Warning: Permanently added '[localhost]:17322' (ECDSA) to the list of known hosts. 2025/08/29 09:14:49 fuzzer started 2025/08/29 09:14:50 dialing manager at localhost:43077 syzkaller login: [ 53.152225] cgroup: Unknown subsys name 'net' [ 53.284567] cgroup: Unknown subsys name 'cpuset' [ 53.296148] cgroup: Unknown subsys name 'rlimit' 2025/08/29 09:15:00 syscalls: 2214 2025/08/29 09:15:00 code coverage: enabled 2025/08/29 09:15:00 comparison tracing: enabled 2025/08/29 09:15:00 extra coverage: enabled 2025/08/29 09:15:00 setuid sandbox: enabled 2025/08/29 09:15:00 namespace sandbox: enabled 2025/08/29 09:15:00 Android sandbox: enabled 2025/08/29 09:15:00 fault injection: enabled 2025/08/29 09:15:00 leak checking: enabled 2025/08/29 09:15:00 net packet injection: enabled 2025/08/29 09:15:00 net device setup: enabled 2025/08/29 09:15:00 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/08/29 09:15:00 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/08/29 09:15:00 USB emulation: enabled 2025/08/29 09:15:00 hci packet injection: enabled 2025/08/29 09:15:00 wifi device emulation: enabled 2025/08/29 09:15:00 802.15.4 emulation: enabled 2025/08/29 09:15:00 fetching corpus: 0, signal 0/2000 (executing program) 2025/08/29 09:15:00 fetching corpus: 49, signal 19338/22796 (executing program) 2025/08/29 09:15:00 fetching corpus: 99, signal 29397/34192 (executing program) 2025/08/29 09:15:00 fetching corpus: 149, signal 40061/45856 (executing program) 2025/08/29 09:15:00 fetching corpus: 199, signal 46887/53689 (executing program) 2025/08/29 09:15:01 fetching corpus: 249, signal 53780/61391 (executing program) 2025/08/29 09:15:01 fetching corpus: 299, signal 57594/66110 (executing program) 2025/08/29 09:15:01 fetching corpus: 349, signal 61945/71249 (executing program) 2025/08/29 09:15:01 fetching corpus: 399, signal 65127/75209 (executing program) 2025/08/29 09:15:01 fetching corpus: 449, signal 70273/80778 (executing program) 2025/08/29 09:15:01 fetching corpus: 499, signal 72782/83956 (executing program) 2025/08/29 09:15:01 fetching corpus: 549, signal 75146/86995 (executing program) 2025/08/29 09:15:01 fetching corpus: 599, signal 78935/91051 (executing program) 2025/08/29 09:15:01 fetching corpus: 649, signal 81492/94081 (executing program) 2025/08/29 09:15:02 fetching corpus: 699, signal 84333/97218 (executing program) 2025/08/29 09:15:02 fetching corpus: 749, signal 86495/99781 (executing program) 2025/08/29 09:15:02 fetching corpus: 799, signal 88131/101815 (executing program) 2025/08/29 09:15:02 fetching corpus: 849, signal 90603/104465 (executing program) 2025/08/29 09:15:02 fetching corpus: 899, signal 92350/106653 (executing program) 2025/08/29 09:15:02 fetching corpus: 949, signal 93747/108405 (executing program) 2025/08/29 09:15:02 fetching corpus: 999, signal 95882/110700 (executing program) 2025/08/29 09:15:02 fetching corpus: 1049, signal 97846/112797 (executing program) 2025/08/29 09:15:02 fetching corpus: 1099, signal 100402/115236 (executing program) 2025/08/29 09:15:03 fetching corpus: 1149, signal 101601/116731 (executing program) 2025/08/29 09:15:03 fetching corpus: 1199, signal 103292/118493 (executing program) 2025/08/29 09:15:03 fetching corpus: 1249, signal 104754/120044 (executing program) 2025/08/29 09:15:03 fetching corpus: 1299, signal 106236/121575 (executing program) 2025/08/29 09:15:03 fetching corpus: 1349, signal 107584/122941 (executing program) 2025/08/29 09:15:03 fetching corpus: 1399, signal 109740/124766 (executing program) 2025/08/29 09:15:03 fetching corpus: 1449, signal 110647/125763 (executing program) 2025/08/29 09:15:03 fetching corpus: 1499, signal 111514/126800 (executing program) 2025/08/29 09:15:03 fetching corpus: 1549, signal 112676/127927 (executing program) 2025/08/29 09:15:04 fetching corpus: 1599, signal 114363/129342 (executing program) 2025/08/29 09:15:04 fetching corpus: 1649, signal 115304/130318 (executing program) 2025/08/29 09:15:04 fetching corpus: 1699, signal 116369/131320 (executing program) 2025/08/29 09:15:04 fetching corpus: 1749, signal 117578/132363 (executing program) 2025/08/29 09:15:04 fetching corpus: 1799, signal 118560/133231 (executing program) 2025/08/29 09:15:04 fetching corpus: 1849, signal 120222/134429 (executing program) 2025/08/29 09:15:04 fetching corpus: 1899, signal 121098/135170 (executing program) 2025/08/29 09:15:04 fetching corpus: 1949, signal 122750/136260 (executing program) 2025/08/29 09:15:04 fetching corpus: 1999, signal 123536/136915 (executing program) 2025/08/29 09:15:05 fetching corpus: 2049, signal 124431/137631 (executing program) 2025/08/29 09:15:05 fetching corpus: 2099, signal 125401/138390 (executing program) 2025/08/29 09:15:05 fetching corpus: 2149, signal 126280/139067 (executing program) 2025/08/29 09:15:05 fetching corpus: 2199, signal 127261/139732 (executing program) 2025/08/29 09:15:05 fetching corpus: 2249, signal 128219/140359 (executing program) 2025/08/29 09:15:05 fetching corpus: 2299, signal 129115/140954 (executing program) 2025/08/29 09:15:05 fetching corpus: 2349, signal 129748/141411 (executing program) 2025/08/29 09:15:05 fetching corpus: 2399, signal 130624/141986 (executing program) 2025/08/29 09:15:05 fetching corpus: 2449, signal 131331/142446 (executing program) 2025/08/29 09:15:05 fetching corpus: 2499, signal 132148/142924 (executing program) 2025/08/29 09:15:06 fetching corpus: 2549, signal 133243/143453 (executing program) 2025/08/29 09:15:06 fetching corpus: 2599, signal 134007/143912 (executing program) 2025/08/29 09:15:06 fetching corpus: 2649, signal 134655/144261 (executing program) 2025/08/29 09:15:06 fetching corpus: 2699, signal 135413/144658 (executing program) 2025/08/29 09:15:06 fetching corpus: 2749, signal 136040/144973 (executing program) 2025/08/29 09:15:06 fetching corpus: 2799, signal 136725/145302 (executing program) 2025/08/29 09:15:06 fetching corpus: 2849, signal 137616/145687 (executing program) 2025/08/29 09:15:07 fetching corpus: 2899, signal 138323/145978 (executing program) 2025/08/29 09:15:07 fetching corpus: 2949, signal 139250/146267 (executing program) 2025/08/29 09:15:07 fetching corpus: 2999, signal 139633/146463 (executing program) 2025/08/29 09:15:07 fetching corpus: 3049, signal 140299/146678 (executing program) 2025/08/29 09:15:07 fetching corpus: 3099, signal 141298/146910 (executing program) 2025/08/29 09:15:07 fetching corpus: 3149, signal 142107/147107 (executing program) 2025/08/29 09:15:07 fetching corpus: 3199, signal 142534/147266 (executing program) 2025/08/29 09:15:07 fetching corpus: 3249, signal 143260/147388 (executing program) 2025/08/29 09:15:08 fetching corpus: 3299, signal 143978/147497 (executing program) 2025/08/29 09:15:08 fetching corpus: 3349, signal 144563/147633 (executing program) 2025/08/29 09:15:08 fetching corpus: 3399, signal 145049/147700 (executing program) 2025/08/29 09:15:08 fetching corpus: 3449, signal 145515/147763 (executing program) 2025/08/29 09:15:08 fetching corpus: 3453, signal 145572/147791 (executing program) 2025/08/29 09:15:08 fetching corpus: 3453, signal 145572/147819 (executing program) 2025/08/29 09:15:08 fetching corpus: 3453, signal 145572/147819 (executing program) 2025/08/29 09:15:10 starting 8 fuzzer processes 09:15:10 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000200)=@newsa={0x154, 0x10, 0x9063c8f45262bcb, 0x0, 0x0, {{@in6=@loopback, @in=@loopback}, {@in=@loopback, 0x0, 0x33}, @in6=@ipv4={'\x00', '\xff\xff', @private}, {}, {}, {}, 0x0, 0x0, 0xa}, [@replay_esn_val={0x1c}, @algo_auth={0x48, 0x1, {{'blake2s-256-generic\x00'}}}]}, 0x154}}, 0x0) 09:15:10 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x572, &(0x7f0000000140)=0x0) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x4840, 0x0) r2 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x4840, 0x0) io_submit(r0, 0x2, &(0x7f00000001c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}]) 09:15:10 executing program 7: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$cgroup2(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000180)={[{@memory_localevents}, {@memory_recursiveprot}]}) 09:15:10 executing program 2: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x4, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 09:15:10 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x490) [ 72.979272] audit: type=1400 audit(1756458910.115:7): avc: denied { execmem } for pid=275 comm="syz-executor.7" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 09:15:10 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$bt_hci(r0, &(0x7f0000000000)=ANY=[], 0x6) 09:15:10 executing program 4: remap_file_pages(&(0x7f0000ffc000/0x1000)=nil, 0xa00, 0x0, 0x0, 0x0) 09:15:10 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) preadv2(r0, &(0x7f00000013c0)=[{&(0x7f0000000000)=""/8, 0x8}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0x0, 0x0, 0x0) [ 74.143707] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 74.147355] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 74.149657] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 74.151683] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 74.153969] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 74.157621] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 74.161221] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 74.163524] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 74.166093] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 74.168752] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 74.279653] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 74.289795] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 74.297855] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 74.299064] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 74.306425] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 74.308310] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 74.310879] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 74.315546] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 74.320943] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 74.328846] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 74.330412] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 74.332247] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 74.337702] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 74.344002] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 74.347434] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 74.349013] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 74.358744] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 74.358896] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 74.364232] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 74.370831] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 74.374336] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 74.378954] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 74.395914] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 74.402694] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 74.404994] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 74.420723] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 74.436766] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 74.438154] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 74.463602] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 74.492962] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 76.236238] Bluetooth: hci0: command tx timeout [ 76.236241] Bluetooth: hci1: command tx timeout [ 76.427736] Bluetooth: hci3: command tx timeout [ 76.428379] Bluetooth: hci4: command tx timeout [ 76.429577] Bluetooth: hci2: command tx timeout [ 76.491541] Bluetooth: hci6: command tx timeout [ 76.491662] Bluetooth: hci5: command tx timeout [ 76.555852] Bluetooth: hci7: command tx timeout [ 78.283693] Bluetooth: hci1: command tx timeout [ 78.283799] Bluetooth: hci0: command tx timeout [ 78.476534] Bluetooth: hci4: command tx timeout [ 78.476710] Bluetooth: hci3: command tx timeout [ 78.477358] Bluetooth: hci2: command tx timeout [ 78.539652] Bluetooth: hci6: command tx timeout [ 78.539758] Bluetooth: hci5: command tx timeout [ 78.603654] Bluetooth: hci7: command tx timeout [ 80.333546] Bluetooth: hci1: command tx timeout [ 80.334021] Bluetooth: hci0: command tx timeout [ 80.523517] Bluetooth: hci2: command tx timeout [ 80.523967] Bluetooth: hci3: command tx timeout [ 80.524344] Bluetooth: hci4: command tx timeout [ 80.587730] Bluetooth: hci5: command tx timeout [ 80.587748] Bluetooth: hci6: command tx timeout [ 80.651642] Bluetooth: hci7: command tx timeout [ 82.379584] Bluetooth: hci0: command tx timeout [ 82.380004] Bluetooth: hci1: command tx timeout [ 82.571876] Bluetooth: hci3: command tx timeout [ 82.572401] Bluetooth: hci2: command tx timeout [ 82.573233] Bluetooth: hci4: command tx timeout [ 82.636647] Bluetooth: hci6: command tx timeout [ 82.636674] Bluetooth: hci5: command tx timeout [ 82.699758] Bluetooth: hci7: command tx timeout [ 114.313198] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.314009] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.566174] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.566842] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.925702] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.926387] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.023979] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.024636] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 09:15:52 executing program 7: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$cgroup2(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000180)={[{@memory_localevents}, {@memory_recursiveprot}]}) 09:15:52 executing program 7: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$cgroup2(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000180)={[{@memory_localevents}, {@memory_recursiveprot}]}) [ 115.166664] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.167258] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.168795] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.169386] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 09:15:52 executing program 7: syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$cgroup2(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000180)={[{@memory_localevents}, {@memory_recursiveprot}]}) [ 115.259804] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.260403] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.291180] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.291998] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.359486] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.360081] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 09:15:52 executing program 7: r0 = socket$unix(0x1, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x7, &(0x7f0000000200)={0x0, 0x0}, 0x10) 09:15:52 executing program 7: r0 = socket$unix(0x1, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x7, &(0x7f0000000200)={0x0, 0x0}, 0x10) 09:15:52 executing program 7: r0 = socket$unix(0x1, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x7, &(0x7f0000000200)={0x0, 0x0}, 0x10) [ 115.458457] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.459061] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.497075] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.497134] audit: type=1400 audit(1756458952.632:8): avc: denied { open } for pid=3886 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 115.498025] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.504623] audit: type=1400 audit(1756458952.633:9): avc: denied { kernel } for pid=3886 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 09:15:52 executing program 7: r0 = socket$unix(0x1, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x7, &(0x7f0000000200)={0x0, 0x0}, 0x10) [ 115.599756] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.600395] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.627675] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.628281] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.676727] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.677297] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.721277] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.721903] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.763920] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.764766] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.834419] mmap: syz-executor.4 (3903) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. 09:15:53 executing program 7: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = dup2(r0, r0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = dup2(r2, r2) dup2(r1, r3) 09:15:53 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000200)=@newsa={0x154, 0x10, 0x9063c8f45262bcb, 0x0, 0x0, {{@in6=@loopback, @in=@loopback}, {@in=@loopback, 0x0, 0x33}, @in6=@ipv4={'\x00', '\xff\xff', @private}, {}, {}, {}, 0x0, 0x0, 0xa}, [@replay_esn_val={0x1c}, @algo_auth={0x48, 0x1, {{'blake2s-256-generic\x00'}}}]}, 0x154}}, 0x0) 09:15:53 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$bt_hci(r0, &(0x7f0000000000)=ANY=[], 0x6) 09:15:53 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x572, &(0x7f0000000140)=0x0) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x4840, 0x0) r2 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x4840, 0x0) io_submit(r0, 0x2, &(0x7f00000001c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}]) 09:15:53 executing program 4: remap_file_pages(&(0x7f0000ffc000/0x1000)=nil, 0xa00, 0x0, 0x0, 0x0) 09:15:53 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x490) 09:15:53 executing program 2: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x4, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 09:15:53 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) preadv2(r0, &(0x7f00000013c0)=[{&(0x7f0000000000)=""/8, 0x8}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0x0, 0x0, 0x0) 09:15:53 executing program 4: remap_file_pages(&(0x7f0000ffc000/0x1000)=nil, 0xa00, 0x0, 0x0, 0x0) 09:15:53 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) preadv2(r0, &(0x7f00000013c0)=[{&(0x7f0000000000)=""/8, 0x8}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0x0, 0x0, 0x0) 09:15:53 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x490) 09:15:53 executing program 2: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x4, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 09:15:53 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$bt_hci(r0, &(0x7f0000000000)=ANY=[], 0x6) 09:15:53 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x572, &(0x7f0000000140)=0x0) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x4840, 0x0) r2 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x4840, 0x0) io_submit(r0, 0x2, &(0x7f00000001c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}]) 09:15:53 executing program 7: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = dup2(r0, r0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = dup2(r2, r2) dup2(r1, r3) 09:15:53 executing program 4: remap_file_pages(&(0x7f0000ffc000/0x1000)=nil, 0xa00, 0x0, 0x0, 0x0) 09:15:53 executing program 2: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x4, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 09:15:53 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000200)=@newsa={0x154, 0x10, 0x9063c8f45262bcb, 0x0, 0x0, {{@in6=@loopback, @in=@loopback}, {@in=@loopback, 0x0, 0x33}, @in6=@ipv4={'\x00', '\xff\xff', @private}, {}, {}, {}, 0x0, 0x0, 0xa}, [@replay_esn_val={0x1c}, @algo_auth={0x48, 0x1, {{'blake2s-256-generic\x00'}}}]}, 0x154}}, 0x0) 09:15:53 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, 0x0, 0x490) 09:15:53 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) preadv2(r0, &(0x7f00000013c0)=[{&(0x7f0000000000)=""/8, 0x8}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0x0, 0x0, 0x0) [ 116.311882] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#1] SMP KASAN NOPTI [ 116.312826] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197] [ 116.313510] CPU: 0 UID: 0 PID: 3952 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 116.315074] Tainted: [W]=WARN [ 116.315495] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 116.316735] RIP: 0010:perf_tp_event+0x175/0xe70 [ 116.317542] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 116.322379] RSP: 0018:ffff888045d6f780 EFLAGS: 00010012 [ 116.322782] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc90006a22000 [ 116.323328] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 116.323868] RBP: ffff888045d6f9f0 R08: ffff88806ce31340 R09: ffffe8ffffc16498 [ 116.324400] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 116.324930] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 [ 116.325549] FS: 00007ff61e6e7700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 116.326178] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 116.326612] CR2: 0000001b2d028000 CR3: 0000000044c1e000 CR4: 0000000000350ef0 [ 116.327175] Call Trace: [ 116.327370] [ 116.327545] ? __pfx_perf_tp_event+0x10/0x10 [ 116.327897] ? __asan_memcpy+0x3d/0x60 [ 116.328200] ? visit_groups_merge.constprop.0.isra.0+0x6e7/0x1150 [ 116.328669] ? __pfx_visit_groups_merge.constprop.0.isra.0+0x10/0x10 [ 116.329148] ? lock_is_held_type+0x9e/0x120 [ 116.329483] ? ctx_sched_in+0x134/0x9b0 [ 116.329781] ? tracing_gen_ctx_irq_test+0x167/0x1f0 [ 116.330155] ? perf_swevent_event+0x63/0x3f0 [ 116.330489] ? perf_tp_event+0x807/0xe70 [ 116.330795] ? perf_trace_run_bpf_submit+0xef/0x180 [ 116.331173] ? perf_trace_run_bpf_submit+0xef/0x180 [ 116.331548] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 116.332001] perf_trace_run_bpf_submit+0xef/0x180 [ 116.332367] perf_trace_preemptirq_template+0x259/0x430 [ 116.332784] ? mark_held_locks+0x49/0x80 [ 116.333094] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 116.333544] ? _raw_spin_lock_irqsave+0x53/0x60 [ 116.333898] trace_irq_disable.constprop.0+0xa6/0x100 [ 116.334283] _raw_spin_lock_irqsave+0x53/0x60 [ 116.334624] try_to_wake_up+0xa0/0x11d0 [ 116.334931] ? __pfx_try_to_wake_up+0x10/0x10 [ 116.335273] ? plist_del+0x122/0x270 [ 116.335560] ? find_held_lock+0x2b/0x80 [ 116.335880] ? futex_wake+0x474/0x540 [ 116.336175] wake_up_q+0xa1/0x130 [ 116.336445] futex_wake+0x47e/0x540 [ 116.336727] ? __pfx_futex_wake+0x10/0x10 [ 116.337042] ? __do_sys_perf_event_open+0x44d/0x2c20 [ 116.337423] ? lock_release+0xc8/0x290 [ 116.337720] do_futex+0x26d/0x370 [ 116.337986] ? __pfx_do_futex+0x10/0x10 [ 116.338301] __x64_sys_futex+0x1c9/0x4d0 [ 116.338650] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 116.339095] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 116.339536] ? __pfx___x64_sys_futex+0x10/0x10 [ 116.339891] ? xfd_validate_state+0x55/0x180 [ 116.340235] do_syscall_64+0xbf/0x360 [ 116.340553] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.340956] RIP: 0033:0x7ff621171b19 [ 116.341242] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 116.342589] RSP: 002b:00007ff61e6e7218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 116.343153] RAX: ffffffffffffffda RBX: 00007ff621284f68 RCX: 00007ff621171b19 [ 116.343698] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007ff621284f6c [ 116.344228] RBP: 00007ff621284f60 R08: 000000000000000e R09: 0000000000000000 [ 116.344760] R10: 0000000000000003 R11: 0000000000000246 R12: 00007ff621284f6c [ 116.345334] R13: 00007fffb040195f R14: 00007ff61e6e7300 R15: 0000000000022000 [ 116.345989] [ 116.346210] Modules linked in: [ 116.346514] ---[ end trace 0000000000000000 ]--- [ 116.346941] RIP: 0010:perf_tp_event+0x175/0xe70 [ 116.347328] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 116.348688] RSP: 0018:ffff888045d6f780 EFLAGS: 00010012 [ 116.349083] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc90006a22000 [ 116.349608] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 116.350135] RBP: ffff888045d6f9f0 R08: ffff88806ce31340 R09: ffffe8ffffc16498 [ 116.350666] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 116.351192] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 [ 116.351732] FS: 00007ff61e6e7700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 116.352325] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 116.352762] CR2: 0000001b2d028000 CR3: 0000000044c1e000 CR4: 0000000000350ef0 [ 116.353305] note: syz-executor.3[3952] exited with irqs disabled [ 116.353853] Oops: general protection fault, probably for non-canonical address 0xdffffc0020000032: 0000 [#2] SMP KASAN NOPTI [ 116.354676] KASAN: probably user-memory-access in range [0x0000000100000190-0x0000000100000197] [ 116.355318] CPU: 0 UID: 0 PID: 3952 Comm: syz-executor.3 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 116.356200] Tainted: [D]=DIE, [W]=WARN [ 116.356484] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 116.357085] RIP: 0010:perf_tp_event+0x175/0xe70 [ 116.357441] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 116.358773] RSP: 0018:ffff88806ce08ac0 EFLAGS: 00010012 [ 116.359165] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: 0000000000000002 [ 116.359800] RDX: ffff888043e68000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 116.360440] RBP: ffff88806ce08d30 R08: ffff88806ce313e8 R09: ffffe8ffffc16498 [ 116.361093] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 [ 116.361638] R13: 0000000000000014 R14: ffff88806ce313e8 R15: dffffc0000000000 [ 116.362159] FS: 00007ff61e6e7700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 116.362745] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 116.363173] CR2: 0000001b2d028000 CR3: 0000000044c1e000 CR4: 0000000000350ef0 [ 116.363709] Call Trace: [ 116.363904] [ 116.364070] ? __smp_call_single_queue+0x15b/0x2f0 [ 116.364446] ? __pfx_perf_tp_event+0x10/0x10 [ 116.364783] ? perf_tp_event+0x807/0xe70 [ 116.365093] ? __pfx_perf_tp_event+0x10/0x10 [ 116.365427] ? trace_pelt_se_tp+0xdf/0x130 [ 116.365747] ? place_entity+0x300/0x410 [ 116.366049] ? lock_acquire+0x18c/0x2f0 [ 116.366353] ? update_cfs_group+0x11d/0x260 [ 116.366683] ? lock_release+0x1c7/0x290 [ 116.366985] ? perf_trace_run_bpf_submit+0xef/0x180 [ 116.367361] perf_trace_run_bpf_submit+0xef/0x180 [ 116.367759] perf_trace_preemptirq_template+0x259/0x430 [ 116.368163] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 116.368605] ? perf_trace_run_bpf_submit+0xef/0x180 [ 116.368981] ? irqentry_enter+0x2a/0x60 [ 116.369285] trace_irq_disable.constprop.0+0xa6/0x100 [ 116.369669] irqentry_enter+0x2a/0x60 [ 116.369961] common_interrupt+0x1d/0xd0 [ 116.370264] asm_common_interrupt+0x26/0x40 [ 116.370587] RIP: 0010:handle_softirqs+0x174/0x770 [ 116.370959] Code: c8 83 83 3c 0a 00 00 01 c7 44 24 20 0a 00 00 00 48 89 44 24 18 65 66 c7 05 0f 84 48 06 00 00 e8 42 80 40 00 fb bb ff ff ff ff <48> c7 c5 c0 c0 a0 85 41 0f bc de 83 c3 01 0f 85 9b 00 00 00 e9 8d [ 116.372288] RSP: 0018:ffff88806ce08f78 EFLAGS: 00000246 [ 116.372683] RAX: 0000000000000001 RBX: 00000000ffffffff RCX: ffffffff817c2b86 [ 116.373202] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff813bac2e [ 116.373721] RBP: ffff888045d6fe78 R08: 0000000000000000 R09: 0000000000000000 [ 116.374240] R10: ffffffff8643ac57 R11: ffff888009922898 R12: 0000000000000000 [ 116.374760] R13: 0000000000000000 R14: 0000000000000282 R15: 0000000000000000 [ 116.375284] ? trace_irq_enable.constprop.0+0x26/0x100 [ 116.375683] ? handle_softirqs+0x16e/0x770 [ 116.376007] ? handle_softirqs+0x16e/0x770 [ 116.376332] __irq_exit_rcu+0xc4/0x100 [ 116.376634] irq_exit_rcu+0x9/0x20 [ 116.376904] sysvec_apic_timer_interrupt+0x70/0x80 [ 116.377272] [ 116.377443] [ 116.377616] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 116.378006] RIP: 0010:make_task_dead+0xa2/0x3b0 [ 116.378356] Code: 38 00 85 db 0f 84 21 01 00 00 e8 d9 96 38 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 27 92 38 00 48 85 db 0f 84 17 01 00 00 b9 96 38 00 31 ff 65 8b 1d 60 df 48 06 81 e3 ff ff ff 7f 89 de [ 116.379690] RSP: 0018:ffff888045d6ff28 EFLAGS: 00000246 [ 116.380083] RAX: 0000000000000001 RBX: ffff888043e68000 RCX: ffffffff817c2b86 [ 116.380608] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff813b5234 [ 116.381138] RBP: 000000000000000b R08: 0000000000000000 R09: 0000000000000000 [ 116.381660] R10: ffffffff8643ac57 R11: 0000000000000001 R12: ffff888043e68000 [ 116.382188] R13: 0000000000000000 R14: dffffc0020000032 R15: 0000000000000000 [ 116.382714] ? trace_irq_enable.constprop.0+0x26/0x100 [ 116.383102] ? make_task_dead+0x214/0x3b0 [ 116.383415] ? make_task_dead+0x214/0x3b0 [ 116.383745] ? do_syscall_64+0xbf/0x360 [ 116.384043] rewind_stack_and_make_dead+0x16/0x20 [ 116.384409] RIP: 0033:0x7ff621171b19 [ 116.384698] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 116.386034] RSP: 002b:00007ff61e6e7218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 116.386590] RAX: ffffffffffffffda RBX: 00007ff621284f68 RCX: 00007ff621171b19 [ 116.387111] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007ff621284f6c [ 116.387643] RBP: 00007ff621284f60 R08: 000000000000000e R09: 0000000000000000 [ 116.388172] R10: 0000000000000003 R11: 0000000000000246 R12: 00007ff621284f6c [ 116.388694] R13: 00007fffb040195f R14: 00007ff61e6e7300 R15: 0000000000022000 [ 116.389251] [ 116.389432] Modules linked in: [ 116.389676] ---[ end trace 0000000000000000 ]--- [ 116.390020] RIP: 0010:perf_tp_event+0x175/0xe70 [ 116.390373] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 116.391714] RSP: 0018:ffff888045d6f780 EFLAGS: 00010012 [ 116.392108] RAX: 0000000020000032 RBX: 00000000ffffffa0 RCX: ffffc90006a22000 [ 116.392630] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: 0000000100000190 [ 116.393198] RBP: ffff888045d6f9f0 R08: ffff88806ce31340 R09: ffffe8ffffc16498 [ 116.393729] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 116.394248] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 [ 116.394774] FS: 00007ff61e6e7700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 116.395385] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 116.395824] CR2: 0000001b2d028000 CR3: 0000000044c1e000 CR4: 0000000000350ef0 [ 116.396348] Kernel panic - not syncing: Fatal exception in interrupt [ 116.396997] Kernel Offset: disabled [ 116.397268] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- VM DIAGNOSIS: 09:15:53 Registers: info registers vcpu 0 RAX=0000000000000034 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff828e32c5 RDI=ffffffff88724180 RBP=ffffffff88724140 RSP=ffff888045d6f070 R8 =0000000000000000 R9 =ffffed1001652046 R10=0000000000000034 R11=0000000065646f43 R12=0000000000000034 R13=0000000000000010 R14=ffffffff88724140 R15=ffffffff828e32b0 RIP=ffffffff828e331d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007ff61e6e7700 00000000 00000000 GS =0000 ffff8880e55dd000 00000000 00000000 LDT=0000 fffffe0600000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000001b2d028000 CR3=0000000044c1e000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007ff6212587c000007ff6212587c8 XMM02=00007ff6212587e000007ff6212587c0 XMM03=00007ff6212587c800007ff6212587c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000000 RBX=dffffc0000000000 RCX=ffffffff81bd42e2 RDX=1ffff11003b67e91 RSI=ffffffff81faf173 RDI=ffff88801dace318 RBP=ffff8880177cfdd0 RSP=ffff8880177cfb60 R8 =0000000000000001 R9 =ffffed1001eac8ea R10=ffff88800f564757 R11=0000000000000000 R12=ffff88801db3f460 R13=ffff88801dab5a70 R14=ffff88801dace318 R15=ffff88801db3f438 RIP=ffffffff8173e788 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000555558c2d400 00000000 00000000 GS =0000 ffff8880e56dd000 00000000 00000000 LDT=0000 fffffe2800000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ffdb691ecd8 CR3=0000000041576000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000a60ce07b00000000cec3662e XMM01=00000000000000001f222bd182a9dedc XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000