313e8 R09: ffffe8ffffd16c10 [ 120.510386] R10: 0000000000000000 R11: ffff88801eee8098 R12: dffffc0000000000 [ 120.510946] R13: 0000000000000014 R14: ffff88806cf313e8 R15: dffffc0000000000 [ 120.511508] FS: 00007f4cc9378700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000 [ 120.512144] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 120.512610] CR2: 00007f9525c03018 CR3: 0000000013f1b000 CR4: 0000000000350ef0 [ 120.513173] Call Trace: [ 120.513383] [ 120.513565] ? __pfx_perf_tp_event+0x10/0x10 [ 120.513927] ? __pfx_perf_trace_lock+0x10/0x10 [ 120.514297] ? __pfx_perf_trace_lock+0x10/0x10 [ 120.514667] ? do_raw_spin_lock+0x123/0x260 [ 120.515016] ? try_to_wake_up+0x128/0x11d0 [ 120.515361] ? lock_release+0x1c7/0x290 [ 120.515695] ? do_raw_spin_unlock+0x53/0x220 [ 120.516053] ? _raw_spin_unlock_irqrestore+0x22/0x50 [ 120.516457] ? try_to_wake_up+0x128/0x11d0 [ 120.516800] ? perf_trace_lock+0xb5/0x5d0 [ 120.517133] ? do_raw_spin_lock+0x123/0x260 [ 120.517481] ? __pfx_perf_trace_lock+0x10/0x10 [ 120.517848] ? perf_trace_run_bpf_submit+0xef/0x180 [ 120.518247] perf_trace_run_bpf_submit+0xef/0x180 [ 120.518638] perf_trace_preemptirq_template+0x259/0x430 [ 120.519067] ? read_tsc+0x9/0x20 [ 120.519348] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 120.519824] ? clockevents_program_event+0x135/0x360 [ 120.520229] ? tick_program_event+0xac/0x140 [ 120.520585] ? handle_softirqs+0x16e/0x770 [ 120.520930] trace_irq_enable.constprop.0+0xa6/0x100 [ 120.521330] trace_hardirqs_on+0x26/0x40 [ 120.521656] handle_softirqs+0x16e/0x770 [ 120.521989] __irq_exit_rcu+0xc4/0x100 [ 120.522308] irq_exit_rcu+0x9/0x20 [ 120.522595] sysvec_apic_timer_interrupt+0x70/0x80 [ 120.522989] [ 120.523172] [ 120.523356] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 120.523783] RIP: 0010:make_task_dead+0xa2/0x3b0 [ 120.524157] Code: 38 00 85 db 0f 84 21 01 00 00 e8 d9 96 38 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 27 92 38 00 48 85 db 0f 84 17 01 00 00 b9 96 38 00 31 ff 65 8b 1d 60 df 48 06 81 e3 ff ff ff 7f 89 de [ 120.525566] RSP: 0018:ffff888044f57f28 EFLAGS: 00000246 [ 120.525981] RAX: 0000000000000001 RBX: ffff88800f2b0000 RCX: ffffffff817c2b86 [ 120.526538] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff813b5234 [ 120.527094] RBP: 000000000000000b R08: 0000000000000000 R09: 0000000000000000 [ 120.527656] R10: ffffffff8643ac57 R11: 0000000000000001 R12: ffff88800f2b0000 [ 120.528209] R13: 0000000000000000 R14: dffffc0020000032 R15: 0000000000000000 [ 120.528767] ? trace_irq_enable.constprop.0+0x26/0x100 [ 120.529179] ? make_task_dead+0x214/0x3b0 [ 120.529512] ? make_task_dead+0x214/0x3b0 [ 120.529842] ? do_syscall_64+0xbf/0x360 [ 120.530158] rewind_stack_and_make_dead+0x16/0x20 [ 120.530549] RIP: 0033:0x7f4ccbe02b19 [ 120.530843] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 120.532267] RSP: 002b:00007f4cc9378218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 120.532858] RAX: ffffffffffffffda RBX: 00007f4ccbf15f68 RCX: 00007f4ccbe02b19 [ 120.533415] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f4ccbf15f6c [ 120.533982] RBP: 00007f4ccbf15f60 R08: 000000000000000e R09: 0000000000000000 [ 120.534549] R10: 000000000000001e R11: 0000000000000246 R12: 00007f4ccbf15f6c [ 120.535113] R13: 00007fff49a520df R14: 00007f4cc9378300 R15: 0000000000022000 [ 120.535689] [ 120.535884] Modules linked in: [ 120.536148] ---[ end trace 0000000000000000 ]--- [ 120.536524] RIP: 0010:perf_tp_event+0x175/0xe70 [ 120.536903] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 120.538330] RSP: 0018:ffff888044f57780 EFLAGS: 00010012 [ 120.538754] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc9000a085000 [ 120.539314] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 120.539886] RBP: ffff888044f579f0 R08: ffff88806cf31340 R09: ffffe8ffffd16c10 [ 120.540451] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 120.541019] R13: 0000000000000014 R14: ffff88806cf31340 R15: dffffc0000000000 [ 120.541581] FS: 00007f4cc9378700(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000 [ 120.542213] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 120.542675] CR2: 00007f9525c03018 CR3: 0000000013f1b000 CR4: 0000000000350ef0 [ 120.543241] Kernel panic - not syncing: Fatal exception in interrupt [ 120.543980] Kernel Offset: disabled [ 120.544272] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- VM DIAGNOSIS: 09:12:03 Registers: info registers vcpu 0 RAX=0000000000000000 RBX=0000000000000001 RCX=ffffffff816894c3 RDX=ffff888043045280 RSI=ffffffff816894b1 RDI=0000000000000005 RBP=ffff88800a497850 RSP=ffff88800a497780 R8 =0000000000000000 R9 =fffffbfff0c8758a R10=0000000000000001 R11=0000000000000001 R12=0000000000000000 R13=0000000000000200 R14=1ffff11001492ef4 R15=ffffffff85852560 RIP=ffffffff816894b3 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e55dd000 00000000 00000000 LDT=0000 fffffe2c00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ffe547bff08 CR3=0000000034dc8000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=ff00000000ff000000000000000000ff XMM01=25252525252525252525252525252525 XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000020 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff828e32c5 RDI=ffffffff88724180 RBP=ffffffff88724140 RSP=ffff888044f57070 R8 =0000000000000000 R9 =ffffed100130d046 R10=0000000000000020 R11=0000000065646f43 R12=0000000000000020 R13=0000000000000010 R14=ffffffff88724140 R15=ffffffff828e32b0 RIP=ffffffff828e331d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f4cc9378700 00000000 00000000 GS =0000 ffff8880e56dd000 00000000 00000000 LDT=0000 fffffe5800000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f9525c03018 CR3=0000000013f1b000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=ffffffffffffffffff00000000000000 XMM01=ffffffffffffffffffffffffffffffff XMM02=ffffffffffffffffffffffffffffffff XMM03=ffffffffffffffffffffffffffffffff XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000