Warning: Permanently added '[localhost]:36041' (ECDSA) to the list of known hosts. 2025/08/29 09:33:12 fuzzer started 2025/08/29 09:33:12 dialing manager at localhost:43077 syzkaller login: [ 51.537818] cgroup: Unknown subsys name 'net' [ 51.598730] cgroup: Unknown subsys name 'cpuset' [ 51.625770] cgroup: Unknown subsys name 'rlimit' 2025/08/29 09:33:23 syscalls: 2214 2025/08/29 09:33:23 code coverage: enabled 2025/08/29 09:33:23 comparison tracing: enabled 2025/08/29 09:33:23 extra coverage: enabled 2025/08/29 09:33:23 setuid sandbox: enabled 2025/08/29 09:33:23 namespace sandbox: enabled 2025/08/29 09:33:23 Android sandbox: enabled 2025/08/29 09:33:23 fault injection: enabled 2025/08/29 09:33:23 leak checking: enabled 2025/08/29 09:33:23 net packet injection: enabled 2025/08/29 09:33:23 net device setup: enabled 2025/08/29 09:33:23 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2025/08/29 09:33:23 devlink PCI setup: PCI device 0000:00:10.0 is not available 2025/08/29 09:33:23 USB emulation: enabled 2025/08/29 09:33:23 hci packet injection: enabled 2025/08/29 09:33:23 wifi device emulation: enabled 2025/08/29 09:33:23 802.15.4 emulation: enabled 2025/08/29 09:33:23 fetching corpus: 0, signal 0/2000 (executing program) 2025/08/29 09:33:23 fetching corpus: 50, signal 22894/26286 (executing program) 2025/08/29 09:33:23 fetching corpus: 100, signal 32022/36779 (executing program) 2025/08/29 09:33:23 fetching corpus: 150, signal 38024/44061 (executing program) 2025/08/29 09:33:23 fetching corpus: 200, signal 44453/51535 (executing program) 2025/08/29 09:33:23 fetching corpus: 250, signal 50711/58744 (executing program) 2025/08/29 09:33:23 fetching corpus: 300, signal 54545/63525 (executing program) 2025/08/29 09:33:24 fetching corpus: 350, signal 59168/69002 (executing program) 2025/08/29 09:33:24 fetching corpus: 400, signal 64611/75021 (executing program) 2025/08/29 09:33:24 fetching corpus: 450, signal 67799/78886 (executing program) 2025/08/29 09:33:24 fetching corpus: 500, signal 71161/82856 (executing program) 2025/08/29 09:33:24 fetching corpus: 550, signal 75928/87956 (executing program) 2025/08/29 09:33:24 fetching corpus: 600, signal 78319/90924 (executing program) 2025/08/29 09:33:24 fetching corpus: 650, signal 80072/93320 (executing program) 2025/08/29 09:33:24 fetching corpus: 700, signal 82256/96058 (executing program) 2025/08/29 09:33:24 fetching corpus: 750, signal 84057/98391 (executing program) 2025/08/29 09:33:24 fetching corpus: 800, signal 86337/101101 (executing program) 2025/08/29 09:33:25 fetching corpus: 850, signal 88220/103386 (executing program) 2025/08/29 09:33:25 fetching corpus: 900, signal 90372/105989 (executing program) 2025/08/29 09:33:25 fetching corpus: 950, signal 92450/108300 (executing program) 2025/08/29 09:33:25 fetching corpus: 1000, signal 93590/109934 (executing program) 2025/08/29 09:33:25 fetching corpus: 1050, signal 95577/112122 (executing program) 2025/08/29 09:33:25 fetching corpus: 1100, signal 97818/114421 (executing program) 2025/08/29 09:33:25 fetching corpus: 1150, signal 99502/116341 (executing program) 2025/08/29 09:33:25 fetching corpus: 1200, signal 100622/117836 (executing program) 2025/08/29 09:33:25 fetching corpus: 1250, signal 102569/119813 (executing program) 2025/08/29 09:33:25 fetching corpus: 1300, signal 103729/121190 (executing program) 2025/08/29 09:33:26 fetching corpus: 1350, signal 106050/123324 (executing program) 2025/08/29 09:33:26 fetching corpus: 1400, signal 107074/124574 (executing program) 2025/08/29 09:33:26 fetching corpus: 1450, signal 109913/126897 (executing program) 2025/08/29 09:33:26 fetching corpus: 1500, signal 111267/128306 (executing program) 2025/08/29 09:33:26 fetching corpus: 1550, signal 112241/129440 (executing program) 2025/08/29 09:33:26 fetching corpus: 1600, signal 113869/130889 (executing program) 2025/08/29 09:33:26 fetching corpus: 1650, signal 114679/131882 (executing program) 2025/08/29 09:33:26 fetching corpus: 1700, signal 115896/133054 (executing program) 2025/08/29 09:33:26 fetching corpus: 1750, signal 116924/134148 (executing program) 2025/08/29 09:33:26 fetching corpus: 1800, signal 117701/135024 (executing program) 2025/08/29 09:33:27 fetching corpus: 1850, signal 119447/136393 (executing program) 2025/08/29 09:33:27 fetching corpus: 1900, signal 120596/137445 (executing program) 2025/08/29 09:33:27 fetching corpus: 1950, signal 121529/138337 (executing program) 2025/08/29 09:33:27 fetching corpus: 2000, signal 122222/139139 (executing program) 2025/08/29 09:33:27 fetching corpus: 2050, signal 123141/139985 (executing program) 2025/08/29 09:33:27 fetching corpus: 2100, signal 124636/141042 (executing program) 2025/08/29 09:33:27 fetching corpus: 2150, signal 125551/141799 (executing program) 2025/08/29 09:33:27 fetching corpus: 2200, signal 126861/142665 (executing program) 2025/08/29 09:33:27 fetching corpus: 2250, signal 127986/143447 (executing program) 2025/08/29 09:33:28 fetching corpus: 2300, signal 129332/144338 (executing program) 2025/08/29 09:33:28 fetching corpus: 2350, signal 130272/145028 (executing program) 2025/08/29 09:33:28 fetching corpus: 2400, signal 130997/145612 (executing program) 2025/08/29 09:33:28 fetching corpus: 2450, signal 132365/146364 (executing program) 2025/08/29 09:33:28 fetching corpus: 2500, signal 133237/146941 (executing program) 2025/08/29 09:33:28 fetching corpus: 2550, signal 133726/147332 (executing program) 2025/08/29 09:33:28 fetching corpus: 2600, signal 134372/147805 (executing program) 2025/08/29 09:33:28 fetching corpus: 2650, signal 135000/148250 (executing program) 2025/08/29 09:33:28 fetching corpus: 2700, signal 135618/148668 (executing program) 2025/08/29 09:33:29 fetching corpus: 2750, signal 136327/149089 (executing program) 2025/08/29 09:33:29 fetching corpus: 2800, signal 137647/149611 (executing program) 2025/08/29 09:33:29 fetching corpus: 2850, signal 138232/149969 (executing program) 2025/08/29 09:33:29 fetching corpus: 2900, signal 138789/150311 (executing program) 2025/08/29 09:33:29 fetching corpus: 2950, signal 139743/150693 (executing program) 2025/08/29 09:33:29 fetching corpus: 3000, signal 140224/151039 (executing program) 2025/08/29 09:33:29 fetching corpus: 3050, signal 140914/151317 (executing program) 2025/08/29 09:33:29 fetching corpus: 3100, signal 141486/151608 (executing program) 2025/08/29 09:33:29 fetching corpus: 3150, signal 142152/151850 (executing program) 2025/08/29 09:33:29 fetching corpus: 3200, signal 142826/152103 (executing program) 2025/08/29 09:33:30 fetching corpus: 3250, signal 143453/152327 (executing program) 2025/08/29 09:33:30 fetching corpus: 3300, signal 144387/152719 (executing program) 2025/08/29 09:33:30 fetching corpus: 3350, signal 144776/152911 (executing program) 2025/08/29 09:33:30 fetching corpus: 3400, signal 145491/153146 (executing program) 2025/08/29 09:33:30 fetching corpus: 3450, signal 145926/153330 (executing program) 2025/08/29 09:33:30 fetching corpus: 3500, signal 146572/153471 (executing program) 2025/08/29 09:33:30 fetching corpus: 3550, signal 147084/153633 (executing program) 2025/08/29 09:33:30 fetching corpus: 3600, signal 147596/153752 (executing program) 2025/08/29 09:33:30 fetching corpus: 3650, signal 148418/153876 (executing program) 2025/08/29 09:33:31 fetching corpus: 3700, signal 148829/153943 (executing program) 2025/08/29 09:33:31 fetching corpus: 3750, signal 149394/153970 (executing program) 2025/08/29 09:33:31 fetching corpus: 3800, signal 149732/153970 (executing program) 2025/08/29 09:33:31 fetching corpus: 3850, signal 150232/153971 (executing program) 2025/08/29 09:33:31 fetching corpus: 3900, signal 150974/153972 (executing program) 2025/08/29 09:33:31 fetching corpus: 3950, signal 151374/153972 (executing program) 2025/08/29 09:33:31 fetching corpus: 3998, signal 151812/153983 (executing program) 2025/08/29 09:33:31 fetching corpus: 3998, signal 151812/153983 (executing program) 2025/08/29 09:33:33 starting 8 fuzzer processes 09:33:33 executing program 0: syz_mount_image$tmpfs(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={[{@mpol={'mpol', 0x3d, {'prefer', '=relative', @val={0x3a, [0x32, 0x2d, 0x39, 0x3a, 0x34]}}}}]}) 09:33:33 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCETHTOOL(r0, 0x8923, &(0x7f00000000c0)={'wlan0\x00', 0x0}) 09:33:33 executing program 6: perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x4840, 0x0) ioctl$CDROMREADAUDIO(r0, 0x1261, 0x0) 09:33:33 executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000280)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010064dcd1a3000000002a0000000c00018008000100", @ANYRES32=r3], 0x20}}, 0x0) 09:33:33 executing program 1: creat(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x8000) [ 71.896195] audit: type=1400 audit(1756460013.364:7): avc: denied { execmem } for pid=272 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 09:33:33 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448dd, &(0x7f0000000500)) 09:33:33 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000180)=0xc9e7, 0x4) sendmmsg$sock(r0, &(0x7f0000000600)=[{{&(0x7f0000000200)=@nfc={0x27, 0x1}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000300)="e557ce3bd6d952e732a1", 0xa}], 0x1}}], 0x1, 0x0) 09:33:33 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000100)={0x0, {{0x2, 0x0, @broadcast}}, 0x0, 0x1fffffe, [{{0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {{0x2, 0x0, @loopback}}]}, 0x190) [ 73.033319] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 73.036416] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 73.040021] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 73.042225] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 73.044625] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 73.046751] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 73.051645] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 73.053364] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 73.056208] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 73.058876] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 73.252915] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 73.260561] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 73.265482] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 73.274669] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 73.282594] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 73.293568] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 73.294847] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 73.296116] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 73.297480] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 73.301447] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 73.302215] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 73.303779] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 73.304474] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 73.307398] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 73.313637] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 73.314654] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 73.314938] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 73.318220] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 73.319797] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 73.323743] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 73.325464] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 73.326564] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 73.327985] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 73.341386] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 73.347412] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 73.353469] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 73.357707] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 73.359963] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 73.369598] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 73.376239] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 75.127809] Bluetooth: hci0: command tx timeout [ 75.128629] Bluetooth: hci1: command tx timeout [ 75.384919] Bluetooth: hci4: command tx timeout [ 75.385069] Bluetooth: hci3: command tx timeout [ 75.386678] Bluetooth: hci6: command tx timeout [ 75.447870] Bluetooth: hci2: command tx timeout [ 75.449294] Bluetooth: hci7: command tx timeout [ 75.449939] Bluetooth: hci5: command tx timeout [ 77.175916] Bluetooth: hci1: command tx timeout [ 77.176390] Bluetooth: hci0: command tx timeout [ 77.431410] Bluetooth: hci4: command tx timeout [ 77.431868] Bluetooth: hci3: command tx timeout [ 77.433039] Bluetooth: hci6: command tx timeout [ 77.495364] Bluetooth: hci2: command tx timeout [ 77.496824] Bluetooth: hci5: command tx timeout [ 77.497217] Bluetooth: hci7: command tx timeout [ 79.223532] Bluetooth: hci1: command tx timeout [ 79.223981] Bluetooth: hci0: command tx timeout [ 79.481330] Bluetooth: hci3: command tx timeout [ 79.481786] Bluetooth: hci4: command tx timeout [ 79.482169] Bluetooth: hci6: command tx timeout [ 79.543464] Bluetooth: hci7: command tx timeout [ 79.543877] Bluetooth: hci5: command tx timeout [ 79.543912] Bluetooth: hci2: command tx timeout [ 81.272388] Bluetooth: hci0: command tx timeout [ 81.272841] Bluetooth: hci1: command tx timeout [ 81.527320] Bluetooth: hci6: command tx timeout [ 81.527775] Bluetooth: hci4: command tx timeout [ 81.528154] Bluetooth: hci3: command tx timeout [ 81.591362] Bluetooth: hci2: command tx timeout [ 81.591516] Bluetooth: hci5: command tx timeout [ 81.592488] Bluetooth: hci7: command tx timeout [ 109.097494] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.098167] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.236605] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.237272] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.419414] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.420039] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.566309] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.566938] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 09:34:11 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000180)=0xc9e7, 0x4) sendmmsg$sock(r0, &(0x7f0000000600)=[{{&(0x7f0000000200)=@nfc={0x27, 0x1}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000300)="e557ce3bd6d952e732a1", 0xa}], 0x1}}], 0x1, 0x0) [ 109.675332] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.675932] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 09:34:11 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000180)=0xc9e7, 0x4) sendmmsg$sock(r0, &(0x7f0000000600)=[{{&(0x7f0000000200)=@nfc={0x27, 0x1}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000300)="e557ce3bd6d952e732a1", 0xa}], 0x1}}], 0x1, 0x0) [ 109.839708] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.840870] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 09:34:11 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000180)=0xc9e7, 0x4) sendmmsg$sock(r0, &(0x7f0000000600)=[{{&(0x7f0000000200)=@nfc={0x27, 0x1}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000300)="e557ce3bd6d952e732a1", 0xa}], 0x1}}], 0x1, 0x0) 09:34:11 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000180)=0xc9e7, 0x4) sendmmsg$sock(r0, &(0x7f0000000600)=[{{&(0x7f0000000200)=@nfc={0x27, 0x1}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000300)="e557ce3bd6d952e732a1", 0xa}], 0x1}}], 0x1, 0x0) 09:34:11 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000180)=0xc9e7, 0x4) sendmmsg$sock(r0, &(0x7f0000000600)=[{{&(0x7f0000000200)=@nfc={0x27, 0x1}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000300)="e557ce3bd6d952e732a1", 0xa}], 0x1}}], 0x1, 0x0) 09:34:11 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000180)=0xc9e7, 0x4) sendmmsg$sock(r0, &(0x7f0000000600)=[{{&(0x7f0000000200)=@nfc={0x27, 0x1}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000300)="e557ce3bd6d952e732a1", 0xa}], 0x1}}], 0x1, 0x0) 09:34:11 executing program 4: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000400), 0x0, 0x2) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000440)="e551acd9be836525a6c34fdbc3f075add89d8855f7ca978b", 0x18}], 0x1) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) [ 110.302527] audit: type=1400 audit(1756460051.770:8): avc: denied { open } for pid=3780 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 110.306410] audit: type=1400 audit(1756460051.770:9): avc: denied { kernel } for pid=3780 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 09:34:11 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000100)={0x0, {{0x2, 0x0, @broadcast}}, 0x0, 0x1fffffe, [{{0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {{0x2, 0x0, @loopback}}]}, 0x190) [ 110.520315] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.520968] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.649320] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.649912] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.104899] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 111.455362] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.455953] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.520212] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.520837] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.671061] tmpfs: Bad value for 'mpol' [ 111.671306] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.672031] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.674046] tmpfs: Bad value for 'mpol' [ 111.710928] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.711595] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.964752] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.965418] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.039373] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.039970] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.056066] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.056692] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.098385] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.098970] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 09:34:13 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000100)={0x0, {{0x2, 0x0, @broadcast}}, 0x0, 0x1fffffe, [{{0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {{0x2, 0x0, @loopback}}]}, 0x190) 09:34:13 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448dd, &(0x7f0000000500)) 09:34:13 executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000280)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010064dcd1a3000000002a0000000c00018008000100", @ANYRES32=r3], 0x20}}, 0x0) 09:34:13 executing program 4: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000400), 0x0, 0x2) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000440)="e551acd9be836525a6c34fdbc3f075add89d8855f7ca978b", 0x18}], 0x1) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) 09:34:13 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x4) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0x10, 0x4) 09:34:13 executing program 1: creat(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x8000) 09:34:13 executing program 0: syz_mount_image$tmpfs(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={[{@mpol={'mpol', 0x3d, {'prefer', '=relative', @val={0x3a, [0x32, 0x2d, 0x39, 0x3a, 0x34]}}}}]}) 09:34:13 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCETHTOOL(r0, 0x8923, &(0x7f00000000c0)={'wlan0\x00', 0x0}) [ 112.277121] tmpfs: Bad value for 'mpol' 09:34:13 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x4) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0x10, 0x4) [ 112.312524] Bluetooth: hci0: command 0x0c1a tx timeout [ 112.315416] Bluetooth: hci0: Opcode 0x0c1a failed: -110 09:34:13 executing program 4: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000400), 0x0, 0x2) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000440)="e551acd9be836525a6c34fdbc3f075add89d8855f7ca978b", 0x18}], 0x1) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) 09:34:13 executing program 0: syz_mount_image$tmpfs(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={[{@mpol={'mpol', 0x3d, {'prefer', '=relative', @val={0x3a, [0x32, 0x2d, 0x39, 0x3a, 0x34]}}}}]}) 09:34:13 executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000280)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010064dcd1a3000000002a0000000c00018008000100", @ANYRES32=r3], 0x20}}, 0x0) 09:34:13 executing program 1: creat(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x8000) 09:34:13 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448dd, &(0x7f0000000500)) [ 112.365545] kmemleak: Found object by alias at 0x607f1a62f32c [ 112.365568] CPU: 0 UID: 0 PID: 3932 Comm: syz-executor.6 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 112.365587] Tainted: [W]=WARN [ 112.365591] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 112.365598] Call Trace: [ 112.365602] [ 112.365607] dump_stack_lvl+0xca/0x120 [ 112.365636] __lookup_object+0x94/0xb0 [ 112.365654] delete_object_full+0x27/0x70 [ 112.365670] free_percpu+0x30/0x1160 [ 112.365686] ? arch_uprobe_clear_state+0x16/0x140 [ 112.365707] futex_hash_free+0x38/0xc0 [ 112.365722] mmput+0x2d3/0x390 [ 112.365741] do_exit+0x79d/0x2970 [ 112.365754] ? signal_wake_up_state+0x85/0x120 [ 112.365770] ? zap_other_threads+0x2b9/0x3a0 [ 112.365786] ? __pfx_do_exit+0x10/0x10 [ 112.365798] ? do_group_exit+0x1c3/0x2a0 [ 112.365811] ? lock_release+0xc8/0x290 [ 112.365829] do_group_exit+0xd3/0x2a0 [ 112.365843] __x64_sys_exit_group+0x3e/0x50 [ 112.365857] x64_sys_call+0x18c5/0x18d0 [ 112.365872] do_syscall_64+0xbf/0x360 [ 112.365884] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.365896] RIP: 0033:0x7fa68daa9b19 [ 112.365905] Code: Unable to access opcode bytes at 0x7fa68daa9aef. [ 112.365910] RSP: 002b:00007ffc15f73288 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 112.365922] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007fa68daa9b19 [ 112.365929] RDX: 00007fa68da5c72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 112.365937] RBP: 0000000000000000 R08: 0000001b2d1212bc R09: 0000000000000000 [ 112.365944] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 112.365950] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffc15f73370 [ 112.365966] [ 112.365970] kmemleak: Object (percpu) 0x607f1a62f324 (size 16): [ 112.365977] kmemleak: comm "syz-executor.7", pid 284, jiffies 4294779241 [ 112.365984] kmemleak: min_count = 1 [ 112.365988] kmemleak: count = 0 [ 112.365992] kmemleak: flags = 0x21 [ 112.365995] kmemleak: checksum = 0 [ 112.365999] kmemleak: backtrace: [ 112.366003] pcpu_alloc_noprof+0x87a/0x1170 [ 112.366018] __percpu_counter_init_many+0x44/0x360 [ 112.366031] mm_init+0xcac/0x1170 [ 112.366039] copy_process+0x3ab7/0x73c0 [ 112.366049] kernel_clone+0xea/0x7f0 [ 112.366059] __do_sys_clone+0xce/0x120 [ 112.366069] do_syscall_64+0xbf/0x360 [ 112.366077] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.404051] tmpfs: Bad value for 'mpol' [ 112.489832] BUG: Bad rss-counter state mm:0000000061d0685e type:MM_ANONPAGES val:1 Comm:syz-executor.7 Pid:3942 [ 113.233229] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 113.254368] kmemleak: Found object by alias at 0x607f1a62f330 [ 113.254397] CPU: 0 UID: 0 PID: 3940 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 113.254435] Tainted: [W]=WARN [ 113.254443] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 113.254458] Call Trace: [ 113.254466] [ 113.254475] dump_stack_lvl+0xca/0x120 [ 113.254523] __lookup_object+0x94/0xb0 [ 113.254557] delete_object_full+0x27/0x70 [ 113.254593] free_percpu+0x30/0x1160 [ 113.254627] ? arch_uprobe_clear_state+0x16/0x140 [ 113.254670] futex_hash_free+0x38/0xc0 [ 113.254700] mmput+0x2d3/0x390 [ 113.254740] do_exit+0x79d/0x2970 [ 113.254778] ? __pfx_do_exit+0x10/0x10 [ 113.254809] ? find_held_lock+0x2b/0x80 [ 113.254848] ? get_signal+0x835/0x2340 [ 113.254891] do_group_exit+0xd3/0x2a0 [ 113.254924] get_signal+0x2315/0x2340 [ 113.254967] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 113.255003] ? __pfx_get_signal+0x10/0x10 [ 113.255043] ? __pfx_task_work_add+0x10/0x10 [ 113.255079] arch_do_signal_or_restart+0x80/0x790 [ 113.255117] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 113.255151] ? __fput_deferred+0x21a/0x490 [ 113.255186] ? __pfx___fput_deferred+0x10/0x10 [ 113.255218] ? __pfx___file_ref_put+0x10/0x10 [ 113.255268] ? selinux_file_ioctl+0xb9/0x280 [ 113.255312] exit_to_user_mode_loop+0x8b/0x110 [ 113.255339] do_syscall_64+0x2f7/0x360 [ 113.255365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.255390] RIP: 0033:0x7f81a65c9b19 [ 113.255408] Code: Unable to access opcode bytes at 0x7f81a65c9aef. [ 113.255420] RSP: 002b:00007f81a3b3f188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 113.255443] RAX: fffffffffffffffc RBX: 00007f81a66dcf60 RCX: 00007f81a65c9b19 [ 113.255460] RDX: 0000000020000500 RSI: 00000000400448dd RDI: 0000000000000004 [ 113.255475] RBP: 00007f81a6623f6d R08: 0000000000000000 R09: 0000000000000000 [ 113.255490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 113.255504] R13: 00007fffbb778eaf R14: 00007f81a3b3f300 R15: 0000000000022000 [ 113.255539] [ 113.255547] kmemleak: Object (percpu) 0x607f1a62f324 (size 16): [ 113.255561] kmemleak: comm "systemd-udevd", pid 114, jiffies 4294779613 [ 113.255576] kmemleak: min_count = 1 [ 113.255585] kmemleak: count = 0 [ 113.255592] kmemleak: flags = 0x21 [ 113.255601] kmemleak: checksum = 0 [ 113.255609] kmemleak: backtrace: [ 113.255616] pcpu_alloc_noprof+0x87a/0x1170 [ 113.255649] __percpu_counter_init_many+0x44/0x360 [ 113.255676] mm_init+0xcac/0x1170 [ 113.255693] copy_process+0x3ab7/0x73c0 [ 113.255715] kernel_clone+0xea/0x7f0 [ 113.255736] __do_sys_clone+0xce/0x120 [ 113.255758] do_syscall_64+0xbf/0x360 [ 113.255777] entry_SYSCALL_64_after_hwframe+0x77/0x7f 09:34:14 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000100)={0x0, {{0x2, 0x0, @broadcast}}, 0x0, 0x1fffffe, [{{0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {{0x2, 0x0, @loopback}}]}, 0x190) 09:34:14 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCETHTOOL(r0, 0x8923, &(0x7f00000000c0)={'wlan0\x00', 0x0}) 09:34:14 executing program 0: syz_mount_image$tmpfs(&(0x7f0000000000), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={[{@mpol={'mpol', 0x3d, {'prefer', '=relative', @val={0x3a, [0x32, 0x2d, 0x39, 0x3a, 0x34]}}}}]}) 09:34:14 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x4) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0x10, 0x4) 09:34:14 executing program 1: creat(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x8000) 09:34:14 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448dd, &(0x7f0000000500)) 09:34:14 executing program 4: perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x79, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000400), 0x0, 0x2) writev(r0, &(0x7f0000000500)=[{&(0x7f0000000440)="e551acd9be836525a6c34fdbc3f075add89d8855f7ca978b", 0x18}], 0x1) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) 09:34:14 executing program 7: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000002040)={0x0, 0x0, &(0x7f0000002000)={&(0x7f0000000280)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010064dcd1a3000000002a0000000c00018008000100", @ANYRES32=r3], 0x20}}, 0x0) [ 113.349525] BUG: unable to handle page fault for address: ffffed10212c935e [ 113.350299] #PF: supervisor read access in kernel mode [ 113.350873] #PF: error_code(0x0000) - not-present page [ 113.351440] PGD 7ffd4067 P4D 7ffd4067 PUD 7ffd3067 PMD 0 [ 113.352061] Oops: Oops: 0000 [#1] SMP KASAN NOPTI [ 113.352597] CPU: 0 UID: 0 PID: 3951 Comm: syz-executor.3 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 113.353881] Tainted: [W]=WARN [ 113.354225] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 113.354822] tmpfs: Bad value for 'mpol' [ 113.355106] RIP: 0010:perf_tp_event+0x175/0xe70 [ 113.355974] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 113.357926] RSP: 0018:ffff8880462ff780 EFLAGS: 00010012 [ 113.358558] RAX: 1ffff110212c935e RBX: ffff888109649900 RCX: ffffc90001a97000 [ 113.359358] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: ffff888109649af0 [ 113.360160] RBP: ffff8880462ff9f0 R08: ffff88806ce31340 R09: ffffe8ffffc075e8 [ 113.360955] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 113.361769] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 [ 113.362554] FS: 00007fe7e0598700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 113.363468] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 113.364129] CR2: ffffed10212c935e CR3: 000000000e2bb000 CR4: 0000000000350ef0 [ 113.365014] Call Trace: [ 113.365330] [ 113.365598] ? __pfx_perf_tp_event+0x10/0x10 [ 113.366096] ? __asan_memcpy+0x3d/0x60 [ 113.366540] ? visit_groups_merge.constprop.0.isra.0+0x6e7/0x1150 [ 113.367220] ? __pfx_visit_groups_merge.constprop.0.isra.0+0x10/0x10 [ 113.367926] ? lock_is_held_type+0x9e/0x120 [ 113.368419] ? ctx_sched_in+0x134/0x9b0 [ 113.368866] ? css_rstat_updated+0x1b8/0x4d0 [ 113.369382] ? __pfx_css_rstat_updated+0x10/0x10 [ 113.369926] ? lock_is_held_type+0x9e/0x120 [ 113.370416] ? trace_pelt_se_tp+0xdf/0x130 [ 113.370887] ? perf_trace_run_bpf_submit+0xef/0x180 [ 113.371448] ? lock_is_held_type+0x9e/0x120 [ 113.371939] perf_trace_run_bpf_submit+0xef/0x180 [ 113.372498] perf_trace_preemptirq_template+0x259/0x430 [ 113.373104] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 113.373772] ? check_preempt_wakeup_fair+0x406/0x950 [ 113.374339] ? find_held_lock+0x2b/0x80 [ 113.374796] ? try_to_wake_up+0x8ae/0x11d0 [ 113.375280] ? _raw_spin_unlock_irqrestore+0x2c/0x50 [ 113.375851] trace_irq_enable.constprop.0+0xa6/0x100 [ 113.376424] trace_hardirqs_on+0x26/0x40 [ 113.376878] _raw_spin_unlock_irqrestore+0x2c/0x50 [ 113.377451] try_to_wake_up+0x8ae/0x11d0 [ 113.377920] ? __pfx_try_to_wake_up+0x10/0x10 [ 113.378437] ? plist_del+0x122/0x270 [ 113.378868] ? find_held_lock+0x2b/0x80 [ 113.379329] ? futex_wake+0x474/0x540 [ 113.379768] wake_up_q+0xa1/0x130 [ 113.380176] futex_wake+0x47e/0x540 [ 113.380597] ? __pfx_futex_wake+0x10/0x10 [ 113.381073] ? __do_sys_perf_event_open+0x44d/0x2c20 [ 113.381653] ? lock_release+0xc8/0x290 [ 113.382103] do_futex+0x26d/0x370 [ 113.382511] ? __pfx_do_futex+0x10/0x10 [ 113.382964] __x64_sys_futex+0x1c9/0x4d0 [ 113.383425] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 113.384084] ? __pfx___x64_sys_futex+0x10/0x10 [ 113.384607] ? xfd_validate_state+0x55/0x180 [ 113.385123] do_syscall_64+0xbf/0x360 [ 113.385562] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.386139] RIP: 0033:0x7fe7e3022b19 [ 113.386557] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 113.388541] RSP: 002b:00007fe7e0598218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 113.389390] RAX: ffffffffffffffda RBX: 00007fe7e3135f68 RCX: 00007fe7e3022b19 [ 113.390181] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe7e3135f6c [ 113.390966] RBP: 00007fe7e3135f60 R08: 000000000000000e R09: 0000000000000000 [ 113.391753] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fe7e3135f6c [ 113.392534] R13: 00007ffc11ff91bf R14: 00007fe7e0598300 R15: 0000000000022000 [ 113.393346] [ 113.393618] Modules linked in: [ 113.393993] CR2: ffffed10212c935e [ 113.394384] ---[ end trace 0000000000000000 ]--- [ 113.394905] RIP: 0010:perf_tp_event+0x175/0xe70 [ 113.395439] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 113.397438] RSP: 0018:ffff8880462ff780 EFLAGS: 00010012 [ 113.398030] RAX: 1ffff110212c935e RBX: ffff888109649900 RCX: ffffc90001a97000 [ 113.398812] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: ffff888109649af0 [ 113.399590] RBP: ffff8880462ff9f0 R08: ffff88806ce31340 R09: ffffe8ffffc075e8 [ 113.400379] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 113.401167] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 [ 113.401958] FS: 00007fe7e0598700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 113.402847] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 113.403503] CR2: ffffed10212c935e CR3: 000000000e2bb000 CR4: 0000000000350ef0 [ 113.404293] note: syz-executor.3[3951] exited with irqs disabled [ 113.405032] BUG: unable to handle page fault for address: ffffed10212c935e [ 113.405802] #PF: supervisor read access in kernel mode [ 113.406387] #PF: error_code(0x0000) - not-present page [ 113.406970] PGD 7ffd4067 P4D 7ffd4067 PUD 7ffd3067 PMD 0 [ 113.407609] Oops: Oops: 0000 [#2] SMP KASAN NOPTI [ 113.408153] CPU: 0 UID: 0 PID: 3951 Comm: syz-executor.3 Tainted: G D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 113.409492] Tainted: [D]=DIE, [W]=WARN [ 113.409918] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 113.410833] RIP: 0010:perf_tp_event+0x175/0xe70 [ 113.411364] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 113.413348] RSP: 0018:ffff88806ce08b80 EFLAGS: 00010012 [ 113.413949] RAX: 1ffff110212c935e RBX: ffff888109649900 RCX: 0000000000000002 [ 113.414733] RDX: ffff888044969b80 RSI: ffffffff818995b7 RDI: ffff888109649af0 [ 113.415522] RBP: ffff88806ce08df0 R08: ffff88806ce313e8 R09: ffffe8ffffc075e8 [ 113.416305] R10: 0000000000000000 R11: ffff88801e4ab898 R12: dffffc0000000000 [ 113.417090] R13: 0000000000000014 R14: ffff88806ce313e8 R15: dffffc0000000000 [ 113.417878] FS: 00007fe7e0598700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 113.418766] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 113.419415] CR2: ffffed10212c935e CR3: 000000000e2bb000 CR4: 0000000000350ef0 [ 113.420352] Call Trace: [ 113.420704] [ 113.421001] ? __pfx_perf_tp_event+0x10/0x10 [ 113.421609] ? do_raw_spin_lock+0x123/0x260 [ 113.422186] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 113.422811] ? lock_acquire+0x18c/0x2f0 [ 113.423340] ? lock_release+0x1c7/0x290 [ 113.423885] ? do_raw_spin_unlock+0x53/0x220 [ 113.424480] ? _raw_spin_unlock_irqrestore+0x22/0x50 [ 113.425168] ? try_to_wake_up+0x128/0x11d0 [ 113.425686] ? do_raw_spin_lock+0x123/0x260 [ 113.426174] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 113.426702] ? perf_trace_run_bpf_submit+0xef/0x180 [ 113.427256] perf_trace_run_bpf_submit+0xef/0x180 [ 113.427804] perf_trace_preemptirq_template+0x259/0x430 [ 113.428404] ? read_tsc+0x9/0x20 [ 113.428794] ? __pfx_perf_trace_preemptirq_template+0x10/0x10 [ 113.429455] ? clockevents_program_event+0x135/0x360 [ 113.430019] ? tick_program_event+0xac/0x140 [ 113.430513] ? handle_softirqs+0x16e/0x770 [ 113.430993] trace_irq_enable.constprop.0+0xa6/0x100 [ 113.431554] trace_hardirqs_on+0x26/0x40 [ 113.432012] handle_softirqs+0x16e/0x770 [ 113.432478] __irq_exit_rcu+0xc4/0x100 [ 113.432924] irq_exit_rcu+0x9/0x20 [ 113.433331] sysvec_apic_timer_interrupt+0x70/0x80 [ 113.433878] [ 113.434131] [ 113.434386] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 113.434961] RIP: 0010:make_task_dead+0xa2/0x3b0 [ 113.435482] Code: 38 00 85 db 0f 84 21 01 00 00 e8 d9 96 38 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 27 92 38 00 48 85 db 0f 84 17 01 00 00 b9 96 38 00 31 ff 65 8b 1d 60 df 48 06 81 e3 ff ff ff 7f 89 de [ 113.437438] RSP: 0018:ffff8880462fff28 EFLAGS: 00000246 [ 113.438023] RAX: 0000000000000001 RBX: ffff888044969b80 RCX: ffffffff817c2b86 [ 113.438803] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff813b5234 [ 113.439570] RBP: 0000000000000009 R08: 0000000000000000 R09: 0000000000000000 [ 113.440353] R10: ffffffff8643ac57 R11: 0000000000000001 R12: ffff888044969b80 [ 113.441123] R13: 0000000000000009 R14: ffff8880462ff760 R15: 0000000000000000 [ 113.441912] ? trace_irq_enable.constprop.0+0x26/0x100 [ 113.442493] ? make_task_dead+0x214/0x3b0 [ 113.442960] ? make_task_dead+0x214/0x3b0 [ 113.443419] ? do_syscall_64+0xbf/0x360 [ 113.443862] rewind_stack_and_make_dead+0x16/0x20 [ 113.444398] RIP: 0033:0x7fe7e3022b19 [ 113.444807] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 113.446771] RSP: 002b:00007fe7e0598218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 113.447590] RAX: ffffffffffffffda RBX: 00007fe7e3135f68 RCX: 00007fe7e3022b19 [ 113.448367] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe7e3135f6c [ 113.449135] RBP: 00007fe7e3135f60 R08: 000000000000000e R09: 0000000000000000 [ 113.449917] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fe7e3135f6c [ 113.450696] R13: 00007ffc11ff91bf R14: 00007fe7e0598300 R15: 0000000000022000 [ 113.451470] [ 113.451741] Modules linked in: [ 113.452098] CR2: ffffed10212c935e [ 113.452478] ---[ end trace 0000000000000000 ]--- [ 113.452993] RIP: 0010:perf_tp_event+0x175/0xe70 [ 113.453520] Code: ff df 48 89 85 a8 fd ff ff 48 c1 e8 03 4c 01 e0 48 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 44 8b ab f0 01 [ 113.455486] RSP: 0018:ffff8880462ff780 EFLAGS: 00010012 [ 113.456078] RAX: 1ffff110212c935e RBX: ffff888109649900 RCX: ffffc90001a97000 [ 113.456852] RDX: 0000000000040000 RSI: ffffffff818995b7 RDI: ffff888109649af0 [ 113.457647] RBP: ffff8880462ff9f0 R08: ffff88806ce31340 R09: ffffe8ffffc075e8 [ 113.458430] R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000 [ 113.459209] R13: 0000000000000014 R14: ffff88806ce31340 R15: dffffc0000000000 [ 113.459987] FS: 00007fe7e0598700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000 [ 113.460853] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 113.461492] CR2: ffffed10212c935e CR3: 000000000e2bb000 CR4: 0000000000350ef0 [ 113.462265] Kernel panic - not syncing: Fatal exception in interrupt [ 113.463162] Kernel Offset: disabled [ 113.463561] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- VM DIAGNOSIS: 09:34:14 Registers: info registers vcpu 0 RAX=0000000000000003 RBX=0000000000000000 RCX=ffffffff81b88f1f RDX=0000000000000000 RSI=0000000000000001 RDI=0000000000000000 RBP=ffff8880187393c0 RSP=ffff8880169bfb38 R8 =0000000000000000 R9 =ffffed10017c1bc3 R10=0000000000000000 R11=0000000000000001 R12=0000000000000001 R13=ffffffff85d236c0 R14=0000000000000001 R15=ffff8880187393c2 RIP=ffffffff8173e284 RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f30fa82a8c0 00000000 00000000 GS =0000 ffff8880e55dd000 00000000 00000000 LDT=0000 fffffe5a00000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000055555a381c58 CR3=000000000e920000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000ff0000 XMM01=6a6e695f31313230385f7a7973006273 XMM02=00000000000000000000000000000000 XMM03=00007f81a66b07c800007f81a66b07c0 XMM04=ffffffff0000ff00000000ff00000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000050 RBX=ffff888009a50000 RCX=ffffffff82549146 RDX=00000000000101f7 RSI=ffffffff82549154 RDI=0000000000000007 RBP=00000000000003e7 RSP=ffff88800a9f77a8 R8 =0000000000000001 R9 =0000000000006d2c R10=00000000000101f7 R11=0000000000000001 R12=00000000000101f7 R13=ffffed100134a001 R14=ffffffff860d0540 R15=dffffc0000000000 RIP=ffffffff82549158 RFL=00000093 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e56dd000 00000000 00000000 LDT=0000 fffffe4900000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fe9030c5108 CR3=00000000412b4000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=ff00000000ff000000000000000000ff XMM01=25252525252525252525252525252525 XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000