Warning: Permanently added '[localhost]:54345' (ECDSA) to the list of known hosts.
2025/09/01 09:03:08 fuzzer started
2025/09/01 09:03:09 dialing manager at localhost:35473
syzkaller login: [ 44.871028] cgroup: Unknown subsys name 'net'
[ 44.944367] cgroup: Unknown subsys name 'cpuset'
[ 44.970216] cgroup: Unknown subsys name 'rlimit'
2025/09/01 09:03:20 syscalls: 2214
2025/09/01 09:03:20 code coverage: enabled
2025/09/01 09:03:20 comparison tracing: enabled
2025/09/01 09:03:20 extra coverage: enabled
2025/09/01 09:03:20 setuid sandbox: enabled
2025/09/01 09:03:20 namespace sandbox: enabled
2025/09/01 09:03:20 Android sandbox: enabled
2025/09/01 09:03:20 fault injection: enabled
2025/09/01 09:03:20 leak checking: enabled
2025/09/01 09:03:20 net packet injection: enabled
2025/09/01 09:03:20 net device setup: enabled
2025/09/01 09:03:20 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2025/09/01 09:03:20 devlink PCI setup: PCI device 0000:00:10.0 is not available
2025/09/01 09:03:20 USB emulation: enabled
2025/09/01 09:03:20 hci packet injection: enabled
2025/09/01 09:03:20 wifi device emulation: enabled
2025/09/01 09:03:20 802.15.4 emulation: enabled
2025/09/01 09:03:20 fetching corpus: 0, signal 0/2000 (executing program)
2025/09/01 09:03:20 fetching corpus: 49, signal 19875/23321 (executing program)
2025/09/01 09:03:21 fetching corpus: 99, signal 33578/38179 (executing program)
2025/09/01 09:03:21 fetching corpus: 149, signal 40814/46561 (executing program)
2025/09/01 09:03:21 fetching corpus: 199, signal 50896/57379 (executing program)
2025/09/01 09:03:21 fetching corpus: 249, signal 57971/65110 (executing program)
2025/09/01 09:03:21 fetching corpus: 299, signal 62749/70619 (executing program)
2025/09/01 09:03:21 fetching corpus: 349, signal 68012/76417 (executing program)
2025/09/01 09:03:21 fetching corpus: 399, signal 70691/79851 (executing program)
2025/09/01 09:03:21 fetching corpus: 449, signal 73390/83211 (executing program)
2025/09/01 09:03:21 fetching corpus: 499, signal 76005/86395 (executing program)
2025/09/01 09:03:22 fetching corpus: 549, signal 79209/90025 (executing program)
2025/09/01 09:03:22 fetching corpus: 599, signal 81372/92718 (executing program)
2025/09/01 09:03:22 fetching corpus: 649, signal 83764/95509 (executing program)
2025/09/01 09:03:22 fetching corpus: 699, signal 86157/98324 (executing program)
2025/09/01 09:03:22 fetching corpus: 749, signal 88054/100597 (executing program)
2025/09/01 09:03:22 fetching corpus: 799, signal 90086/102943 (executing program)
2025/09/01 09:03:22 fetching corpus: 849, signal 91989/105099 (executing program)
2025/09/01 09:03:22 fetching corpus: 899, signal 93694/107033 (executing program)
2025/09/01 09:03:22 fetching corpus: 949, signal 95041/108730 (executing program)
2025/09/01 09:03:23 fetching corpus: 999, signal 96001/110111 (executing program)
2025/09/01 09:03:23 fetching corpus: 1049, signal 97110/111553 (executing program)
2025/09/01 09:03:23 fetching corpus: 1099, signal 100516/114493 (executing program)
2025/09/01 09:03:23 fetching corpus: 1149, signal 102004/116089 (executing program)
2025/09/01 09:03:23 fetching corpus: 1199, signal 103850/117921 (executing program)
2025/09/01 09:03:23 fetching corpus: 1249, signal 105723/119681 (executing program)
2025/09/01 09:03:23 fetching corpus: 1299, signal 106649/120783 (executing program)
2025/09/01 09:03:23 fetching corpus: 1349, signal 107832/122058 (executing program)
2025/09/01 09:03:23 fetching corpus: 1399, signal 109396/123518 (executing program)
2025/09/01 09:03:24 fetching corpus: 1449, signal 110355/124600 (executing program)
2025/09/01 09:03:24 fetching corpus: 1499, signal 112283/126143 (executing program)
2025/09/01 09:03:24 fetching corpus: 1549, signal 114011/127543 (executing program)
2025/09/01 09:03:24 fetching corpus: 1599, signal 115234/128628 (executing program)
2025/09/01 09:03:24 fetching corpus: 1649, signal 116550/129780 (executing program)
2025/09/01 09:03:24 fetching corpus: 1699, signal 117821/130849 (executing program)
2025/09/01 09:03:24 fetching corpus: 1749, signal 119447/132044 (executing program)
2025/09/01 09:03:24 fetching corpus: 1799, signal 120529/132959 (executing program)
2025/09/01 09:03:25 fetching corpus: 1849, signal 121700/133839 (executing program)
2025/09/01 09:03:25 fetching corpus: 1899, signal 123119/134845 (executing program)
2025/09/01 09:03:25 fetching corpus: 1949, signal 124505/135751 (executing program)
2025/09/01 09:03:25 fetching corpus: 1999, signal 125496/136463 (executing program)
2025/09/01 09:03:25 fetching corpus: 2049, signal 125990/136918 (executing program)
2025/09/01 09:03:25 fetching corpus: 2099, signal 127265/137713 (executing program)
2025/09/01 09:03:25 fetching corpus: 2149, signal 128744/138503 (executing program)
2025/09/01 09:03:25 fetching corpus: 2199, signal 129442/138991 (executing program)
2025/09/01 09:03:25 fetching corpus: 2249, signal 129956/139419 (executing program)
2025/09/01 09:03:26 fetching corpus: 2299, signal 130823/139928 (executing program)
2025/09/01 09:03:26 fetching corpus: 2349, signal 131557/140370 (executing program)
2025/09/01 09:03:26 fetching corpus: 2399, signal 132114/140710 (executing program)
2025/09/01 09:03:26 fetching corpus: 2449, signal 133120/141233 (executing program)
2025/09/01 09:03:26 fetching corpus: 2499, signal 134787/141886 (executing program)
2025/09/01 09:03:26 fetching corpus: 2549, signal 135453/142220 (executing program)
2025/09/01 09:03:26 fetching corpus: 2599, signal 136268/142614 (executing program)
2025/09/01 09:03:26 fetching corpus: 2649, signal 137511/143004 (executing program)
2025/09/01 09:03:27 fetching corpus: 2699, signal 138112/143231 (executing program)
2025/09/01 09:03:27 fetching corpus: 2749, signal 138687/143546 (executing program)
2025/09/01 09:03:27 fetching corpus: 2799, signal 139700/143917 (executing program)
2025/09/01 09:03:27 fetching corpus: 2849, signal 140656/144196 (executing program)
2025/09/01 09:03:27 fetching corpus: 2899, signal 141201/144368 (executing program)
2025/09/01 09:03:27 fetching corpus: 2949, signal 141765/144524 (executing program)
2025/09/01 09:03:27 fetching corpus: 2999, signal 142227/144662 (executing program)
2025/09/01 09:03:27 fetching corpus: 3042, signal 142600/144756 (executing program)
2025/09/01 09:03:27 fetching corpus: 3042, signal 142600/144794 (executing program)
2025/09/01 09:03:27 fetching corpus: 3042, signal 142600/144837 (executing program)
2025/09/01 09:03:27 fetching corpus: 3042, signal 142600/144874 (executing program)
2025/09/01 09:03:27 fetching corpus: 3042, signal 142600/144909 (executing program)
2025/09/01 09:03:27 fetching corpus: 3042, signal 142600/144946 (executing program)
2025/09/01 09:03:27 fetching corpus: 3042, signal 142600/144979 (executing program)
2025/09/01 09:03:27 fetching corpus: 3042, signal 142600/145011 (executing program)
2025/09/01 09:03:27 fetching corpus: 3042, signal 142600/145033 (executing program)
2025/09/01 09:03:27 fetching corpus: 3042, signal 142600/145073 (executing program)
2025/09/01 09:03:27 fetching corpus: 3042, signal 142600/145086 (executing program)
2025/09/01 09:03:27 fetching corpus: 3042, signal 142600/145086 (executing program)
2025/09/01 09:03:30 starting 8 fuzzer processes
09:03:30 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
getsockopt$netlink(r0, 0x10e, 0xa, 0x0, &(0x7f00000001c0))
09:03:30 executing program 3:
r0 = epoll_create(0x2b)
r1 = timerfd_create(0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000040))
09:03:30 executing program 1:
unlinkat(0xffffffffffffff9c, 0x0, 0x2)
09:03:30 executing program 2:
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "c770cc", 0x8, 0x3a, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast2, {[], @echo_request}}}}}, 0x0)
09:03:30 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000100)={0x34, 0x2d, 0x1, 0x0, 0x0, "", [@typed={0xc, 0x0, 0x0, 0x0, @u64}, @nested={0x18, 0x0, 0x0, 0x1, [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@local}]}]}, 0x34}], 0x1}, 0x0)
09:03:30 executing program 7:
r0 = syz_open_dev$evdev(&(0x7f0000000340), 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000500)=0x8)
[ 65.381861] audit: type=1400 audit(1756717410.472:7): avc: denied { execmem } for pid=273 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
09:03:30 executing program 6:
r0 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r0, &(0x7f0000000400)=@file={0x1, './file0\x00'}, 0x6e)
close(r0)
09:03:30 executing program 5:
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xea, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000240))
[ 66.581081] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 66.584376] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 66.586681] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 66.589317] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 66.594766] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 66.596620] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 66.596889] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 66.603868] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 66.604773] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 66.607882] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 66.649229] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 66.655602] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 66.659228] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 66.672139] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 66.677711] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 66.803429] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 66.804855] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 66.805500] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[ 66.808298] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 66.823222] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[ 66.826268] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[ 66.831087] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 66.832220] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[ 66.833446] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 66.837914] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[ 66.842553] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[ 66.843718] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 66.847691] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[ 66.849493] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[ 66.852872] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[ 66.863765] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[ 66.868194] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[ 66.874101] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 66.875503] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 66.876813] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[ 66.879756] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 66.890393] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 66.896648] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[ 66.936051] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[ 66.938612] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[ 68.666445] Bluetooth: hci0: command tx timeout
[ 68.667623] Bluetooth: hci1: command tx timeout
[ 68.731301] Bluetooth: hci2: command tx timeout
[ 68.923979] Bluetooth: hci7: command tx timeout
[ 68.987046] Bluetooth: hci6: command tx timeout
[ 68.987735] Bluetooth: hci4: command tx timeout
[ 68.988707] Bluetooth: hci5: command tx timeout
[ 68.988998] Bluetooth: hci3: command tx timeout
[ 70.714059] Bluetooth: hci0: command tx timeout
[ 70.714524] Bluetooth: hci1: command tx timeout
[ 70.778082] Bluetooth: hci2: command tx timeout
[ 70.969985] Bluetooth: hci7: command tx timeout
[ 71.034003] Bluetooth: hci3: command tx timeout
[ 71.034467] Bluetooth: hci5: command tx timeout
[ 71.034857] Bluetooth: hci4: command tx timeout
[ 71.035293] Bluetooth: hci6: command tx timeout
[ 72.762096] Bluetooth: hci1: command tx timeout
[ 72.762561] Bluetooth: hci0: command tx timeout
[ 72.825997] Bluetooth: hci2: command tx timeout
[ 73.017987] Bluetooth: hci7: command tx timeout
[ 73.082057] Bluetooth: hci6: command tx timeout
[ 73.082523] Bluetooth: hci4: command tx timeout
[ 73.082917] Bluetooth: hci5: command tx timeout
[ 73.083368] Bluetooth: hci3: command tx timeout
[ 74.810349] Bluetooth: hci1: command tx timeout
[ 74.811308] Bluetooth: hci0: command tx timeout
[ 74.875040] Bluetooth: hci2: command tx timeout
[ 75.066651] Bluetooth: hci7: command tx timeout
[ 75.130989] Bluetooth: hci3: command tx timeout
[ 75.131714] Bluetooth: hci5: command tx timeout
[ 75.132462] Bluetooth: hci4: command tx timeout
[ 75.132491] Bluetooth: hci6: command tx timeout
[ 103.255095] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 103.255749] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 103.421334] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 103.422210] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:04:09 executing program 3:
r0 = epoll_create(0x2b)
r1 = timerfd_create(0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000040))
09:04:09 executing program 3:
r0 = epoll_create(0x2b)
r1 = timerfd_create(0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000040))
09:04:09 executing program 3:
r0 = epoll_create(0x2b)
r1 = timerfd_create(0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000040))
09:04:09 executing program 3:
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0)
fchmod(r0, 0x0)
[ 104.531083] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 104.532288] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:04:09 executing program 3:
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0)
fchmod(r0, 0x0)
[ 104.614019] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 104.614613] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 104.692239] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 104.692841] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:04:09 executing program 3:
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0)
fchmod(r0, 0x0)
[ 104.828965] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 104.829581] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:04:10 executing program 3:
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0)
fchmod(r0, 0x0)
09:04:10 executing program 3:
syz_emit_ethernet(0x66, &(0x7f0000000000)={@local, @remote, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x29, 0x0, @private=0xa010100, @local}}}}}, 0x0)
[ 105.236995] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.237611] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 105.275818] audit: type=1400 audit(1756717450.368:8): avc: denied { open } for pid=3851 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[ 105.277537] audit: type=1400 audit(1756717450.368:9): avc: denied { kernel } for pid=3851 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[ 105.293222] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 105.374961] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.375561] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 105.467813] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.468854] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 105.531848] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.532991] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 105.648203] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.648844] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 105.811967] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.813105] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 105.952388] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 105.953059] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.047084] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.047707] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.352095] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.352714] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 106.379978] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 106.380503] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
09:04:11 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
getsockopt$netlink(r0, 0x10e, 0xa, 0x0, &(0x7f00000001c0))
09:04:11 executing program 5:
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xea, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000240))
09:04:11 executing program 7:
r0 = syz_open_dev$evdev(&(0x7f0000000340), 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000500)=0x8)
09:04:11 executing program 3:
syz_emit_ethernet(0x66, &(0x7f0000000000)={@local, @remote, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x29, 0x0, @private=0xa010100, @local}}}}}, 0x0)
09:04:11 executing program 2:
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "c770cc", 0x8, 0x3a, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast2, {[], @echo_request}}}}}, 0x0)
09:04:11 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000100)={0x34, 0x2d, 0x1, 0x0, 0x0, "", [@typed={0xc, 0x0, 0x0, 0x0, @u64}, @nested={0x18, 0x0, 0x0, 0x1, [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@local}]}]}, 0x34}], 0x1}, 0x0)
09:04:11 executing program 6:
r0 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r0, &(0x7f0000000400)=@file={0x1, './file0\x00'}, 0x6e)
close(r0)
09:04:11 executing program 1:
unlinkat(0xffffffffffffff9c, 0x0, 0x2)
09:04:11 executing program 7:
r0 = syz_open_dev$evdev(&(0x7f0000000340), 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000500)=0x8)
[ 106.626044] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'.
09:04:11 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
getsockopt$netlink(r0, 0x10e, 0xa, 0x0, &(0x7f00000001c0))
09:04:11 executing program 6:
r0 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r0, &(0x7f0000000400)=@file={0x1, './file0\x00'}, 0x6e)
close(r0)
09:04:11 executing program 7:
r0 = syz_open_dev$evdev(&(0x7f0000000340), 0x0, 0x0)
ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000500)=0x8)
09:04:11 executing program 1:
unlinkat(0xffffffffffffff9c, 0x0, 0x2)
09:04:11 executing program 3:
syz_emit_ethernet(0x66, &(0x7f0000000000)={@local, @remote, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x29, 0x0, @private=0xa010100, @local}}}}}, 0x0)
09:04:11 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000100)={0x34, 0x2d, 0x1, 0x0, 0x0, "", [@typed={0xc, 0x0, 0x0, 0x0, @u64}, @nested={0x18, 0x0, 0x0, 0x1, [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@local}]}]}, 0x34}], 0x1}, 0x0)
09:04:11 executing program 5:
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xea, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000240))
09:04:11 executing program 2:
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "c770cc", 0x8, 0x3a, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast2, {[], @echo_request}}}}}, 0x0)
[ 106.854278] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 106.861082] kmemleak: Found object by alias at 0x607f1a62f694
[ 106.861101] CPU: 1 UID: 0 PID: 3940 Comm: syz-executor.6 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 106.861120] Tainted: [W]=WARN
[ 106.861124] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 106.861132] Call Trace:
[ 106.861136]
[ 106.861141] dump_stack_lvl+0xca/0x120
[ 106.861174] __lookup_object+0x94/0xb0
[ 106.861192] delete_object_full+0x27/0x70
[ 106.861209] free_percpu+0x30/0x1160
[ 106.861227] ? arch_uprobe_clear_state+0x16/0x140
[ 106.861248] futex_hash_free+0x38/0xc0
[ 106.861263] mmput+0x2d3/0x390
[ 106.861283] do_exit+0x79d/0x2970
[ 106.861301] ? __pfx_do_exit+0x10/0x10
[ 106.861315] ? find_held_lock+0x2b/0x80
[ 106.861334] ? get_signal+0x835/0x2340
[ 106.861355] do_group_exit+0xd3/0x2a0
[ 106.861370] get_signal+0x2315/0x2340
[ 106.861388] ? trace_irq_enable.constprop.0+0xc2/0x100
[ 106.861407] ? __pfx_get_signal+0x10/0x10
[ 106.861424] ? __schedule+0xe91/0x3590
[ 106.861446] arch_do_signal_or_restart+0x80/0x790
[ 106.861465] ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 106.861485] ? __x64_sys_futex+0x1c9/0x4d0
[ 106.861498] ? __x64_sys_futex+0x1d2/0x4d0
[ 106.861512] ? fput_close_sync+0x114/0x240
[ 106.861530] ? __pfx___x64_sys_futex+0x10/0x10
[ 106.861543] ? __pfx_fput_close_sync+0x10/0x10
[ 106.861559] ? dnotify_flush+0x79/0x4c0
[ 106.861571] ? xfd_validate_state+0x55/0x180
[ 106.861593] exit_to_user_mode_loop+0x8b/0x110
[ 106.861607] do_syscall_64+0x2f7/0x360
[ 106.861620] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 106.861633] RIP: 0033:0x7f8995547b19
[ 106.861642] Code: Unable to access opcode bytes at 0x7f8995547aef.
[ 106.861648] RSP: 002b:00007f8992abd218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 106.861659] RAX: 0000000000000001 RBX: 00007f899565af68 RCX: 00007f8995547b19
[ 106.861667] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f899565af6c
[ 106.861675] RBP: 00007f899565af60 R08: 000000000000000e R09: 0000000000000000
[ 106.861682] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f899565af6c
[ 106.861689] R13: 00007ffe82e075df R14: 00007f8992abd300 R15: 0000000000022000
[ 106.861706]
[ 106.861710] kmemleak: Object (percpu) 0x607f1a62f690 (size 8):
[ 106.861717] kmemleak: comm "syz-executor.5", pid 3943, jiffies 4294773725
[ 106.861724] kmemleak: min_count = 1
[ 106.861728] kmemleak: count = 0
[ 106.861732] kmemleak: flags = 0x21
[ 106.861736] kmemleak: checksum = 0
[ 106.861740] kmemleak: backtrace:
[ 106.861744] pcpu_alloc_noprof+0x87a/0x1170
[ 106.861760] perf_trace_event_init+0x366/0xa10
[ 106.861776] perf_trace_init+0x1a4/0x2f0
[ 106.861788] perf_tp_event_init+0xa6/0x120
[ 106.861805] perf_try_init_event+0x140/0x9f0
[ 106.861819] perf_event_alloc.part.0+0x118e/0x45f0
[ 106.861836] __do_sys_perf_event_open+0x719/0x2c20
[ 106.861850] do_syscall_64+0xbf/0x360
[ 106.861860] entry_SYSCALL_64_after_hwframe+0x77/0x7f
09:04:11 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
getsockopt$netlink(r0, 0x10e, 0xa, 0x0, &(0x7f00000001c0))
09:04:11 executing program 3:
syz_emit_ethernet(0x66, &(0x7f0000000000)={@local, @remote, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x29, 0x0, @private=0xa010100, @local}}}}}, 0x0)
09:04:12 executing program 2:
syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "c770cc", 0x8, 0x3a, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast2, {[], @echo_request}}}}}, 0x0)
09:04:12 executing program 1:
unlinkat(0xffffffffffffff9c, 0x0, 0x2)
09:04:12 executing program 7:
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc018937e, &(0x7f0000000040)={{0x1, 0x1, 0xc5, 0xffffffffffffffff, {0x5}}, './file0\x00'})
09:04:12 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000100)={0x34, 0x2d, 0x1, 0x0, 0x0, "", [@typed={0xc, 0x0, 0x0, 0x0, @u64}, @nested={0x18, 0x0, 0x0, 0x1, [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@local}]}]}, 0x34}], 0x1}, 0x0)
09:04:12 executing program 6:
r0 = socket$unix(0x1, 0x2, 0x0)
bind$unix(r0, &(0x7f0000000400)=@file={0x1, './file0\x00'}, 0x6e)
close(r0)
09:04:12 executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0)
09:04:12 executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001800)={&(0x7f0000000400)=ANY=[@ANYBLOB="380100001a000100000000000000000020010000000000000000000000000002fe8000"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000aa000000006c000000fe8000000000000000000000000000aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000480003"], 0x138}}, 0x0)
09:04:12 executing program 5:
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xea, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x4000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000240))
[ 107.125820] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.4'.
09:04:12 executing program 7:
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc018937e, &(0x7f0000000040)={{0x1, 0x1, 0xc5, 0xffffffffffffffff, {0x5}}, './file0\x00'})
09:04:12 executing program 7:
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc018937e, &(0x7f0000000040)={{0x1, 0x1, 0xc5, 0xffffffffffffffff, {0x5}}, './file0\x00'})
09:04:12 executing program 7:
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc018937e, &(0x7f0000000040)={{0x1, 0x1, 0xc5, 0xffffffffffffffff, {0x5}}, './file0\x00'})
09:04:12 executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
sendmmsg$sock(r0, &(0x7f0000004b40)=[{{&(0x7f0000000200)=@nfc={0x27, 0x1}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000300)="e525000004000000000000000000", 0xe}], 0x1, &(0x7f0000000280)=[@timestamping={{0x14, 0x1, 0x25, 0x2}}], 0x18}}], 0x1, 0x0)
09:04:12 executing program 4:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
writev(r0, &(0x7f0000000640)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9)
09:04:12 executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001800)={&(0x7f0000000400)=ANY=[@ANYBLOB="380100001a000100000000000000000020010000000000000000000000000002fe8000"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000aa000000006c000000fe8000000000000000000000000000aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000480003"], 0x138}}, 0x0)
09:04:12 executing program 5:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TIOCSSOFTCAR(r0, 0x5428, 0x0)
09:04:12 executing program 4:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
writev(r0, &(0x7f0000000640)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9)
[ 107.959545] Bluetooth: hci0: Opcode 0x0c03 failed: -4
[ 107.962210] Bluetooth: hci0: Opcode 0x0c03 failed: -4
09:04:13 executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001800)={&(0x7f0000000400)=ANY=[@ANYBLOB="380100001a000100000000000000000020010000000000000000000000000002fe8000"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000aa000000006c000000fe8000000000000000000000000000aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000480003"], 0x138}}, 0x0)
09:04:13 executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
sendmmsg$sock(r0, &(0x7f0000004b40)=[{{&(0x7f0000000200)=@nfc={0x27, 0x1}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000300)="e525000004000000000000000000", 0xe}], 0x1, &(0x7f0000000280)=[@timestamping={{0x14, 0x1, 0x25, 0x2}}], 0x18}}], 0x1, 0x0)
09:04:13 executing program 7:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40001)
r2 = dup2(r1, r0)
write$binfmt_script(r2, &(0x7f0000000100)={'#! ', './file0', [{0x20, '/dev/sg#\x00'}, {0x20, '/dev/ptmx\x00'}], 0xa, "4a6e109f"}, 0x24)
09:04:13 executing program 5:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TIOCSSOFTCAR(r0, 0x5428, 0x0)
09:04:13 executing program 2:
munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000)
mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0)
mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil)
09:04:13 executing program 6:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180))
ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000100)={0xfffeffff, 0x0, 0x0, 0x0, 0x0, "f1210b16ad94e37ec2aab08ecc82258476310a"})
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000))
09:04:13 executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0)
09:04:13 executing program 4:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
writev(r0, &(0x7f0000000640)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9)
09:04:13 executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001800)={&(0x7f0000000400)=ANY=[@ANYBLOB="380100001a000100000000000000000020010000000000000000000000000002fe8000"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000aa000000006c000000fe8000000000000000000000000000aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000480003"], 0x138}}, 0x0)
09:04:13 executing program 4:
perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
writev(r0, &(0x7f0000000640)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9)
09:04:13 executing program 5:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TIOCSSOFTCAR(r0, 0x5428, 0x0)
09:04:13 executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
sendmmsg$sock(r0, &(0x7f0000004b40)=[{{&(0x7f0000000200)=@nfc={0x27, 0x1}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000300)="e525000004000000000000000000", 0xe}], 0x1, &(0x7f0000000280)=[@timestamping={{0x14, 0x1, 0x25, 0x2}}], 0x18}}], 0x1, 0x0)
09:04:13 executing program 2:
munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000)
mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0)
mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil)
09:04:13 executing program 7:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40001)
r2 = dup2(r1, r0)
write$binfmt_script(r2, &(0x7f0000000100)={'#! ', './file0', [{0x20, '/dev/sg#\x00'}, {0x20, '/dev/ptmx\x00'}], 0xa, "4a6e109f"}, 0x24)
09:04:13 executing program 6:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180))
ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000100)={0xfffeffff, 0x0, 0x0, 0x0, 0x0, "f1210b16ad94e37ec2aab08ecc82258476310a"})
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000))
09:04:13 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180))
ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000100)={0xfffeffff, 0x0, 0x0, 0x0, 0x0, "f1210b16ad94e37ec2aab08ecc82258476310a"})
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000))
09:04:13 executing program 2:
munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000)
mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0)
mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil)
[ 108.890430] Bluetooth: hci0: Opcode 0x0c03 failed: -4
09:04:14 executing program 7:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40001)
r2 = dup2(r1, r0)
write$binfmt_script(r2, &(0x7f0000000100)={'#! ', './file0', [{0x20, '/dev/sg#\x00'}, {0x20, '/dev/ptmx\x00'}], 0xa, "4a6e109f"}, 0x24)
09:04:14 executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0)
09:04:14 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180))
ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000100)={0xfffeffff, 0x0, 0x0, 0x0, 0x0, "f1210b16ad94e37ec2aab08ecc82258476310a"})
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000))
09:04:14 executing program 1:
r0 = socket$packet(0x11, 0x3, 0x300)
sendmmsg$sock(r0, &(0x7f0000004b40)=[{{&(0x7f0000000200)=@nfc={0x27, 0x1}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000300)="e525000004000000000000000000", 0xe}], 0x1, &(0x7f0000000280)=[@timestamping={{0x14, 0x1, 0x25, 0x2}}], 0x18}}], 0x1, 0x0)
09:04:14 executing program 5:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TIOCSSOFTCAR(r0, 0x5428, 0x0)
09:04:14 executing program 4:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180))
ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000100)={0xfffeffff, 0x0, 0x0, 0x0, 0x0, "f1210b16ad94e37ec2aab08ecc82258476310a"})
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000))
09:04:14 executing program 2:
munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000)
mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0)
mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil)
09:04:14 executing program 6:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180))
ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000100)={0xfffeffff, 0x0, 0x0, 0x0, 0x0, "f1210b16ad94e37ec2aab08ecc82258476310a"})
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000))
09:04:14 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40001)
r2 = dup2(r1, r0)
write$binfmt_script(r2, &(0x7f0000000100)={'#! ', './file0', [{0x20, '/dev/sg#\x00'}, {0x20, '/dev/ptmx\x00'}], 0xa, "4a6e109f"}, 0x24)
09:04:14 executing program 6:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180))
ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000100)={0xfffeffff, 0x0, 0x0, 0x0, 0x0, "f1210b16ad94e37ec2aab08ecc82258476310a"})
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000))
09:04:14 executing program 3:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180))
ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000100)={0xfffeffff, 0x0, 0x0, 0x0, 0x0, "f1210b16ad94e37ec2aab08ecc82258476310a"})
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000))
09:04:14 executing program 5:
munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000)
mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0)
mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil)
09:04:14 executing program 7:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40001)
r2 = dup2(r1, r0)
write$binfmt_script(r2, &(0x7f0000000100)={'#! ', './file0', [{0x20, '/dev/sg#\x00'}, {0x20, '/dev/ptmx\x00'}], 0xa, "4a6e109f"}, 0x24)
09:04:14 executing program 4:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180))
ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000100)={0xfffeffff, 0x0, 0x0, 0x0, 0x0, "f1210b16ad94e37ec2aab08ecc82258476310a"})
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000))
09:04:14 executing program 2:
openat$sr(0xffffffffffffff9c, &(0x7f0000000480), 0x40080, 0x0)
09:04:14 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000480)=ANY=[@ANYBLOB="280000001d00010000000000000000000700000001"], 0x28}], 0x1}, 0x0)
09:04:14 executing program 5:
munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000)
mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0)
mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil)
[ 109.137123] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 109.788248] Bluetooth: hci0: Opcode 0x0c03 failed: -4
09:04:14 executing program 0:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r0, 0x400448cb, 0x0)
09:04:14 executing program 4:
r0 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x13)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180))
ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000100)={0xfffeffff, 0x0, 0x0, 0x0, 0x0, "f1210b16ad94e37ec2aab08ecc82258476310a"})
r1 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000))
09:04:14 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40001)
r2 = dup2(r1, r0)
write$binfmt_script(r2, &(0x7f0000000100)={'#! ', './file0', [{0x20, '/dev/sg#\x00'}, {0x20, '/dev/ptmx\x00'}], 0xa, "4a6e109f"}, 0x24)
09:04:14 executing program 5:
munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000)
mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0)
mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil)
09:04:14 executing program 6:
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
sendmsg$sock(r0, &(0x7f0000003440)={0x0, 0x0, 0x0, 0x0, &(0x7f00000033c0)=[@txtime={{0x18}}], 0x18}, 0x0)
09:04:14 executing program 2:
setresuid(0x0, 0xee01, 0x0)
timerfd_create(0x8, 0x0)
09:04:14 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000480)=ANY=[@ANYBLOB="280000001d00010000000000000000000700000001"], 0x28}], 0x1}, 0x0)
09:04:14 executing program 7:
perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = fork()
ptrace(0xffffffffffffffff, r0)
kcmp(r0, 0x0, 0x4, 0xffffffffffffffff, 0xffffffffffffffff)
msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000080)={{0x3, 0x0, 0xffffffffffffffff, 0xee01, 0x0, 0x8, 0xb1dc}, 0x0, 0x0, 0x6, 0x80, 0x2e, 0x7fffffff, 0x3ff, 0x5c1e, 0x400, 0x3, 0x0, r0})
perf_event_open(&(0x7f0000000100)={0x4, 0x80, 0xff, 0x7, 0x1, 0x6b, 0x0, 0x33a, 0x212, 0xd, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfb84, 0x1, @perf_bp={&(0x7f0000000080), 0x1}, 0x1008, 0x3, 0x2, 0x2, 0x100000001, 0xfffffffa, 0xc00, 0x0, 0x5, 0x0, 0x8}, r0, 0x9, 0xffffffffffffffff, 0x0)
msgsnd(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01f3fd8440d615ab8c0ef800000000000000"], 0x2000, 0x0)
[ 109.866130] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'.
09:04:14 executing program 2:
setresuid(0x0, 0xee01, 0x0)
timerfd_create(0x8, 0x0)
[ 109.903067] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#1] SMP KASAN NOPTI
[ 109.904820] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[ 109.904881] kmemleak: Found object by alias at 0x607f1a62f694
[ 109.904905] CPU: 1 UID: 0 PID: 4066 Comm: syz-executor.6 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 109.904924] Tainted: [W]=WARN
[ 109.904928] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 109.904936] Call Trace:
[ 109.904941]
[ 109.904945] dump_stack_lvl+0xca/0x120
[ 109.904978] __lookup_object+0x94/0xb0
[ 109.904996] delete_object_full+0x27/0x70
[ 109.905012] free_percpu+0x30/0x1160
[ 109.905029] ? arch_uprobe_clear_state+0x16/0x140
[ 109.905048] futex_hash_free+0x38/0xc0
[ 109.905063] mmput+0x2d3/0x390
[ 109.905082] do_exit+0x79d/0x2970
[ 109.905097] ? __pfx_do_exit+0x10/0x10
[ 109.905111] ? find_held_lock+0x2b/0x80
[ 109.905129] ? get_signal+0x835/0x2340
[ 109.905148] do_group_exit+0xd3/0x2a0
[ 109.905162] get_signal+0x2315/0x2340
[ 109.905180] ? put_task_stack+0xd2/0x240
[ 109.905192] ? __pfx_get_signal+0x10/0x10
[ 109.905209] ? __schedule+0xe91/0x3590
[ 109.905227] arch_do_signal_or_restart+0x80/0x790
[ 109.905245] ? __pfx_arch_do_signal_or_restart+0x10/0x10
[ 109.905262] ? __x64_sys_futex+0x1c9/0x4d0
[ 109.905274] ? __x64_sys_futex+0x1d2/0x4d0
[ 109.905288] ? fput_close_sync+0x114/0x240
[ 109.905305] ? __pfx___x64_sys_futex+0x10/0x10
[ 109.905318] ? __pfx_fput_close_sync+0x10/0x10
[ 109.905334] ? dnotify_flush+0x79/0x4c0
[ 109.905348] exit_to_user_mode_loop+0x8b/0x110
[ 109.905361] do_syscall_64+0x2f7/0x360
[ 109.905373] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.905386] RIP: 0033:0x7f8995547b19
[ 109.905395] Code: Unable to access opcode bytes at 0x7f8995547aef.
[ 109.905401] RSP: 002b:00007f8992abd218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 109.905413] RAX: 0000000000000001 RBX: 00007f899565af68 RCX: 00007f8995547b19
[ 109.905421] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f899565af6c
[ 109.905428] RBP: 00007f899565af60 R08: 000000000000000e R09: 0000000000000000
[ 109.905436] R10: 0000000000000004 R11: 0000000000000246 R12: 00007f899565af6c
[ 109.905443] R13: 00007ffe82e075df R14: 00007f8992abd300 R15: 0000000000022000
[ 109.905454]
[ 109.905458] kmemleak: Object (percpu) 0x607f1a62f690 (size 8):
[ 109.905465] kmemleak: comm "syz-executor.7", pid 4072, jiffies 4294776784
[ 109.905472] kmemleak: min_count = 1
[ 109.905477] kmemleak: count = 0
[ 109.905481] kmemleak: flags = 0x21
[ 109.905485] kmemleak: checksum = 0
[ 109.905488] kmemleak: backtrace:
[ 109.905492] pcpu_alloc_noprof+0x87a/0x1170
[ 109.905508] perf_trace_event_init+0x366/0xa10
[ 109.905523] perf_trace_init+0x1a4/0x2f0
[ 109.905535] perf_tp_event_init+0xa6/0x120
[ 109.905552] perf_try_init_event+0x140/0x9f0
[ 109.905566] perf_event_alloc.part.0+0x118e/0x45f0
[ 109.905583] __do_sys_perf_event_open+0x719/0x2c20
[ 109.905597] do_syscall_64+0xbf/0x360
[ 109.905606] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.953530] CPU: 0 UID: 0 PID: 4063 Comm: syz-executor.5 Tainted: G W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 109.955344] Tainted: [W]=WARN
[ 109.955827] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 109.957086] RIP: 0010:perf_tp_event+0x175/0xe70
[ 109.957831] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 109.960566] RSP: 0018:ffff888016257780 EFLAGS: 00010012
[ 109.961404] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[ 109.962477] RDX: ffff888015b00000 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 109.963556] RBP: ffff8880162579f0 R08: ffff88806ce31340 R09: ffffe8ffffc07690
[ 109.964656] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 109.965751] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000
[ 109.966830] FS: 000055557c943400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[ 109.968050] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 109.968946] CR2: 00007f139a326000 CR3: 0000000044918000 CR4: 0000000000350ef0
[ 109.970040] Call Trace:
[ 109.970448]
[ 109.970807] ? __pfx_perf_tp_event+0x10/0x10
[ 109.971522] ? trace_mm_page_alloc+0xfc/0x150
[ 109.972237] ? __alloc_frozen_pages_noprof+0x296/0x1f20
[ 109.973084] ? lock_acquire+0x15e/0x2f0
[ 109.973708] ? find_held_lock+0x2b/0x80
[ 109.974343] ? __lock_acquire+0x694/0x1b70
[ 109.975006] ? perf_trace_run_bpf_submit+0xef/0x180
[ 109.975792] ? __lock_acquire+0xc65/0x1b70
[ 109.976442] perf_trace_run_bpf_submit+0xef/0x180
[ 109.977216] perf_trace_preemptirq_template+0x259/0x430
[ 109.978038] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 109.978942] ? _raw_spin_lock_irqsave+0x53/0x60
[ 109.979673] trace_irq_disable.constprop.0+0xa6/0x100
[ 109.980462] _raw_spin_lock_irqsave+0x53/0x60
[ 109.981181] try_to_wake_up+0xa0/0x11d0
[ 109.981817] ? __pfx_try_to_wake_up+0x10/0x10
[ 109.982518] ? plist_del+0x122/0x270
[ 109.983126] ? find_held_lock+0x2b/0x80
[ 109.983755] ? futex_wake+0x474/0x540
[ 109.984357] wake_up_q+0xa1/0x130
[ 109.984932] futex_wake+0x47e/0x540
[ 109.985524] ? __pfx_futex_wake+0x10/0x10
[ 109.986189] ? __handle_mm_fault+0x753/0x3260
[ 109.986912] ? __lock_acquire+0x694/0x1b70
[ 109.987578] do_futex+0x26d/0x370
[ 109.988136] ? __pfx_do_futex+0x10/0x10
[ 109.988783] ? find_held_lock+0x2b/0x80
[ 109.989422] __x64_sys_futex+0x1c9/0x4d0
[ 109.990060] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 109.990962] ? __pfx___x64_sys_futex+0x10/0x10
[ 109.991675] do_syscall_64+0xbf/0x360
[ 109.992273] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.993102] RIP: 0033:0x7f139a216b19
[ 109.993698] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 109.996455] RSP: 002b:00007ffd2efa2a88 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 109.997626] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f139a216b19
[ 109.998716] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f139a329f68
[ 109.999831] RBP: 00007f139a329f60 R08: 0000001b2d72001c R09: 0000000000000000
[ 110.000918] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f139a32e0a8
[ 110.002014] R13: 00007ffd2efa2b90 R14: 00007f139a329f60 R15: 000000000001acd3
[ 110.003114]
[ 110.003489] Modules linked in:
[ 110.003988] ---[ end trace 0000000000000000 ]---
[ 110.004725] RIP: 0010:perf_tp_event+0x175/0xe70
[ 110.005462] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 110.008238] RSP: 0018:ffff888016257780 EFLAGS: 00010012
[ 110.009068] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[ 110.010154] RDX: ffff888015b00000 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 110.011252] RBP: ffff8880162579f0 R08: ffff88806ce31340 R09: ffffe8ffffc07690
[ 110.012354] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 110.013468] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000
[ 110.014568] FS: 000055557c943400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[ 110.015811] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 110.016727] CR2: 00007f139a326000 CR3: 0000000044918000 CR4: 0000000000350ef0
[ 110.017852] note: syz-executor.5[4063] exited with irqs disabled
[ 110.018942] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000032: 0000 [#2] SMP KASAN NOPTI
[ 110.020655] KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
[ 110.021841] CPU: 0 UID: 0 PID: 4063 Comm: syz-executor.5 Tainted: G D W 6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary)
[ 110.023663] Tainted: [D]=DIE, [W]=WARN
[ 110.024259] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 110.025578] RIP: 0010:perf_tp_event+0x175/0xe70
[ 110.026336] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
[ 110.029180] RSP: 0018:ffff88806ce08b40 EFLAGS: 00010012
[ 110.030030] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[ 110.031145] RDX: ffff888015b00000 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 110.032262] RBP: ffff88806ce08db0 R08: ffff88806ce313e8 R09: ffffe8ffffc07690
[ 110.033387] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
[ 110.034508] R13: 0000000000000014 R14: ffff88806ce313e8 R15: dffffc0000000000
[ 110.035624] FS: 000055557c943400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[ 110.036915] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 110.037841] CR2: 00007f139a326000 CR3: 0000000044918000 CR4: 0000000000350ef0
[ 110.038977] Call Trace:
[ 110.039389]
[ 110.039753] ? __pfx_perf_tp_event+0x10/0x10
[ 110.040478] ? sched_clock_cpu+0x6c/0x4e0
[ 110.041157] ? lock_release+0x1c7/0x290
[ 110.041800] ? __virt_addr_valid+0x100/0x5d0
[ 110.042522] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 110.043355] ? task_work_add+0x1b2/0x340
[ 110.044008] ? lock_acquire+0x18c/0x2f0
[ 110.044650] ? __pfx_task_work_add+0x10/0x10
[ 110.045391] ? update_cfs_group+0x11d/0x260
[ 110.046087] ? lock_release+0x1c7/0x290
[ 110.046729] ? trace_softirq_raise+0xbe/0x100
[ 110.047469] ? run_posix_cpu_timers+0x160/0x7d0
[ 110.048212] ? __raise_softirq_irqoff+0x5f/0x90
[ 110.048968] ? __pfx_run_posix_cpu_timers+0x10/0x10
[ 110.049766] ? sched_balance_trigger+0x1ac/0xcb0
[ 110.050701] ? sched_tick+0x27c/0x6c0
[ 110.051330] ? perf_trace_run_bpf_submit+0xef/0x180
[ 110.052131] ? timerqueue_add+0x1c2/0x330
[ 110.052808] perf_trace_run_bpf_submit+0xef/0x180
[ 110.053596] perf_trace_preemptirq_template+0x259/0x430
[ 110.054425] ? __pfx_perf_trace_preemptirq_template+0x10/0x10
[ 110.055344] ? read_tsc+0x9/0x20
[ 110.055905] ? ktime_get+0x16d/0x270
[ 110.056506] ? __pfx_lapic_next_deadline+0x10/0x10
[ 110.057314] ? clockevents_program_event+0x135/0x360
[ 110.058141] ? _raw_spin_lock_irq+0x42/0x50
[ 110.058837] trace_irq_disable.constprop.0+0xa6/0x100
[ 110.059656] _raw_spin_lock_irq+0x42/0x50
[ 110.060323] run_timer_softirq+0x190/0x210
[ 110.061017] handle_softirqs+0x1b1/0x770
[ 110.061688] __irq_exit_rcu+0xc4/0x100
[ 110.062323] irq_exit_rcu+0x9/0x20
[ 110.062896] sysvec_apic_timer_interrupt+0x70/0x80
[ 110.063689]
[ 110.064050]
[ 110.064416] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 110.065259] RIP: 0010:make_task_dead+0xa2/0x3b0
[ 110.066014] Code: 38 00 85 db 0f 84 21 01 00 00 e8 09 a6 38 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 57 a1 38 00 48 85 db 0f 84 17 01 00 00 e9 a5 38 00 31 ff 65 8b 1d 60 2f 49 06 81 e3 ff ff ff 7f 89 de
[ 110.068840] RSP: 0018:ffff888016257f28 EFLAGS: 00000246
[ 110.069670] RAX: 0000000000000001 RBX: ffff888015b00000 RCX: ffffffff817c3ab6
[ 110.070788] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff813b5234
[ 110.071892] RBP: 000000000000000b R08: 0000000000000000 R09: 0000000000000000
[ 110.073003] R10: ffffffff8643b457 R11: 0000000000000001 R12: ffff888015b00000
[ 110.074110] R13: 0000000000000000 R14: dffffc0000000032 R15: 0000000000000000
[ 110.075219] ? trace_irq_enable.constprop.0+0x26/0x100
[ 110.076047] ? make_task_dead+0x214/0x3b0
[ 110.076714] ? make_task_dead+0x214/0x3b0
[ 110.077376] ? do_syscall_64+0xbf/0x360
[ 110.078005] rewind_stack_and_make_dead+0x16/0x20
[ 110.078773] RIP: 0033:0x7f139a216b19
[ 110.079364] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 110.082187] RSP: 002b:00007ffd2efa2a88 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[ 110.083379] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f139a216b19
[ 110.084492] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f139a329f68
[ 110.085626] RBP: 00007f139a329f60 R08: 0000001b2d72001c R09: 0000000000000000
[ 110.086731] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f139a32e0a8
[ 110.087835] R13: 00007ffd2efa2b90 R14: 00007f139a329f60 R15: 000000000001acd3
[ 110.088977]
[ 110.089350] Modules linked in:
[ 110.089868] ---[ end trace 0000000000000000 ]---
[ 110.090599] RIP: 0010:perf_tp_event+0x175/0xe70
[ 110.091344] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01
09:04:15 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000480)=ANY=[@ANYBLOB="280000001d00010000000000000000000700000001"], 0x28}], 0x1}, 0x0)
[ 110.094184] RSP: 0018:ffff888016257780 EFLAGS: 00010012
[ 110.095100] RAX: 0000000000000032 RBX: ffffffffffffffa1 RCX: 0000000000000002
[ 110.096216] RDX: ffff888015b00000 RSI: ffffffff8189a4e7 RDI: 0000000000000191
[ 110.097351] RBP: ffff8880162579f0 R08: ffff88806ce31340 R09: ffffe8ffffc07690
[ 110.098458] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
[ 110.099556] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000
[ 110.100671] FS: 000055557c943400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
[ 110.101949] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 110.102863] CR2: 00007f139a326000 CR3: 0000000044918000 CR4: 0000000000350ef0
[ 110.103986] Kernel panic - not syncing: Fatal exception in interrupt
[ 110.105295] Kernel Offset: disabled
[ 110.105875] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
VM DIAGNOSIS:
09:04:15 Registers:
info registers vcpu 0
RAX=0000000000000005 RBX=00000000000003f9 RCX=0000000000000000 RDX=00000000000003f9
RSI=ffffffff828e5105 RDI=ffffffff88729280 RBP=ffffffff88729240 RSP=ffff888016257170
R8 =0000000000000000 R9 =ffffed10015fb046 R10=0000000000000000 R11=552031203a555043
R12=0000000000000005 R13=0000000000000010 R14=ffffffff88729240 R15=ffffffff828e50f0
RIP=ffffffff828e515d RFL=00000006 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 000055557c943400 00000000 00000000
GS =0000 ffff8880e55d8000 00000000 00000000
LDT=0000 fffffe4000000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f139a326000 CR3=0000000044918000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00ff0000000000ff0000000000000000 XMM01=00010000000000010000000000000000
XMM02=7463656a6e695f31313230385f7a7973 XMM03=00007f139a2fd7c800007f139a2fd7c0
XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000
info registers vcpu 1
RAX=0000000000000000 RBX=ffff88806ce3de20 RCX=ffffffff816880fc RDX=ffff888016edb700
RSI=ffffffff816880d6 RDI=0000000000000005 RBP=0000000000000003 RSP=ffff888044e06ec8
R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000001 R11=1ffff1100d9e6bb1
R12=ffffed100d9c7bc5 R13=ffff88806ce3de28 R14=0000000000000001 R15=dffffc0000000000
RIP=ffffffff816880d8 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f916bd21700 00000000 00000000
GS =0000 ffff8880e56d8000 00000000 00000000
LDT=0000 fffffe6300000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f916bdad180 CR3=000000000e038000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=ff000000000000000000000000000000
XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
XMM04=ef63d2b7339aa72c0000000000152180 XMM05=d3fdd5f48436fbd700000000000aead0
XMM06=82cb2faff09ef49600000000000ae988 XMM07=a1fcdcf819d7e1e500000000000ae728
XMM08=44495f474f4c5359530069253d595449 XMM09=00000000000000000000000000000000
XMM10=00000000000000000020000020000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000