Debian GNU/Linux 11 syzkaller ttyS0 Warning: Permanently added '[localhost]:61193' (ECDSA) to the list of known hosts. 2025/08/29 08:23:37 fuzzer started 2025/08/29 08:23:37 dialing manager at localhost:43077 syzkaller login: [ 50.725320] cgroup: Unknown subsys name 'net' [ 50.778548] cgroup: Unknown subsys name 'cpuset' [ 50.790321] cgroup: Unknown subsys name 'rlimit' 2025/08/29 08:23:48 syscalls: 2214 2025/08/29 08:23:48 code coverage: enabled 2025/08/29 08:23:48 comparison tracing: enabled 2025/08/29 08:23:48 extra coverage: enabled 2025/08/29 08:23:48 setuid sandbox: enabled 2025/08/29 08:23:48 namespace sandbox: enabled 2025/08/29 08:23:48 Android sandbox: enabled 2025/08/29 08:23:48 fault injection: enabled 2025/08/29 08:23:48 leak checking: enabled 2025/08/29 08:23:48 net packet injection: enabled 2025/08/29 08:23:48 net device setup: enabled 2025/08/29 08:23:48 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/08/29 08:23:48 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/08/29 08:23:48 USB emulation: enabled 2025/08/29 08:23:48 hci packet injection: enabled 2025/08/29 08:23:48 wifi device emulation: enabled 2025/08/29 08:23:48 802.15.4 emulation: enabled 2025/08/29 08:23:48 fetching corpus: 0, signal 0/2000 (executing program) 2025/08/29 08:23:48 fetching corpus: 50, signal 24203/27129 (executing program) 2025/08/29 08:23:48 fetching corpus: 100, signal 36500/40049 (executing program) 2025/08/29 08:23:48 fetching corpus: 150, signal 44207/48222 (executing program) 2025/08/29 08:23:48 fetching corpus: 200, signal 51203/55409 (executing program) 2025/08/29 08:23:48 fetching corpus: 250, signal 58031/62130 (executing program) 2025/08/29 08:23:49 fetching corpus: 300, signal 61623/65842 (executing program) 2025/08/29 08:23:49 fetching corpus: 350, signal 65017/69254 (executing program) 2025/08/29 08:23:49 fetching corpus: 400, signal 69289/73329 (executing program) 2025/08/29 08:23:49 fetching corpus: 450, signal 72047/75932 (executing program) 2025/08/29 08:23:49 fetching corpus: 500, signal 73741/77557 (executing program) 2025/08/29 08:23:49 fetching corpus: 550, signal 75774/79448 (executing program) 2025/08/29 08:23:50 fetching corpus: 600, signal 77961/81290 (executing program) 2025/08/29 08:23:50 fetching corpus: 650, signal 79214/82411 (executing program) 2025/08/29 08:23:50 fetching corpus: 700, signal 81382/84157 (executing program) 2025/08/29 08:23:50 fetching corpus: 750, signal 85162/86730 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/87114 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/87195 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/87290 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/87379 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/87466 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/87555 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/87656 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/87739 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/87821 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/87894 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/87988 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/88069 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/88153 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/88240 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/88347 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/88434 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/88536 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/88605 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/88699 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/88790 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/88869 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/88959 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/89045 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/89147 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/89238 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/89316 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/89391 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/89440 (executing program) 2025/08/29 08:23:50 fetching corpus: 779, signal 85635/89440 (executing program) 2025/08/29 08:23:52 starting 8 fuzzer processes 08:23:52 executing program 0: rseq(&(0x7f0000000180), 0x20, 0x0, 0x0) syz_mount_image$nfs4(0x0, 0x0, 0x0, 0x0, &(0x7f0000001600), 0x0, 0x0) 08:23:52 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x9, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000000100000c000000500000000f000000000000000200000006000000000008000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001000000000000000b0000008000000018000000c20500002b82", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000039c043f6970341999833e8e90d2470c4010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x1000}, {&(0x7f0000012500)="ed41000000100000dbf4655fdcf4655fdcf4655f00000000000004008000000000000800050000000af301000400000000000000000000000100000010", 0x3d, 0x4080}, {&(0x7f0000012800)="ed", 0x1, 0x4580}, {&(0x7f0000012b00)="020000000c0001022e000000020000000c0002022e2e00000b00000014000a026c6f73742b666f756e6400000c0000001000050266696c6530", 0x39, 0x10000}, {&(0x7f0000013000)="504d4d00504d4dff", 0x8, 0x40000}, {0x0, 0x0, 0x80000}], 0x0, &(0x7f0000013b00)) lstat(&(0x7f0000000040)='./file0/file0\x00', 0x0) 08:23:52 executing program 3: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x1) 08:23:52 executing program 7: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_pktinfo={{0x1c, 0x0, 0x2, {0x0, @loopback, @multicast2}}}], 0x20}, 0x0) 08:23:52 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) statx(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) 08:23:52 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x4a, 0x0, &(0x7f00000018c0)) 08:23:52 executing program 5: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000080)) eventfd(0x0) [ 65.609533] audit: type=1400 audit(1756455832.884:7): avc: denied { execmem } for pid=272 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 08:23:52 executing program 6: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup3(r0, r1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x16, 0x0, 0x0) [ 66.752870] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 66.756254] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 66.758603] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 66.763511] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 66.768920] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 66.940391] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 66.946520] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 66.948579] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 66.952538] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 66.957461] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 67.026286] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 67.040911] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 67.044037] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 67.054425] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 67.066409] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 67.078656] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 67.080076] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 67.084560] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 67.088374] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 67.090576] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 67.092504] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 67.093196] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 67.093938] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 67.097096] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 67.099091] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 67.103992] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 67.109923] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 67.113041] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 67.114728] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 67.117008] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 67.119161] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 67.151866] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 67.154576] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 67.156265] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 67.160202] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 67.164119] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 67.184010] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 67.195100] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 67.205962] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 67.209476] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 68.849070] Bluetooth: hci0: command tx timeout [ 68.976747] Bluetooth: hci1: command tx timeout [ 69.168893] Bluetooth: hci2: command tx timeout [ 69.170062] Bluetooth: hci3: command tx timeout [ 69.233477] Bluetooth: hci6: command tx timeout [ 69.296153] Bluetooth: hci5: command tx timeout [ 69.297256] Bluetooth: hci7: command tx timeout [ 69.297847] Bluetooth: hci4: command tx timeout [ 70.895875] Bluetooth: hci0: command tx timeout [ 71.025738] Bluetooth: hci1: command tx timeout [ 71.215771] Bluetooth: hci3: command tx timeout [ 71.215943] Bluetooth: hci2: command tx timeout [ 71.279851] Bluetooth: hci6: command tx timeout [ 71.344172] Bluetooth: hci4: command tx timeout [ 71.344216] Bluetooth: hci5: command tx timeout [ 71.345175] Bluetooth: hci7: command tx timeout [ 72.944781] Bluetooth: hci0: command tx timeout [ 73.071847] Bluetooth: hci1: command tx timeout [ 73.263738] Bluetooth: hci2: command tx timeout [ 73.264820] Bluetooth: hci3: command tx timeout [ 73.328028] Bluetooth: hci6: command tx timeout [ 73.391784] Bluetooth: hci7: command tx timeout [ 73.392250] Bluetooth: hci4: command tx timeout [ 73.393232] Bluetooth: hci5: command tx timeout [ 74.991738] Bluetooth: hci0: command tx timeout [ 75.119820] Bluetooth: hci1: command tx timeout [ 75.311772] Bluetooth: hci3: command tx timeout [ 75.312233] Bluetooth: hci2: command tx timeout [ 75.375914] Bluetooth: hci6: command tx timeout [ 75.439831] Bluetooth: hci5: command tx timeout [ 75.440286] Bluetooth: hci4: command tx timeout [ 75.440664] Bluetooth: hci7: command tx timeout [ 105.042018] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.042661] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.111872] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.112498] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.264778] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.265373] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.393940] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.394545] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.472253] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.473622] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.524326] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.524965] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.620918] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.621536] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.670120] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.670760] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.689253] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.689857] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.762250] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.762904] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.800446] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.801066] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.837969] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.838610] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.906542] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.907559] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.965179] audit: type=1400 audit(1756455873.240:8): avc: denied { open } for pid=3886 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 105.966857] audit: type=1400 audit(1756455873.240:9): avc: denied { kernel } for pid=3886 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 106.009102] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.009730] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.051159] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.052165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.098144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.098833] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.209909] loop1: detected capacity change from 0 to 2048 [ 106.220501] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 106.222263] ext4 filesystem being mounted at /syzkaller-testdir591367545/syzkaller.9vVl0L/0/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 106.225556] EXT4-fs error (device loop1): ext4_lookup:1789: inode #2: comm syz-executor.1: deleted inode referenced: 12 [ 106.231190] EXT4-fs error (device loop1): ext4_lookup:1789: inode #2: comm syz-executor.1: deleted inode referenced: 12 08:24:33 executing program 7: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_pktinfo={{0x1c, 0x0, 0x2, {0x0, @loopback, @multicast2}}}], 0x20}, 0x0) 08:24:33 executing program 5: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000080)) eventfd(0x0) 08:24:33 executing program 4: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x1) 08:24:33 executing program 3: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x1) [ 106.264496] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. 08:24:33 executing program 0: rseq(&(0x7f0000000180), 0x20, 0x0, 0x0) syz_mount_image$nfs4(0x0, 0x0, 0x0, 0x0, &(0x7f0000001600), 0x0, 0x0) 08:24:33 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x9, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000000100000c000000500000000f000000000000000200000006000000000008000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001000000000000000b0000008000000018000000c20500002b82", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000039c043f6970341999833e8e90d2470c4010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x1000}, {&(0x7f0000012500)="ed41000000100000dbf4655fdcf4655fdcf4655f00000000000004008000000000000800050000000af301000400000000000000000000000100000010", 0x3d, 0x4080}, {&(0x7f0000012800)="ed", 0x1, 0x4580}, {&(0x7f0000012b00)="020000000c0001022e000000020000000c0002022e2e00000b00000014000a026c6f73742b666f756e6400000c0000001000050266696c6530", 0x39, 0x10000}, {&(0x7f0000013000)="504d4d00504d4dff", 0x8, 0x40000}, {0x0, 0x0, 0x80000}], 0x0, &(0x7f0000013b00)) lstat(&(0x7f0000000040)='./file0/file0\x00', 0x0) 08:24:33 executing program 6: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup3(r0, r1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x16, 0x0, 0x0) 08:24:33 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x4a, 0x0, &(0x7f00000018c0)) [ 106.316431] loop1: detected capacity change from 0 to 2048 08:24:33 executing program 6: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup3(r0, r1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x16, 0x0, 0x0) 08:24:33 executing program 5: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000080)) eventfd(0x0) 08:24:33 executing program 3: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x1) [ 106.368068] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. 08:24:33 executing program 7: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_pktinfo={{0x1c, 0x0, 0x2, {0x0, @loopback, @multicast2}}}], 0x20}, 0x0) 08:24:33 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x4a, 0x0, &(0x7f00000018c0)) [ 106.380387] ext4 filesystem being mounted at /syzkaller-testdir591367545/syzkaller.9vVl0L/1/file0 supports timestamps until 2038-01-19 (0x7fffffff) 08:24:33 executing program 4: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x1) [ 106.431346] EXT4-fs error (device loop1): ext4_lookup:1789: inode #2: comm syz-executor.1: deleted inode referenced: 12 08:24:33 executing program 0: rseq(&(0x7f0000000180), 0x20, 0x0, 0x0) syz_mount_image$nfs4(0x0, 0x0, 0x0, 0x0, &(0x7f0000001600), 0x0, 0x0) 08:24:33 executing program 3: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x1) 08:24:33 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x4a, 0x0, &(0x7f00000018c0)) 08:24:33 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x9, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000000100000c000000500000000f000000000000000200000006000000000008000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001000000000000000b0000008000000018000000c20500002b82", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000039c043f6970341999833e8e90d2470c4010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x1000}, {&(0x7f0000012500)="ed41000000100000dbf4655fdcf4655fdcf4655f00000000000004008000000000000800050000000af301000400000000000000000000000100000010", 0x3d, 0x4080}, {&(0x7f0000012800)="ed", 0x1, 0x4580}, {&(0x7f0000012b00)="020000000c0001022e000000020000000c0002022e2e00000b00000014000a026c6f73742b666f756e6400000c0000001000050266696c6530", 0x39, 0x10000}, {&(0x7f0000013000)="504d4d00504d4dff", 0x8, 0x40000}, {0x0, 0x0, 0x80000}], 0x0, &(0x7f0000013b00)) lstat(&(0x7f0000000040)='./file0/file0\x00', 0x0) [ 106.516466] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 106.607546] loop1: detected capacity change from 0 to 2048 [ 106.636253] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 106.638976] ext4 filesystem being mounted at /syzkaller-testdir591367545/syzkaller.9vVl0L/2/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 106.645058] EXT4-fs error (device loop1): ext4_lookup:1789: inode #2: comm syz-executor.1: deleted inode referenced: 12 08:24:33 executing program 6: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup3(r0, r1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x16, 0x0, 0x0) 08:24:33 executing program 5: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000080)) eventfd(0x0) 08:24:33 executing program 7: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_pktinfo={{0x1c, 0x0, 0x2, {0x0, @loopback, @multicast2}}}], 0x20}, 0x0) 08:24:33 executing program 0: rseq(&(0x7f0000000180), 0x20, 0x0, 0x0) syz_mount_image$nfs4(0x0, 0x0, 0x0, 0x0, &(0x7f0000001600), 0x0, 0x0) 08:24:33 executing program 4: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x1) 08:24:33 executing program 2: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x9, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000000100000c000000500000000f000000000000000200000006000000000008000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001000000000000000b0000008000000018000000c20500002b82", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000039c043f6970341999833e8e90d2470c4010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x1000}, {&(0x7f0000012500)="ed41000000100000dbf4655fdcf4655fdcf4655f00000000000004008000000000000800050000000af301000400000000000000000000000100000010", 0x3d, 0x4080}, {&(0x7f0000012800)="ed", 0x1, 0x4580}, {&(0x7f0000012b00)="020000000c0001022e000000020000000c0002022e2e00000b00000014000a026c6f73742b666f756e6400000c0000001000050266696c6530", 0x39, 0x10000}, {&(0x7f0000013000)="504d4d00504d4dff", 0x8, 0x40000}, {0x0, 0x0, 0x80000}], 0x0, &(0x7f0000013b00)) lstat(&(0x7f0000000040)='./file0/file0\x00', 0x0) 08:24:33 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x9, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000000100000c000000500000000f000000000000000200000006000000000008000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001000000000000000b0000008000000018000000c20500002b82", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000039c043f6970341999833e8e90d2470c4010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x1000}, {&(0x7f0000012500)="ed41000000100000dbf4655fdcf4655fdcf4655f00000000000004008000000000000800050000000af301000400000000000000000000000100000010", 0x3d, 0x4080}, {&(0x7f0000012800)="ed", 0x1, 0x4580}, {&(0x7f0000012b00)="020000000c0001022e000000020000000c0002022e2e00000b00000014000a026c6f73742b666f756e6400000c0000001000050266696c6530", 0x39, 0x10000}, {&(0x7f0000013000)="504d4d00504d4dff", 0x8, 0x40000}, {0x0, 0x0, 0x80000}], 0x0, &(0x7f0000013b00)) lstat(&(0x7f0000000040)='./file0/file0\x00', 0x0) 08:24:33 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup3(r0, r1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x16, 0x0, 0x0) [ 106.684719] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 106.718334] loop2: detected capacity change from 0 to 2048 08:24:34 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup3(r0, r1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x16, 0x0, 0x0) [ 106.755841] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 106.766370] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 106.767270] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 106.767877] CPU: 0 UID: 0 PID: 3955 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 106.769992] Tainted: [W]=WARN [ 106.770668] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 106.772272] RIP: 0010:__queue_work+0x202/0x1240 [ 106.773675] Code: 48 8b 6d 00 e8 4f 9e 79 03 31 ff 41 89 c5 89 c6 e8 93 f3 31 00 45 85 ed 0f 85 e1 05 00 00 e8 55 f8 31 00 48 89 e8 48 c1 e8 03 <42> 80 3c 20 00 0f 85 a0 0e 00 00 4c 8b 75 00 48 89 df 4c 89 34 24 [ 106.777103] RSP: 0018:ffff8880173c72a8 EFLAGS: 00010056 [ 106.777522] RAX: 0000000000000000 RBX: ffff88800bfce418 RCX: ffffc90002a02000 [ 106.778078] RDX: 0000000000040000 RSI: ffffffff8141ef2b RDI: 0000000000000005 [ 106.778635] RBP: 0000000000000001 R08: 0000000000000001 R09: fffffbfff0f11ef4 [ 106.779191] R10: 0000000000000001 R11: 0000000000000001 R12: dffffc0000000000 [ 106.779756] R13: 0000000000000001 R14: 0000000000000000 R15: ffff8880098c8000 [ 106.780313] FS: 00007ffa901a2700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 106.780942] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 106.781405] CR2: 00007f59c3aae550 CR3: 000000001dec2000 CR4: 0000000000350ef0 [ 106.781962] Call Trace: [ 106.782174] [ 106.782357] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 106.782735] queue_work_on+0xd0/0xe0 [ 106.783037] loop_queue_rq+0x5c8/0x1180 [ 106.783361] __blk_mq_issue_directly+0xd5/0x260 [ 106.783748] ? __pfx___blk_mq_issue_directly+0x10/0x10 [ 106.784167] ? bdev_count_inflight_rw.part.0+0x5f/0x380 [ 106.784592] blk_mq_request_issue_directly+0x11c/0x1e0 [ 106.785007] blk_mq_issue_direct+0x192/0x640 [ 106.785361] blk_mq_dispatch_queue_requests+0x4b0/0x7c0 [ 106.785790] blk_mq_flush_plug_list+0x1ec/0x5b0 [ 106.786162] ? read_tsc+0x9/0x20 [ 106.786438] ? ktime_get+0x16d/0x270 [ 106.786742] ? trace_block_plug+0x149/0x1b0 [ 106.787086] ? blk_add_rq_to_plug+0x234/0x550 [ 106.787447] ? __pfx_blk_mq_flush_plug_list+0x10/0x10 [ 106.787853] ? blk_mq_submit_bio+0x4fd/0x2220 [ 106.788213] __blk_flush_plug+0x25c/0x460 [ 106.788543] ? __pfx___blk_flush_plug+0x10/0x10 [ 106.788911] ? bio_associate_blkg_from_css+0x4fe/0x1380 [ 106.789337] __submit_bio+0x480/0x5b0 [ 106.789640] ? __pfx___submit_bio+0x10/0x10 [ 106.789980] ? read_tsc+0x9/0x20 [ 106.790256] ? ktime_get+0x16d/0x270 [ 106.790558] submit_bio_noacct_nocheck+0x68e/0xcb0 [ 106.790946] ? __pfx_submit_bio_noacct_nocheck+0x10/0x10 [ 106.791385] submit_bio_noacct+0x359/0x1350 [ 106.791727] __sync_dirty_buffer+0x176/0x380 [ 106.792081] ext4_update_superblocks_fn+0x4f3/0xe00 [ 106.792482] ? __pfx_set_overhead+0x10/0x10 [ 106.792828] ? __pfx_ext4_update_superblocks_fn+0x10/0x10 [ 106.793261] ? _raw_spin_unlock_irqrestore+0x2c/0x50 [ 106.793670] ext4_update_overhead+0x21d/0x2b0 [ 106.794030] ext4_fill_super+0x2366/0xba20 [ 106.794383] ? __pfx_ext4_fill_super+0x10/0x10 [ 106.794755] ? find_held_lock+0x2b/0x80 [ 106.795081] ? setup_bdev_super+0x2ed/0x6e0 [ 106.795438] ? set_blocksize+0x1b4/0x470 [ 106.795759] ? lock_release+0xc8/0x290 [ 106.796071] ? sb_set_blocksize+0x177/0x1c0 [ 106.796412] ? setup_bdev_super+0x31f/0x6e0 [ 106.796758] get_tree_bdev_flags+0x38a/0x620 [ 106.797111] ? __pfx_ext4_fill_super+0x10/0x10 [ 106.797476] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 106.797865] ? cap_capable+0xdb/0x3b0 [ 106.798177] ? security_capable+0x2f/0x90 [ 106.798512] vfs_get_tree+0x93/0x340 [ 106.798814] path_mount+0x132d/0x1dd0 [ 106.799124] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 106.799545] ? __pfx_path_mount+0x10/0x10 [ 106.799880] ? kmem_cache_free+0x2a1/0x540 [ 106.800218] ? putname.part.0+0x11b/0x160 [ 106.800552] ? getname_flags.part.0+0x1c6/0x540 [ 106.800932] ? putname.part.0+0x11b/0x160 [ 106.801267] __x64_sys_mount+0x27b/0x300 [ 106.801593] ? __pfx___x64_sys_mount+0x10/0x10 [ 106.801960] do_syscall_64+0xbf/0x360 [ 106.802263] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.802671] RIP: 0033:0x7ffa92c2e04a [ 106.802967] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 106.804391] RSP: 002b:00007ffa901a1fa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 106.804984] RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007ffa92c2e04a [ 106.805544] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffa901a2000 [ 106.806102] RBP: 00007ffa901a2040 R08: 00007ffa901a2040 R09: 0000000020000000 [ 106.806661] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000000 [ 106.807219] R13: 0000000020000100 R14: 00007ffa901a2000 R15: 0000000020013b00 [ 106.807784] [ 106.807974] Modules linked in: [ 106.808236] ---[ end trace 0000000000000000 ]--- [ 106.808603] RIP: 0010:__queue_work+0x202/0x1240 [ 106.808981] Code: 48 8b 6d 00 e8 4f 9e 79 03 31 ff 41 89 c5 89 c6 e8 93 f3 31 00 45 85 ed 0f 85 e1 05 00 00 e8 55 f8 31 00 48 89 e8 48 c1 e8 03 <42> 80 3c 20 00 0f 85 a0 0e 00 00 4c 8b 75 00 48 89 df 4c 89 34 24 [ 106.810398] RSP: 0018:ffff8880173c72a8 EFLAGS: 00010056 [ 106.810818] RAX: 0000000000000000 RBX: ffff88800bfce418 RCX: ffffc90002a02000 [ 106.811381] RDX: 0000000000040000 RSI: ffffffff8141ef2b RDI: 0000000000000005 [ 106.811937] RBP: 0000000000000001 R08: 0000000000000001 R09: fffffbfff0f11ef4 [ 106.812493] R10: 0000000000000001 R11: 0000000000000001 R12: dffffc0000000000 [ 106.813050] R13: 0000000000000001 R14: 0000000000000000 R15: ffff8880098c8000 [ 106.813607] FS: 00007ffa901a2700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 106.814234] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 106.814688] CR2: 00007f59c3aae550 CR3: 000000001dec2000 CR4: 0000000000350ef0 [ 106.815249] note: syz-executor.2[3955] exited with irqs disabled [ 106.816376] note: syz-executor.2[3955] exited with preempt_count 1 [ 106.817392] ------------[ cut here ]------------ [ 106.817787] WARNING: kernel/exit.c:898 at do_exit+0x1c36/0x2970, CPU#0: syz-executor.2/3955 [ 106.818447] Modules linked in: [ 106.818724] CPU: 0 UID: 0 PID: 3955 Comm: syz-executor.2 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 106.819684] Tainted: [D]=DIE, [W]=WARN [ 106.819991] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 106.820635] RIP: 0010:do_exit+0x1c36/0x2970 [ 106.821004] Code: 96 0a 00 00 c7 43 18 00 00 00 00 e9 21 e6 ff ff e8 bf a4 38 00 bf 02 24 00 00 e8 f5 ab 0b 00 e9 41 ff ff ff e8 ab a4 38 00 90 <0f> 0b 90 e9 87 e4 ff ff e8 9d a4 38 00 4c 89 e6 bf 05 06 00 00 e8 [ 106.822439] RSP: 0018:ffff8880173c7e40 EFLAGS: 00010246 [ 106.822878] RAX: 0000000000040000 RBX: 0000000000000200 RCX: ffffc90002a02000 [ 106.823444] RDX: 0000000000040000 RSI: ffffffff813b42d5 RDI: ffff8880413948e8 [ 106.824017] RBP: ffff888041393700 R08: 0000000000000001 R09: fffffbfff0f11cd8 [ 106.824577] R10: 0000000000000200 R11: 0000000000000001 R12: 000000000000000b [ 106.825152] R13: 0000000000002710 R14: dffffc0000000000 R15: 0000000000000000 [ 106.825736] FS: 00007ffa901a2700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 106.826381] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 106.826859] CR2: 00007f59c3aae550 CR3: 000000001dec2000 CR4: 0000000000350ef0 [ 106.827432] Call Trace: [ 106.827639] [ 106.827838] ? _printk+0xbe/0xf0 [ 106.828122] ? __pfx__printk+0x10/0x10 [ 106.828435] ? __pfx_do_exit+0x10/0x10 [ 106.828770] make_task_dead+0x174/0x3b0 [ 106.828871] kmemleak: Found object by alias at 0x607f1a63976c [ 106.828893] CPU: 1 UID: 0 PID: 3956 Comm: syz-executor.6 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 106.828917] Tainted: [D]=DIE, [W]=WARN [ 106.828921] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 106.828928] Call Trace: [ 106.828932] [ 106.828937] dump_stack_lvl+0xca/0x120 [ 106.828966] __lookup_object+0x94/0xb0 [ 106.828987] delete_object_full+0x27/0x70 [ 106.829002] free_percpu+0x30/0x1160 [ 106.829019] ? arch_uprobe_clear_state+0x16/0x140 [ 106.829037] futex_hash_free+0x38/0xc0 [ 106.829052] mmput+0x2d3/0x390 [ 106.829072] do_exit+0x79d/0x2970 [ 106.829086] ? lock_release+0xc8/0x290 [ 106.829102] ? __pfx_do_exit+0x10/0x10 [ 106.829115] ? find_held_lock+0x2b/0x80 [ 106.829132] ? get_signal+0x835/0x2340 [ 106.829153] do_group_exit+0xd3/0x2a0 [ 106.829167] get_signal+0x2315/0x2340 [ 106.829185] ? __pfx_get_signal+0x10/0x10 [ 106.829201] ? do_futex+0x135/0x370 [ 106.829217] ? __pfx_do_futex+0x10/0x10 [ 106.829230] arch_do_signal_or_restart+0x80/0x790 [ 106.829247] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 106.829262] ? __x64_sys_futex+0x1c9/0x4d0 [ 106.829274] ? __x64_sys_futex+0x1d2/0x4d0 [ 106.829289] ? __pfx___x64_sys_futex+0x10/0x10 [ 106.829303] ? __sys_setsockopt+0x13f/0x1a0 [ 106.829323] exit_to_user_mode_loop+0x8b/0x110 [ 106.829335] do_syscall_64+0x2f7/0x360 [ 106.829347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.829360] RIP: 0033:0x7f79e0ab3b19 [ 106.829371] Code: Unable to access opcode bytes at 0x7f79e0ab3aef. [ 106.829376] RSP: 002b:00007f79de029218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 106.829388] RAX: fffffffffffffe00 RBX: 00007f79e0bc6f68 RCX: 00007f79e0ab3b19 [ 106.829396] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f79e0bc6f68 [ 106.829403] RBP: 00007f79e0bc6f60 R08: 0000000000000000 R09: 0000000000000000 [ 106.829410] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f79e0bc6f6c [ 106.829417] R13: 00007ffdb32f518f R14: 00007f79de029300 R15: 0000000000022000 [ 106.829428] [ 106.829431] kmemleak: Object (percpu) 0x607f1a639768 (size 8): [ 106.829439] kmemleak: comm "syz-executor.2", pid 3955, jiffies 4294773564 [ 106.829448] kmemleak: min_count = 1 [ 106.829452] kmemleak: count = 0 [ 106.829456] kmemleak: flags = 0x21 [ 106.829460] kmemleak: checksum = 0 [ 106.829463] kmemleak: backtrace: [ 106.829467] pcpu_alloc_noprof+0x87a/0x1170 [ 106.829482] percpu_ref_init+0x37/0x400 [ 106.829501] blkg_alloc+0xe9/0x7d0 [ 106.829514] blkg_create+0xe08/0x1420 [ 106.829528] bio_associate_blkg_from_css+0xe06/0x1380 [ 106.829542] bio_associate_blkg+0x10e/0x2a0 [ 106.829555] bio_init+0x2dd/0x570 [ 106.829568] bio_alloc_bioset+0x2cf/0x8c0 [ 106.829583] submit_bh_wbc+0x286/0x720 [ 106.829603] ext4_read_bh+0x15a/0x2e0 [ 106.829619] ext4_read_bh_lock+0x7a/0xd0 [ 106.829629] ext4_sb_bread_unmovable+0x172/0x260 [ 106.829641] ext4_fill_super+0x662/0xba20 [ 106.829657] get_tree_bdev_flags+0x38a/0x620 [ 106.829676] vfs_get_tree+0x93/0x340 [ 106.829693] path_mount+0x132d/0x1dd0 [ 106.836466] kmemleak: Found object by alias at 0x607f1a639334 [ 106.836479] CPU: 1 UID: 0 PID: 3951 Comm: syz-executor.0 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 106.836499] Tainted: [D]=DIE, [W]=WARN [ 106.836503] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 106.836509] Call Trace: [ 106.836513] [ 106.836516] dump_stack_lvl+0xca/0x120 [ 106.836535] __lookup_object+0x94/0xb0 [ 106.836549] delete_object_full+0x27/0x70 [ 106.836566] free_percpu+0x30/0x1160 [ 106.836581] ? arch_uprobe_clear_state+0x16/0x140 [ 106.836596] futex_hash_free+0x38/0xc0 [ 106.836608] mmput+0x2d3/0x390 [ 106.836624] do_exit+0x79d/0x2970 [ 106.836638] ? signal_wake_up_state+0x85/0x120 [ 106.836654] ? zap_other_threads+0x2b9/0x3a0 [ 106.836668] ? __pfx_do_exit+0x10/0x10 [ 106.836686] ? do_group_exit+0x1c3/0x2a0 [ 106.836699] ? lock_release+0xc8/0x290 [ 106.836713] do_group_exit+0xd3/0x2a0 [ 106.836729] __x64_sys_exit_group+0x3e/0x50 [ 106.836742] x64_sys_call+0x18c5/0x18d0 [ 106.836756] do_syscall_64+0xbf/0x360 [ 106.836766] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.836777] RIP: 0033:0x7fa4e4658b19 [ 106.836785] Code: Unable to access opcode bytes at 0x7fa4e4658aef. [ 106.836791] RSP: 002b:00007fffa3a4fee8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 08:24:34 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup3(r0, r1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x16, 0x0, 0x0) [ 106.836804] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fa4e4658b19 [ 106.836811] RDX: 00007fa4e460b72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 106.836818] RBP: 0000000000000000 R08: 0000001b2cf201c0 R09: 0000000000000000 [ 106.836825] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 106.836831] R13: 0000000000000000 R14: 0000000000000001 R15: 00007fffa3a4ffd0 [ 106.836841] [ 106.836845] kmemleak: Object (percpu) 0x607f1a639330 (size 8): 08:24:34 executing program 6: r0 = socket(0xa, 0x3, 0x6) sendto(r0, 0x0, 0x2, 0x0, &(0x7f0000000040)=@phonet={0xa}, 0x80) [ 106.836851] kmemleak: comm "syz-executor.2", pid 3955, jiffies 4294773598 [ 106.836858] kmemleak: min_count = 1 [ 106.836862] kmemleak: count = 0 [ 106.836867] kmemleak: flags = 0x21 08:24:34 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f0000000000)={@dev}, 0x8) [ 106.836872] kmemleak: checksum = 0 [ 106.836876] kmemleak: backtrace: [ 106.836879] pcpu_alloc_noprof+0x87a/0x1170 [ 106.836893] percpu_ref_init+0x37/0x400 [ 106.836909] wb_get_create+0x25b/0x1120 [ 106.836918] __inode_attach_wb+0x159/0xc70 [ 106.836931] __folio_mark_dirty+0x908/0xcd0 [ 106.836947] mark_buffer_dirty+0x316/0x3a0 [ 106.836964] __ext4_handle_dirty_metadata+0x3a4/0x8f0 [ 106.836978] ext4_update_superblocks_fn+0x4cf/0xe00 [ 106.836992] ext4_update_overhead+0x21d/0x2b0 [ 106.837006] ext4_fill_super+0x2366/0xba20 [ 106.837023] get_tree_bdev_flags+0x38a/0x620 [ 106.837033] vfs_get_tree+0x93/0x340 [ 106.837047] path_mount+0x132d/0x1dd0 [ 106.837058] __x64_sys_mount+0x27b/0x300 [ 106.837069] do_syscall_64+0xbf/0x360 [ 106.837077] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.838183] loop1: detected capacity change from 0 to 2048 [ 106.838409] ? do_syscall_64+0xbf/0x360 [ 106.838423] rewind_stack_and_make_dead+0x16/0x20 [ 106.846039] kmemleak: Cannot insert 0x607f1a639334 into the object search tree (overlaps existing) [ 106.846053] CPU: 1 UID: 0 PID: 3963 Comm: syz-executor.1 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 106.846071] Tainted: [D]=DIE, [W]=WARN [ 106.846076] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 106.846083] Call Trace: [ 106.846086] [ 106.846090] dump_stack_lvl+0xca/0x120 [ 106.846110] __link_object+0x190/0x210 [ 106.846127] __create_object+0x48/0x80 [ 106.846143] pcpu_alloc_noprof+0x87a/0x1170 08:24:34 executing program 7: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000000c0)=0x3) [ 106.846162] __percpu_init_rwsem+0x2d/0x160 [ 106.846178] ? security_sb_alloc+0x75/0x140 [ 106.846199] alloc_super+0x29e/0xb80 [ 106.846213] ? __pfx_super_s_dev_test+0x10/0x10 [ 106.846230] sget_fc+0xfe/0xb80 [ 106.846240] ? __pfx_super_s_dev_set+0x10/0x10 [ 106.846257] get_tree_bdev_flags+0x1b8/0x620 [ 106.846268] ? __pfx_ext4_fill_super+0x10/0x10 [ 106.846292] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 106.846304] ? cap_capable+0xdb/0x3b0 [ 106.846320] ? security_capable+0x2f/0x90 [ 106.846334] vfs_get_tree+0x93/0x340 [ 106.846351] path_mount+0x132d/0x1dd0 [ 106.846366] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 106.846381] ? __pfx_path_mount+0x10/0x10 [ 106.846393] ? kmem_cache_free+0x2a1/0x540 [ 106.846404] ? putname.part.0+0x11b/0x160 [ 106.846421] ? getname_flags.part.0+0x1c6/0x540 [ 106.846442] ? putname.part.0+0x11b/0x160 [ 106.846458] __x64_sys_mount+0x27b/0x300 [ 106.846470] ? __pfx___x64_sys_mount+0x10/0x10 [ 106.846485] do_syscall_64+0xbf/0x360 [ 106.846496] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.846507] RIP: 0033:0x7f0c3818504a [ 106.846519] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 106.846532] RSP: 002b:00007f0c356f8fa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 106.846543] RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f0c3818504a [ 106.846551] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f0c356f9000 [ 106.846558] RBP: 00007f0c356f9040 R08: 00007f0c356f9040 R09: 0000000020000000 [ 106.846566] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000000 [ 106.846573] R13: 0000000020000100 R14: 00007f0c356f9000 R15: 0000000020013b00 [ 106.846584] [ 106.846598] kmemleak: Kernel memory leak detector disabled [ 106.846603] kmemleak: Object (percpu) 0x607f1a639330 (size 8): [ 106.846610] kmemleak: comm "syz-executor.2", pid 3955, jiffies 4294773598 [ 106.846617] kmemleak: min_count = 1 [ 106.846621] kmemleak: count = 0 [ 106.846625] kmemleak: flags = 0x21 [ 106.846629] kmemleak: checksum = 0 [ 106.846633] kmemleak: backtrace: [ 106.846636] pcpu_alloc_noprof+0x87a/0x1170 [ 106.846651] percpu_ref_init+0x37/0x400 [ 106.846672] wb_get_create+0x25b/0x1120 [ 106.846682] __inode_attach_wb+0x159/0xc70 [ 106.846694] __folio_mark_dirty+0x908/0xcd0 [ 106.846707] mark_buffer_dirty+0x316/0x3a0 [ 106.846724] __ext4_handle_dirty_metadata+0x3a4/0x8f0 [ 106.846737] ext4_update_superblocks_fn+0x4cf/0xe00 [ 106.846756] ext4_update_overhead+0x21d/0x2b0 [ 106.846771] ext4_fill_super+0x2366/0xba20 [ 106.846790] get_tree_bdev_flags+0x38a/0x620 [ 106.846801] vfs_get_tree+0x93/0x340 [ 106.846816] path_mount+0x132d/0x1dd0 [ 106.846827] __x64_sys_mount+0x27b/0x300 [ 106.846839] do_syscall_64+0xbf/0x360 [ 106.846847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.903929] RIP: 0033:0x7ffa92c2e04a [ 106.904240] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 106.905733] RSP: 002b:00007ffa901a1fa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 106.906525] RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007ffa92c2e04a [ 106.907125] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffa901a2000 [ 106.907723] RBP: 00007ffa901a2040 R08: 00007ffa901a2040 R09: 0000000020000000 [ 106.908294] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000000 [ 106.908877] R13: 0000000020000100 R14: 00007ffa901a2000 R15: 0000000020013b00 [ 106.910077] [ 106.910262] irq event stamp: 1688 [ 106.910533] hardirqs last enabled at (1687): [] ktime_get+0x1c7/0x270 [ 106.911191] hardirqs last disabled at (1688): [] _raw_spin_lock_irq+0x42/0x50 [ 106.911900] softirqs last enabled at (1606): [] handle_softirqs+0x50c/0x770 [ 106.912579] softirqs last disabled at (1591): [] __irq_exit_rcu+0xc4/0x100 [ 106.913260] ---[ end trace 0000000000000000 ]--- [ 106.913631] BUG: sleeping function called from invalid context at ./include/linux/percpu-rwsem.h:51 [ 106.914354] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 3955, name: syz-executor.2 [ 106.915046] preempt_count: 0, expected: 0 [ 106.915375] RCU nest depth: 2, expected: 0 [ 106.915716] INFO: lockdep is turned off. [ 106.916034] CPU: 0 UID: 0 PID: 3955 Comm: syz-executor.2 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 106.916052] Tainted: [D]=DIE, [W]=WARN [ 106.916056] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 106.916061] Call Trace: [ 106.916065] [ 106.916069] dump_stack_lvl+0xfa/0x120 [ 106.916087] __might_resched+0x2f3/0x510 [ 106.916100] exit_signals+0x25/0x940 [ 106.916118] do_exit+0x2db/0x2970 [ 106.916130] ? _printk+0xbe/0xf0 [ 106.916142] ? __pfx__printk+0x10/0x10 [ 106.916155] ? __pfx_do_exit+0x10/0x10 [ 106.916169] make_task_dead+0x174/0x3b0 [ 106.916182] ? do_syscall_64+0xbf/0x360 [ 106.916191] rewind_stack_and_make_dead+0x16/0x20 [ 106.916206] RIP: 0033:0x7ffa92c2e04a [ 106.916214] Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 106.916225] RSP: 002b:00007ffa901a1fa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 106.916236] RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007ffa92c2e04a [ 106.916243] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffa901a2000 [ 106.916250] RBP: 00007ffa901a2040 R08: 00007ffa901a2040 R09: 0000000020000000 [ 106.916257] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000020000000 [ 106.916264] R13: 0000000020000100 R14: 00007ffa901a2000 R15: 0000000020013b00 [ 106.916274] [ 106.955275] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 106.968082] ext4 filesystem being mounted at /syzkaller-testdir591367545/syzkaller.9vVl0L/3/file0 supports timestamps until 2038-01-19 (0x7fffffff) 08:24:34 executing program 6: r0 = socket(0xa, 0x3, 0x6) sendto(r0, 0x0, 0x2, 0x0, &(0x7f0000000040)=@phonet={0xa}, 0x80) 08:24:34 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f0000000000)={@dev}, 0x8) 08:24:34 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f0000000000)={@dev}, 0x8) 08:24:34 executing program 3: r0 = socket(0xa, 0x3, 0x6) sendto(r0, 0x0, 0x2, 0x0, &(0x7f0000000040)=@phonet={0xa}, 0x80) 08:24:34 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f0000000000)={@dev}, 0x8) 08:24:34 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x9, &(0x7f0000000000)=0x3, 0x4) syz_emit_ethernet(0x56, &(0x7f0000000040)={@broadcast, @random="5e52989c7e32", @void, {@canfd={0xd, {{}, 0x0, 0x0, 0x0, 0x0, "aa3ab8446a84edc760baf5d5e1b0228ec5bfd22d6df372518b10708bdb014b7899f059b9e8ae4e0ffd6c4cee48f722e396f35768e2ae0fab78858811c5ce3e8d"}}}}, 0x0) 08:24:34 executing program 3: r0 = socket(0xa, 0x3, 0x6) sendto(r0, 0x0, 0x2, 0x0, &(0x7f0000000040)=@phonet={0xa}, 0x80) 08:24:34 executing program 6: r0 = socket(0xa, 0x3, 0x6) sendto(r0, 0x0, 0x2, 0x0, &(0x7f0000000040)=@phonet={0xa}, 0x80) [ 107.091476] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 107.192869] kmemleak: Automatic memory scanning thread ended VM DIAGNOSIS: 08:24:34 Registers: info registers vcpu 0 RAX=0000000000000065 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff828e32c5 RDI=ffffffff88724180 RBP=ffffffff88724140 RSP=ffff8880173c6bf8 R8 =0000000000000000 R9 =ffffed10016c7046 R10=0000000000000065 R11=3034323178304952 R12=0000000000000065 R13=0000000000000010 R14=ffffffff88724140 R15=ffffffff828e32b0 RIP=ffffffff828e331d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007ffa901a2700 00000000 00000000 GS =0000 ffff8880e55dd000 00000000 00000000 LDT=0000 fffffe4f00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f59c3aae550 CR3=000000001dec2000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=ff00000000ff000000000000000000ff XMM01=25252525252525252525252525252525 XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000000 RBX=ffff88806ce3de00 RCX=ffffffff816880fc RDX=ffff888041391b80 RSI=ffffffff816880d6 RDI=0000000000000005 RBP=0000000000000003 RSP=ffff888016aaf6f8 R8 =0000000000000000 R9 =0000000000000000 R10=0000000000000001 R11=1ffff1100d9e6bb1 R12=ffffed100d9c7bc1 R13=ffff88806ce3de08 R14=0000000000000001 R15=dffffc0000000000 RIP=ffffffff816880d8 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e56dd000 00000000 00000000 LDT=0000 fffffe6d00000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fde76961344 CR3=000000003be7c000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=ff00000000ff000000000000000000ff XMM01=25252525252525252525252525252525 XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000