, 0x0) 21:43:39 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 21:43:39 executing program 6: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) r6 = memfd_create(&(0x7f0000000040)='\x00\'\'x\xe0\x1c\xaa\x00d\x88\xc4p\xb0\x89`\xe4\xc6O\xca\x1d\b6\xdd\xda\xacQB\xa7\x8d\xb7\x01Q\xc6\x0fG/\xf9\n', 0x6) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2, 0x1f012, r6, 0x0) 21:43:39 executing program 1: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) memfd_create(&(0x7f0000000040)='\x00\'\'x\xe0\x1c\xaa\x00d\x88\xc4p\xb0\x89`\xe4\xc6O\xca\x1d\b6\xdd\xda\xacQB\xa7\x8d\xb7\x01Q\xc6\x0fG/\xf9\n', 0x6) 21:43:39 executing program 4: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) 21:43:40 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) 21:43:40 executing program 2: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:43:40 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, r0, 0x0) 21:43:40 executing program 5: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x1f012, 0xffffffffffffffff, 0x0) 21:43:40 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) r4 = dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r5 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r8, 0x0, 0x0}, 0x0) r9 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r10, r11, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r12, 0x0, 0x0}, 0x0) r13 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r9, 0x0) syz_io_uring_submit(r13, r11, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r6, r11, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r5, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) r14 = openat$cgroup_devices(r4, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) sendfile(r5, r14, 0x0, 0x1) r15 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000000c0)=@IORING_OP_TIMEOUT={0xb, 0x5, 0x0, 0x0, 0x6, &(0x7f0000000080)={0x0, 0x3938700}, 0x1, 0x0, 0x1, {0x0, r15}}, 0x5) 21:43:53 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) 21:43:53 executing program 6: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 21:43:53 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) r4 = dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r5 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r8, 0x0, 0x0}, 0x0) r9 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r10, r11, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r12, 0x0, 0x0}, 0x0) r13 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r9, 0x0) syz_io_uring_submit(r13, r11, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r6, r11, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r5, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) r14 = openat$cgroup_devices(r4, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) sendfile(r5, r14, 0x0, 0x1) r15 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000000c0)=@IORING_OP_TIMEOUT={0xb, 0x5, 0x0, 0x0, 0x6, &(0x7f0000000080)={0x0, 0x3938700}, 0x1, 0x0, 0x1, {0x0, r15}}, 0x5) 21:43:53 executing program 2: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:43:53 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) r4 = dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r5 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r8, 0x0, 0x0}, 0x0) r9 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r10, r11, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r12, 0x0, 0x0}, 0x0) r13 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r9, 0x0) syz_io_uring_submit(r13, r11, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r6, r11, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r5, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) r14 = openat$cgroup_devices(r4, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) sendfile(r5, r14, 0x0, 0x1) r15 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000000c0)=@IORING_OP_TIMEOUT={0xb, 0x5, 0x0, 0x0, 0x6, &(0x7f0000000080)={0x0, 0x3938700}, 0x1, 0x0, 0x1, {0x0, r15}}, 0x5) 21:43:53 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:43:53 executing program 5: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:43:53 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, r0, 0x0) 21:43:53 executing program 6: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) r6 = memfd_create(&(0x7f0000000040)='\x00\'\'x\xe0\x1c\xaa\x00d\x88\xc4p\xb0\x89`\xe4\xc6O\xca\x1d\b6\xdd\xda\xacQB\xa7\x8d\xb7\x01Q\xc6\x0fG/\xf9\n', 0x6) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2, 0x1f012, r6, 0x0) 21:43:53 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, r0, 0x0) 21:43:53 executing program 2: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:43:53 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) r4 = dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r5 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r8, 0x0, 0x0}, 0x0) r9 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r10, r11, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r12, 0x0, 0x0}, 0x0) r13 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r9, 0x0) syz_io_uring_submit(r13, r11, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r6, r11, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r5, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) r14 = openat$cgroup_devices(r4, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) sendfile(r5, r14, 0x0, 0x1) r15 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000000c0)=@IORING_OP_TIMEOUT={0xb, 0x5, 0x0, 0x0, 0x6, &(0x7f0000000080)={0x0, 0x3938700}, 0x1, 0x0, 0x1, {0x0, r15}}, 0x5) 21:43:53 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 21:43:53 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) r4 = dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r5 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r8, 0x0, 0x0}, 0x0) r9 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r10, r11, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r12, 0x0, 0x0}, 0x0) r13 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r9, 0x0) syz_io_uring_submit(r13, r11, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r6, r11, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r5, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) r14 = openat$cgroup_devices(r4, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) sendfile(r5, r14, 0x0, 0x1) r15 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000000c0)=@IORING_OP_TIMEOUT={0xb, 0x5, 0x0, 0x0, 0x6, &(0x7f0000000080)={0x0, 0x3938700}, 0x1, 0x0, 0x1, {0x0, r15}}, 0x5) 21:43:53 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) r6 = memfd_create(&(0x7f0000000040)='\x00\'\'x\xe0\x1c\xaa\x00d\x88\xc4p\xb0\x89`\xe4\xc6O\xca\x1d\b6\xdd\xda\xacQB\xa7\x8d\xb7\x01Q\xc6\x0fG/\xf9\n', 0x6) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2, 0x1f012, r6, 0x0) 21:43:53 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:43:53 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x10, r0, 0x0) 21:43:53 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r2 = dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r3 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r6, 0x0, 0x0}, 0x0) r7 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r8, r9, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r10, 0x0, 0x0}, 0x0) r11 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r7, 0x0) syz_io_uring_submit(r11, r9, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r4, r9, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r3, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) r12 = openat$cgroup_devices(r2, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) sendfile(r3, r12, 0x0, 0x1) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) 21:44:06 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf250600000008000300020000000800"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:44:06 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) r4 = dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r5 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r8, 0x0, 0x0}, 0x0) r9 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r10, r11, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r12, 0x0, 0x0}, 0x0) r13 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r9, 0x0) syz_io_uring_submit(r13, r11, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r6, r11, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r5, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) r14 = openat$cgroup_devices(r4, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) sendfile(r5, r14, 0x0, 0x1) r15 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r3, &(0x7f00000000c0)=@IORING_OP_TIMEOUT={0xb, 0x5, 0x0, 0x0, 0x6, &(0x7f0000000080)={0x0, 0x3938700}, 0x1, 0x0, 0x1, {0x0, r15}}, 0x5) 21:44:06 executing program 6: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2, 0x1f012, 0xffffffffffffffff, 0x0) 21:44:06 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r2 = dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r3 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r6, 0x0, 0x0}, 0x0) r7 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r8, r9, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r10, 0x0, 0x0}, 0x0) r11 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r7, 0x0) syz_io_uring_submit(r11, r9, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r4, r9, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r3, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) r12 = openat$cgroup_devices(r2, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) sendfile(r3, r12, 0x0, 0x1) 21:44:06 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 21:44:06 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 21:44:06 executing program 2: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = memfd_create(&(0x7f0000000040)='\x00\'\'x\xe0\x1c\xaa\x00d\x88\xc4p\xb0\x89`\xe4\xc6O\xca\x1d\b6\xdd\xda\xacQB\xa7\x8d\xb7\x01Q\xc6\x0fG/\xf9\n', 0x6) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2, 0x1f012, r6, 0x0) 21:44:06 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x10, r0, 0x0) 21:44:06 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x10, r0, 0x0) 21:44:06 executing program 7: r0 = perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4307, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000180)={0x0, 0x0}) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x6, 0x1, 0x20, 0x3, 0x0, 0xfffffffffffffff7, 0x10, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x39, 0x4, @perf_bp={&(0x7f00000000c0), 0xa}, 0x0, 0x895, 0x1, 0x2, 0x5, 0x7fff, 0x6, 0x0, 0x0, 0x0, 0x5ba}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x10) r2 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x2, 0x92}, 0x0, 0x0, 0x9b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, r1, 0x0, 0xffffffffffffffff, 0xa) r3 = dup2(0xffffffffffffffff, r2) perf_event_open(&(0x7f0000000000)={0x5, 0x80, 0x40, 0x40, 0x2, 0x80, 0x0, 0x81, 0x40000, 0x2, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x6, 0x1, @perf_config_ext={0x10001, 0x5}, 0x43821, 0xffff, 0x94f, 0x9, 0x20, 0xfffff74b, 0x263e, 0x0, 0x4, 0x0, 0x7}, 0x0, 0x3, 0xffffffffffffffff, 0x8) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r3, 0xc0189379, &(0x7f00000001c0)=ANY=[@ANYBLOB='\x00'/12, @ANYRES32=0xffffffffffffffff, @ANYBLOB="0000000f0a000000000000653000"]) perf_event_open(&(0x7f00000000c0)={0x3, 0x80, 0xa, 0xff, 0x1, 0x1, 0x0, 0x80000000, 0x20420, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000080), 0xb}, 0x580, 0x8dcc, 0xa6ca, 0x4, 0x100, 0x0, 0x6, 0x0, 0xfffffff8, 0x0, 0x54f5}, 0x0, 0xe, r4, 0x13) 21:44:18 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf250600000008000300020000000800"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:44:18 executing program 2: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r6 = memfd_create(&(0x7f0000000040)='\x00\'\'x\xe0\x1c\xaa\x00d\x88\xc4p\xb0\x89`\xe4\xc6O\xca\x1d\b6\xdd\xda\xacQB\xa7\x8d\xb7\x01Q\xc6\x0fG/\xf9\n', 0x6) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2, 0x1f012, r6, 0x0) 21:44:18 executing program 6: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r6 = memfd_create(&(0x7f0000000040)='\x00\'\'x\xe0\x1c\xaa\x00d\x88\xc4p\xb0\x89`\xe4\xc6O\xca\x1d\b6\xdd\xda\xacQB\xa7\x8d\xb7\x01Q\xc6\x0fG/\xf9\n', 0x6) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2, 0x1f012, r6, 0x0) 21:44:18 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r2 = dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r3 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r6, 0x0, 0x0}, 0x0) r7 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r8, r9, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r10, 0x0, 0x0}, 0x0) r11 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r7, 0x0) syz_io_uring_submit(r11, r9, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r4, r9, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r3, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) openat$cgroup_devices(r2, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) 21:44:18 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2, 0x1f012, 0xffffffffffffffff, 0x0) 21:44:18 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r2 = dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r3 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r6, 0x0, 0x0}, 0x0) r7 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r8, r9, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r10, 0x0, 0x0}, 0x0) r11 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r7, 0x0) syz_io_uring_submit(r11, r9, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r4, r9, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r3, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) r12 = openat$cgroup_devices(r2, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) sendfile(r3, r12, 0x0, 0x1) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) 21:44:18 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, 0xffffffffffffffff, 0x0) 21:44:18 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) r6 = memfd_create(&(0x7f0000000040)='\x00\'\'x\xe0\x1c\xaa\x00d\x88\xc4p\xb0\x89`\xe4\xc6O\xca\x1d\b6\xdd\xda\xacQB\xa7\x8d\xb7\x01Q\xc6\x0fG/\xf9\n', 0x6) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2, 0x1f012, r6, 0x0) 21:44:18 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, 0xffffffffffffffff, 0x0) 21:44:18 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r2 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r5, 0x0, 0x0}, 0x0) r6 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r7, r8, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r9, 0x0, 0x0}, 0x0) r10 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r6, 0x0) syz_io_uring_submit(r10, r8, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r3, r8, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r2, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) 21:44:18 executing program 6: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f0000000240)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "c9f8e650da8d1f569053e8984b83777318760a5238f6af85581608069a64b06b92de9de827a06da13dfd0a7244f9276114abb0c4ea0c40656d1732e262fd02"}}, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x3, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_QGROUP_LIMIT(r5, 0x8030942b, &(0x7f00000000c0)={0x0, {0x0, 0x7, 0x68d09cd1, 0x9, 0x40}}) semget(0x2, 0x4, 0x0) semctl$SEM_STAT_ANY(0x0, 0x1, 0x14, &(0x7f0000000340)=""/194) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r6 = memfd_create(&(0x7f0000000040)='\x00\'\'x\xe0\x1c\xaa\x00d\x88\xc4p\xb0\x89`\xe4\xc6O\xca\x1d\b6\xdd\xda\xacQB\xa7\x8d\xb7\x01Q\xc6\x0fG/\xf9\n', 0x6) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2, 0x1f012, r6, 0x0) 21:44:18 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 1) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:44:18 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r2 = dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r3 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r6, 0x0, 0x0}, 0x0) r7 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r8, r9, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r10, 0x0, 0x0}, 0x0) r11 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r7, 0x0) syz_io_uring_submit(r11, r9, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r4, r9, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r3, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) r12 = openat$cgroup_devices(r2, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) sendfile(r3, r12, 0x0, 0x1) 21:44:18 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) (fail_nth: 1) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:44:18 executing program 7: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4000, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r2 = dup2(r1, r0) sendmsg$nl_generic(r2, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x24044700}, 0xc, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="e00000002900000125bd7000fbdbdf2514000000cb00160046fe5ffcfecc929af5d6796d5fd15c8da125ffbca02f481a3058d8bb0b9425befd91a88030be8fd1c44dd2f8607ffe0b88b49dfd75f0436bbeeca5e2ac7df85582b0671f350ea016b1beb61ad3f4b5ad1cbd195478eb1eafc42eff28fc4df736d251aaada0fcc8d52f84e17921681b94882f4e5c1e65eadb8cab24e9053d54d6f310af5dc42c0fc0937db2d69e14f4fd92002e8be8e4f7d1b7820678509fad45349ccd76712e1c2e7ee3ae5a91d5c6a2e8640bafb705a35178f828088d9046faba5f80a236f0ae00"], 0xe0}}, 0xc0014) r3 = perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4307, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getownex(r3, 0x10, &(0x7f0000000180)={0x0, 0x0}) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x6, 0x1, 0x20, 0x3, 0x0, 0xfffffffffffffff7, 0x10, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x39, 0x4, @perf_bp={&(0x7f00000000c0), 0xa}, 0x0, 0x895, 0x1, 0x2, 0x5, 0x7fff, 0x6, 0x0, 0x0, 0x0, 0x5ba}, r4, 0xffffffffffffffff, 0xffffffffffffffff, 0x10) r5 = perf_event_open(&(0x7f0000000380)={0x1, 0x80, 0x8, 0x9, 0x5, 0x5, 0x0, 0x404b, 0x800, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, @perf_config_ext={0x4, 0x3}, 0x2, 0xd6ac, 0xfffff810, 0x9, 0x100000001, 0xffffffff, 0x9, 0x0, 0xf31d1a41, 0x0, 0x1}, 0xffffffffffffffff, 0x9, r2, 0x1) r6 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) signalfd(r6, &(0x7f0000000400)={[0x7fff]}, 0x8) mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1) perf_event_open(&(0x7f0000000300)={0x2, 0x80, 0x1, 0x80, 0xad, 0x80, 0x0, 0xfffffffffffffff7, 0x809, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x2, @perf_bp={&(0x7f00000002c0), 0x4}, 0x8a0, 0x3f, 0x74, 0x7, 0x9, 0x4, 0x20, 0x0, 0xffffffff, 0x0, 0x1}, r4, 0x4, r5, 0x8) [ 1181.830697] FAULT_INJECTION: forcing a failure. [ 1181.830697] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1181.834201] CPU: 0 PID: 8661 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1181.835950] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1181.838093] Call Trace: [ 1181.838772] dump_stack+0x107/0x167 [ 1181.839710] should_fail.cold+0x5/0xa [ 1181.840686] _copy_from_user+0x2e/0x1b0 [ 1181.841701] io_uring_setup+0x9b/0x2980 [ 1181.842731] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1181.843974] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1181.845258] ? wait_for_completion_io+0x270/0x270 [ 1181.846492] ? rcu_read_lock_any_held+0x75/0xa0 [ 1181.847677] ? vfs_write+0x354/0xb10 [ 1181.848657] ? fput_many+0x2f/0x1a0 [ 1181.849585] ? ksys_write+0x1a9/0x260 [ 1181.850552] ? __ia32_sys_read+0xb0/0xb0 [ 1181.851438] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1181.852764] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1181.854096] do_syscall_64+0x33/0x40 [ 1181.855056] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1181.856364] RIP: 0033:0x7f741addcb19 [ 1181.857295] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1181.862019] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1181.863977] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1181.865809] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1181.867646] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1181.869463] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1181.871286] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:44:18 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x0, 0x0}, 0x0) r5 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r8, 0x0, 0x0}, 0x0) r9 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r5, 0x0) syz_io_uring_submit(r9, r7, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) 21:44:18 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf250600000008000300020000000800"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:44:18 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r2 = dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r3 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r6, 0x0, 0x0}, 0x0) r7 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r8, r9, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r10, 0x0, 0x0}, 0x0) r11 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r7, 0x0) syz_io_uring_submit(r11, r9, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r4, r9, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r3, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) openat$cgroup_devices(r2, &(0x7f0000000040)='devices.deny\x00', 0x2, 0x0) [ 1181.909593] FAULT_INJECTION: forcing a failure. [ 1181.909593] name failslab, interval 1, probability 0, space 0, times 1 [ 1181.912961] CPU: 0 PID: 8663 Comm: syz-executor.2 Not tainted 5.10.262 #1 [ 1181.914733] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1181.916891] Call Trace: [ 1181.917587] dump_stack+0x107/0x167 [ 1181.918507] should_fail.cold+0x5/0xa [ 1181.919515] ? vm_area_dup+0x78/0x290 [ 1181.920492] should_failslab+0x5/0x20 [ 1181.921476] kmem_cache_alloc+0x5b/0x310 [ 1181.922533] vm_area_dup+0x78/0x290 [ 1181.923488] ? perf_event_update_userpage+0x4d3/0x7f0 [ 1181.924824] ? mark_lock+0xf5/0x2df0 [ 1181.925776] ? lock_acquire+0x197/0x470 [ 1181.926784] ? lock_chain_count+0x20/0x20 [ 1181.927734] ? avc_has_perm_noaudit+0x1c9/0x3e0 [ 1181.928918] ? lock_downgrade+0x6d0/0x6d0 [ 1181.930000] ? lock_chain_count+0x20/0x20 [ 1181.930898] ? vm_area_alloc+0x110/0x110 [ 1181.931940] ? __lock_acquire+0x1657/0x5b00 [ 1181.933070] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1181.934413] ? vmacache_find+0x55/0x2a0 [ 1181.935356] __split_vma+0xa8/0x4e0 [ 1181.936269] __do_munmap+0xfae/0x1260 [ 1181.937069] ? arch_get_unmapped_area+0x450/0x450 [ 1181.938295] ? lock_release+0x680/0x680 [ 1181.939337] mmap_region+0x7cc/0x1500 [ 1181.940334] do_mmap+0x868/0x1370 [ 1181.941232] vm_mmap_pgoff+0x198/0x1f0 [ 1181.942251] ? randomize_page+0xb0/0xb0 [ 1181.943290] ksys_mmap_pgoff+0x41c/0x560 [ 1181.944327] ? find_mergeable_anon_vma+0x250/0x250 [ 1181.945591] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1181.946782] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1181.948111] do_syscall_64+0x33/0x40 [ 1181.949063] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1181.950385] RIP: 0033:0x7fc4d0876b19 [ 1181.951343] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1181.956093] RSP: 002b:00007fc4cddec188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1181.958043] RAX: ffffffffffffffda RBX: 00007fc4d0989f60 RCX: 00007fc4d0876b19 [ 1181.959880] RDX: 000000000100000e RSI: 0000000000004000 RDI: 0000000020ffc000 [ 1181.961707] RBP: 00007fc4cddec1d0 R08: 0000000000000004 R09: 0000000000000000 [ 1181.963632] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1181.965392] R13: 00007ffc3105cbff R14: 00007fc4cddec300 R15: 0000000000022000 21:44:19 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) (fail_nth: 1) 21:44:19 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, 0xffffffffffffffff, 0x0) [ 1182.011728] FAULT_INJECTION: forcing a failure. [ 1182.011728] name failslab, interval 1, probability 0, space 0, times 0 [ 1182.014175] CPU: 1 PID: 8673 Comm: syz-executor.6 Not tainted 5.10.262 #1 [ 1182.015635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1182.017398] Call Trace: [ 1182.017977] dump_stack+0x107/0x167 [ 1182.018756] should_fail.cold+0x5/0xa [ 1182.019581] ? vm_area_dup+0x78/0x290 [ 1182.020392] should_failslab+0x5/0x20 [ 1182.021205] kmem_cache_alloc+0x5b/0x310 [ 1182.022072] vm_area_dup+0x78/0x290 [ 1182.022848] ? mark_lock+0xf5/0x2df0 [ 1182.023648] ? mark_lock+0xf5/0x2df0 [ 1182.024448] ? lock_acquire+0x197/0x470 [ 1182.025301] ? lock_chain_count+0x20/0x20 [ 1182.026190] ? avc_has_perm_noaudit+0x1c9/0x3e0 [ 1182.027197] ? lock_downgrade+0x6d0/0x6d0 [ 1182.028092] ? lock_chain_count+0x20/0x20 [ 1182.028980] ? vm_area_alloc+0x110/0x110 [ 1182.029850] ? __lock_acquire+0x1657/0x5b00 [ 1182.030788] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1182.031911] ? vmacache_find+0x55/0x2a0 [ 1182.032757] __split_vma+0xa8/0x4e0 [ 1182.033535] __do_munmap+0xfae/0x1260 [ 1182.034349] ? arch_get_unmapped_area+0x450/0x450 [ 1182.035384] ? lock_release+0x680/0x680 [ 1182.036230] mmap_region+0x7cc/0x1500 [ 1182.037055] do_mmap+0x868/0x1370 [ 1182.037803] vm_mmap_pgoff+0x198/0x1f0 [ 1182.038638] ? randomize_page+0xb0/0xb0 [ 1182.039504] ksys_mmap_pgoff+0x41c/0x560 [ 1182.040373] ? find_mergeable_anon_vma+0x250/0x250 [ 1182.041416] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1182.042536] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1182.043642] do_syscall_64+0x33/0x40 [ 1182.044437] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1182.045527] RIP: 0033:0x7fdf8b8bfb19 [ 1182.046320] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1182.050261] RSP: 002b:00007fdf88e35188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1182.051888] RAX: ffffffffffffffda RBX: 00007fdf8b9d2f60 RCX: 00007fdf8b8bfb19 [ 1182.053403] RDX: 000000000100000e RSI: 0000000000004000 RDI: 0000000020ffc000 [ 1182.054928] RBP: 00007fdf88e351d0 R08: 0000000000000004 R09: 0000000000000000 [ 1182.056447] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1182.057973] R13: 00007fff859166bf R14: 00007fdf88e35300 R15: 0000000000022000 21:44:34 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 1) 21:44:34 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) (fail_nth: 2) 21:44:34 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) (fail_nth: 2) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:44:34 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:44:34 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x0, 0x0}, 0x0) r5 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r8, 0x0, 0x0}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r5, 0x0) 21:44:34 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r2 = socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r5, 0x0, 0x0}, 0x0) r6 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r7, r8, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r9, 0x0, 0x0}, 0x0) r10 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r6, 0x0) syz_io_uring_submit(r10, r8, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r3, r8, &(0x7f0000000240)=@IORING_OP_SEND={0x1a, 0x2, 0x0, r2, 0x0, &(0x7f0000000100)="8054831b16f1dcc90b914d416642bfa24fd99908c07a00cfdc29c024e50d8a6874cc6babbedfc4ae39", 0x29, 0x281c1, 0x1}, 0x0) 21:44:34 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 2) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:44:34 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) (fail_nth: 1) [ 1197.486721] FAULT_INJECTION: forcing a failure. [ 1197.486721] name failslab, interval 1, probability 0, space 0, times 0 [ 1197.488483] CPU: 1 PID: 8694 Comm: syz-executor.6 Not tainted 5.10.262 #1 [ 1197.489459] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1197.490675] Call Trace: [ 1197.491083] dump_stack+0x107/0x167 [ 1197.491617] should_fail.cold+0x5/0xa [ 1197.492171] ? create_object.isra.0+0x3a/0xa30 [ 1197.492850] should_failslab+0x5/0x20 [ 1197.493426] kmem_cache_alloc+0x5b/0x310 [ 1197.494026] create_object.isra.0+0x3a/0xa30 [ 1197.494681] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1197.495436] kmem_cache_alloc+0x159/0x310 [ 1197.496047] vm_area_dup+0x78/0x290 [ 1197.496571] ? mark_lock+0xf5/0x2df0 [ 1197.497108] ? mark_lock+0xf5/0x2df0 [ 1197.497643] ? lock_acquire+0x197/0x470 [ 1197.498218] ? lock_chain_count+0x20/0x20 [ 1197.498817] ? avc_has_perm_noaudit+0x1c9/0x3e0 [ 1197.499502] ? lock_downgrade+0x6d0/0x6d0 [ 1197.500098] ? lock_chain_count+0x20/0x20 [ 1197.500725] ? vm_area_alloc+0x110/0x110 [ 1197.501328] ? __lock_acquire+0x1657/0x5b00 [ 1197.501958] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1197.502716] ? vmacache_find+0x55/0x2a0 [ 1197.503328] __split_vma+0xa8/0x4e0 [ 1197.503859] __do_munmap+0xfae/0x1260 [ 1197.504410] ? arch_get_unmapped_area+0x450/0x450 [ 1197.505108] ? lock_release+0x680/0x680 [ 1197.505681] mmap_region+0x7cc/0x1500 [ 1197.505776] FAULT_INJECTION: forcing a failure. [ 1197.505776] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1197.506236] do_mmap+0x868/0x1370 [ 1197.506346] vm_mmap_pgoff+0x198/0x1f0 [ 1197.510020] ? randomize_page+0xb0/0xb0 [ 1197.510615] ksys_mmap_pgoff+0x41c/0x560 [ 1197.511226] ? find_mergeable_anon_vma+0x250/0x250 [ 1197.511937] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1197.512691] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1197.513462] do_syscall_64+0x33/0x40 [ 1197.514008] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1197.514755] RIP: 0033:0x7fdf8b8bfb19 [ 1197.515309] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1197.517949] RSP: 002b:00007fdf88e35188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1197.519062] RAX: ffffffffffffffda RBX: 00007fdf8b9d2f60 RCX: 00007fdf8b8bfb19 [ 1197.520111] RDX: 000000000100000e RSI: 0000000000004000 RDI: 0000000020ffc000 [ 1197.521135] RBP: 00007fdf88e351d0 R08: 0000000000000004 R09: 0000000000000000 [ 1197.522154] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1197.523199] R13: 00007fff859166bf R14: 00007fdf88e35300 R15: 0000000000022000 [ 1197.524245] CPU: 0 PID: 8696 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1197.524903] FAULT_INJECTION: forcing a failure. [ 1197.524903] name failslab, interval 1, probability 0, space 0, times 0 [ 1197.525790] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1197.525797] Call Trace: [ 1197.525827] dump_stack+0x107/0x167 [ 1197.525849] should_fail.cold+0x5/0xa [ 1197.525876] _copy_from_user+0x2e/0x1b0 [ 1197.525909] io_uring_setup+0x9b/0x2980 [ 1197.533343] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1197.534423] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1197.535568] ? wait_for_completion_io+0x270/0x270 [ 1197.536649] ? rcu_read_lock_any_held+0x75/0xa0 [ 1197.537684] ? vfs_write+0x354/0xb10 [ 1197.538508] ? fput_many+0x2f/0x1a0 [ 1197.539331] ? ksys_write+0x1a9/0x260 [ 1197.540178] ? __ia32_sys_read+0xb0/0xb0 [ 1197.541093] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1197.542267] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1197.543433] do_syscall_64+0x33/0x40 [ 1197.544267] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1197.545411] RIP: 0033:0x7f43c90c3b19 [ 1197.546249] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1197.550368] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1197.552078] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1197.553675] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1197.555281] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1197.556870] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1197.558463] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1197.560107] CPU: 1 PID: 8688 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1197.561079] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1197.562245] Call Trace: [ 1197.562618] dump_stack+0x107/0x167 [ 1197.563168] should_fail.cold+0x5/0xa [ 1197.563704] ? io_uring_setup+0x258/0x2980 [ 1197.564298] should_failslab+0x5/0x20 [ 1197.564829] kmem_cache_alloc_trace+0x55/0x320 [ 1197.565481] io_uring_setup+0x258/0x2980 [ 1197.566051] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1197.566735] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1197.567466] ? wait_for_completion_io+0x270/0x270 [ 1197.568169] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1197.568901] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1197.569622] do_syscall_64+0x33/0x40 [ 1197.570144] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1197.570867] RIP: 0033:0x7f741addcb19 [ 1197.571422] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1197.573978] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1197.575045] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1197.576057] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1197.577052] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1197.578044] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1197.579052] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1197.579365] FAULT_INJECTION: forcing a failure. [ 1197.579365] name failslab, interval 1, probability 0, space 0, times 0 [ 1197.582821] CPU: 0 PID: 8697 Comm: syz-executor.0 Not tainted 5.10.262 #1 [ 1197.583106] FAULT_INJECTION: forcing a failure. [ 1197.583106] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1197.584373] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1197.584381] Call Trace: [ 1197.584408] dump_stack+0x107/0x167 [ 1197.584432] should_fail.cold+0x5/0xa [ 1197.584456] ? vm_area_dup+0x78/0x290 [ 1197.591070] should_failslab+0x5/0x20 [ 1197.591920] kmem_cache_alloc+0x5b/0x310 [ 1197.592833] vm_area_dup+0x78/0x290 [ 1197.593648] ? mark_lock+0xf5/0x2df0 [ 1197.594484] ? mark_lock+0xf5/0x2df0 [ 1197.595338] ? lock_acquire+0x197/0x470 [ 1197.596228] ? lock_chain_count+0x20/0x20 [ 1197.597157] ? avc_has_perm_noaudit+0x1c9/0x3e0 [ 1197.598198] ? lock_downgrade+0x6d0/0x6d0 [ 1197.599133] ? lock_chain_count+0x20/0x20 [ 1197.600052] ? vm_area_alloc+0x110/0x110 [ 1197.600966] ? __lock_acquire+0x1657/0x5b00 [ 1197.601941] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1197.603114] ? vmacache_find+0x55/0x2a0 [ 1197.603999] __split_vma+0xa8/0x4e0 [ 1197.604805] __do_munmap+0xfae/0x1260 [ 1197.605653] ? arch_get_unmapped_area+0x450/0x450 [ 1197.606732] ? lock_release+0x680/0x680 [ 1197.607620] mmap_region+0x7cc/0x1500 [ 1197.608480] do_mmap+0x868/0x1370 [ 1197.609259] vm_mmap_pgoff+0x198/0x1f0 [ 1197.610135] ? randomize_page+0xb0/0xb0 [ 1197.611039] ksys_mmap_pgoff+0x41c/0x560 [ 1197.611949] ? find_mergeable_anon_vma+0x250/0x250 [ 1197.613046] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1197.614236] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1197.615396] do_syscall_64+0x33/0x40 [ 1197.616220] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1197.617354] RIP: 0033:0x7f1db4ecab19 [ 1197.618173] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1197.622294] RSP: 002b:00007f1db2440188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1197.623978] RAX: ffffffffffffffda RBX: 00007f1db4fddf60 RCX: 00007f1db4ecab19 [ 1197.625582] RDX: 000000000100000e RSI: 0000000000004000 RDI: 0000000020ffc000 [ 1197.627174] RBP: 00007f1db24401d0 R08: 0000000000000004 R09: 0000000000000000 [ 1197.628753] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1197.630348] R13: 00007fff6e28900f R14: 00007f1db2440300 R15: 0000000000022000 [ 1197.631976] CPU: 1 PID: 8701 Comm: syz-executor.2 Not tainted 5.10.262 #1 [ 1197.632925] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1197.634062] Call Trace: [ 1197.634421] dump_stack+0x107/0x167 [ 1197.634932] should_fail.cold+0x5/0xa [ 1197.635475] _copy_from_user+0x2e/0x1b0 [ 1197.636025] kstrtouint_from_user+0xbd/0x220 [ 1197.636624] ? kstrtou8_from_user+0x210/0x210 [ 1197.637240] ? lock_acquire+0x197/0x470 [ 1197.637782] ? ksys_write+0x12d/0x260 [ 1197.638308] proc_fail_nth_write+0x78/0x220 [ 1197.638892] ? proc_task_getattr+0x1f0/0x1f0 [ 1197.639511] ? proc_task_getattr+0x1f0/0x1f0 [ 1197.640107] vfs_write+0x29a/0xb10 [ 1197.640591] ksys_write+0x12d/0x260 [ 1197.641085] ? __ia32_sys_read+0xb0/0xb0 [ 1197.641640] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1197.642356] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1197.643077] do_syscall_64+0x33/0x40 [ 1197.643602] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1197.644300] RIP: 0033:0x7fc4d08295ff [ 1197.644799] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48 [ 1197.647287] RSP: 002b:00007fc4cddcb170 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1197.648309] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc4d08295ff [ 1197.649269] RDX: 0000000000000001 RSI: 00007fc4cddcb1e0 RDI: 0000000000000005 [ 1197.650225] RBP: 00007fc4cddcb1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1197.651200] R10: 0000000000000013 R11: 0000000000000293 R12: 0000000000000001 [ 1197.652159] R13: 00007ffc3105cbff R14: 00007fc4cddcb300 R15: 0000000000022000 21:44:34 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x0, 0x0}, 0x0) r5 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r8, 0x0, 0x0}, 0x0) r9 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r5, 0x0) syz_io_uring_submit(r9, r7, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) 21:44:34 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 2) 21:44:34 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) (fail_nth: 3) 21:44:34 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 3) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) [ 1197.712881] FAULT_INJECTION: forcing a failure. [ 1197.712881] name failslab, interval 1, probability 0, space 0, times 0 [ 1197.714457] CPU: 1 PID: 8706 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1197.715378] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1197.716467] Call Trace: [ 1197.716817] dump_stack+0x107/0x167 [ 1197.717303] should_fail.cold+0x5/0xa [ 1197.717808] ? io_uring_setup+0x258/0x2980 [ 1197.718361] should_failslab+0x5/0x20 [ 1197.718874] kmem_cache_alloc_trace+0x55/0x320 [ 1197.719509] io_uring_setup+0x258/0x2980 [ 1197.720045] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1197.720680] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1197.721343] ? wait_for_completion_io+0x270/0x270 [ 1197.721989] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1197.722681] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1197.723380] do_syscall_64+0x33/0x40 [ 1197.723864] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1197.724534] RIP: 0033:0x7f43c90c3b19 [ 1197.725022] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1197.727429] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1197.728424] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1197.729360] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1197.730290] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1197.731248] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1197.732182] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:44:34 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x0, 0x0}, 0x0) r5 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r5, 0x0) 21:44:34 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) (fail_nth: 2) [ 1197.768388] FAULT_INJECTION: forcing a failure. [ 1197.768388] name failslab, interval 1, probability 0, space 0, times 0 [ 1197.769872] CPU: 1 PID: 8712 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1197.770740] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1197.771811] Call Trace: [ 1197.772154] dump_stack+0x107/0x167 [ 1197.772620] should_fail.cold+0x5/0xa [ 1197.773107] ? create_object.isra.0+0x3a/0xa30 [ 1197.773688] should_failslab+0x5/0x20 [ 1197.774177] kmem_cache_alloc+0x5b/0x310 [ 1197.774697] create_object.isra.0+0x3a/0xa30 [ 1197.775275] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1197.775925] kmem_cache_alloc_trace+0x151/0x320 [ 1197.776526] io_uring_setup+0x258/0x2980 [ 1197.776938] FAULT_INJECTION: forcing a failure. [ 1197.776938] name failslab, interval 1, probability 0, space 0, times 0 [ 1197.777047] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1197.777061] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1197.777071] ? wait_for_completion_io+0x270/0x270 [ 1197.777098] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1197.782092] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1197.782747] do_syscall_64+0x33/0x40 [ 1197.783251] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1197.783900] RIP: 0033:0x7f741addcb19 [ 1197.784375] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1197.786698] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1197.787679] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1197.788578] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1197.789477] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1197.790377] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1197.791296] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1197.792220] CPU: 0 PID: 8711 Comm: syz-executor.6 Not tainted 5.10.262 #1 [ 1197.793762] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1197.795630] Call Trace: [ 1197.796224] dump_stack+0x107/0x167 [ 1197.797037] should_fail.cold+0x5/0xa [ 1197.797888] ? vm_area_alloc+0x1c/0x110 [ 1197.798768] should_failslab+0x5/0x20 [ 1197.799631] kmem_cache_alloc+0x5b/0x310 [ 1197.800535] vm_area_alloc+0x1c/0x110 [ 1197.801388] mmap_region+0x982/0x1500 [ 1197.802254] do_mmap+0x868/0x1370 [ 1197.803048] vm_mmap_pgoff+0x198/0x1f0 [ 1197.803874] FAULT_INJECTION: forcing a failure. [ 1197.803874] name failslab, interval 1, probability 0, space 0, times 0 [ 1197.803909] ? randomize_page+0xb0/0xb0 [ 1197.806186] ksys_mmap_pgoff+0x41c/0x560 [ 1197.807112] ? find_mergeable_anon_vma+0x250/0x250 [ 1197.808215] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1197.809387] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1197.810543] do_syscall_64+0x33/0x40 [ 1197.811385] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1197.812531] RIP: 0033:0x7fdf8b8bfb19 [ 1197.813359] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1197.817493] RSP: 002b:00007fdf88e35188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1197.819193] RAX: ffffffffffffffda RBX: 00007fdf8b9d2f60 RCX: 00007fdf8b8bfb19 [ 1197.820799] RDX: 000000000100000e RSI: 0000000000004000 RDI: 0000000020ffc000 [ 1197.822389] RBP: 00007fdf88e351d0 R08: 0000000000000004 R09: 0000000000000000 [ 1197.823989] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1197.825578] R13: 00007fff859166bf R14: 00007fdf88e35300 R15: 0000000000022000 [ 1197.827202] CPU: 1 PID: 8715 Comm: syz-executor.0 Not tainted 5.10.262 #1 [ 1197.828054] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1197.829080] Call Trace: [ 1197.829408] dump_stack+0x107/0x167 [ 1197.829866] should_fail.cold+0x5/0xa [ 1197.830340] ? create_object.isra.0+0x3a/0xa30 [ 1197.830901] should_failslab+0x5/0x20 [ 1197.831389] kmem_cache_alloc+0x5b/0x310 [ 1197.831891] create_object.isra.0+0x3a/0xa30 [ 1197.832431] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1197.833057] kmem_cache_alloc+0x159/0x310 [ 1197.833571] vm_area_dup+0x78/0x290 [ 1197.834026] ? mark_lock+0xf5/0x2df0 [ 1197.834487] ? mark_lock+0xf5/0x2df0 [ 1197.834946] ? lock_acquire+0x197/0x470 [ 1197.835450] ? lock_chain_count+0x20/0x20 [ 1197.835964] ? avc_has_perm_noaudit+0x1c9/0x3e0 [ 1197.836536] ? lock_downgrade+0x6d0/0x6d0 [ 1197.837047] ? lock_chain_count+0x20/0x20 [ 1197.837561] ? vm_area_alloc+0x110/0x110 [ 1197.838068] ? __lock_acquire+0x1657/0x5b00 [ 1197.838620] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1197.839302] ? vmacache_find+0x55/0x2a0 [ 1197.839795] __split_vma+0xa8/0x4e0 [ 1197.840240] __do_munmap+0xfae/0x1260 [ 1197.840709] ? arch_get_unmapped_area+0x450/0x450 [ 1197.841297] ? lock_release+0x680/0x680 [ 1197.841785] mmap_region+0x7cc/0x1500 [ 1197.842257] do_mmap+0x868/0x1370 [ 1197.842694] vm_mmap_pgoff+0x198/0x1f0 [ 1197.843192] ? randomize_page+0xb0/0xb0 [ 1197.843685] ksys_mmap_pgoff+0x41c/0x560 [ 1197.844183] ? find_mergeable_anon_vma+0x250/0x250 [ 1197.844785] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1197.845428] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1197.846064] do_syscall_64+0x33/0x40 [ 1197.846523] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1197.847170] RIP: 0033:0x7f1db4ecab19 [ 1197.847626] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1197.849885] RSP: 002b:00007f1db2440188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1197.850813] RAX: ffffffffffffffda RBX: 00007f1db4fddf60 RCX: 00007f1db4ecab19 [ 1197.851717] RDX: 000000000100000e RSI: 0000000000004000 RDI: 0000000020ffc000 [ 1197.852589] RBP: 00007f1db24401d0 R08: 0000000000000004 R09: 0000000000000000 [ 1197.853459] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1197.854329] R13: 00007fff6e28900f R14: 00007f1db2440300 R15: 0000000000022000 21:44:34 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 3) [ 1197.900312] FAULT_INJECTION: forcing a failure. [ 1197.900312] name failslab, interval 1, probability 0, space 0, times 0 [ 1197.901725] CPU: 1 PID: 8719 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1197.902534] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1197.903550] Call Trace: [ 1197.903878] dump_stack+0x107/0x167 [ 1197.904318] should_fail.cold+0x5/0xa [ 1197.904776] ? create_object.isra.0+0x3a/0xa30 [ 1197.905321] should_failslab+0x5/0x20 [ 1197.905777] kmem_cache_alloc+0x5b/0x310 [ 1197.906264] create_object.isra.0+0x3a/0xa30 [ 1197.906784] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1197.907408] kmem_cache_alloc_trace+0x151/0x320 [ 1197.907967] io_uring_setup+0x258/0x2980 [ 1197.908451] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1197.909026] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1197.909626] ? wait_for_completion_io+0x270/0x270 [ 1197.910211] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1197.910832] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1197.911475] do_syscall_64+0x33/0x40 [ 1197.911918] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1197.912525] RIP: 0033:0x7f43c90c3b19 [ 1197.912963] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1197.915152] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1197.916050] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1197.916890] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1197.917734] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1197.918574] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1197.919429] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:44:48 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) (fail_nth: 4) 21:44:48 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) (fail_nth: 3) 21:44:48 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:44:48 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:44:48 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 4) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:44:48 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x0, 0x0}, 0x0) r5 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r5, 0x0) 21:44:48 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 4) 21:44:48 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x0, 0x0}, 0x0) r5 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r8, 0x0, 0x0}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r5, 0x0) [ 1211.597288] FAULT_INJECTION: forcing a failure. [ 1211.597288] name failslab, interval 1, probability 0, space 0, times 0 [ 1211.600525] CPU: 1 PID: 8737 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1211.602250] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1211.604362] Call Trace: [ 1211.605035] dump_stack+0x107/0x167 [ 1211.605928] should_fail.cold+0x5/0xa [ 1211.606875] ? io_uring_setup+0x33c/0x2980 [ 1211.607950] should_failslab+0x5/0x20 [ 1211.608913] __kmalloc+0x72/0x390 [ 1211.609800] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1211.611094] io_uring_setup+0x33c/0x2980 [ 1211.612105] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1211.613289] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1211.614571] ? wait_for_completion_io+0x270/0x270 [ 1211.615816] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1211.617210] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1211.618567] do_syscall_64+0x33/0x40 [ 1211.619520] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1211.620815] RIP: 0033:0x7f43c90c3b19 [ 1211.621783] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1211.625991] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1211.627595] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1211.629094] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1211.630599] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1211.632129] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1211.633682] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1211.644780] FAULT_INJECTION: forcing a failure. [ 1211.644780] name failslab, interval 1, probability 0, space 0, times 0 [ 1211.647365] CPU: 1 PID: 8738 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1211.648806] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1211.650558] Call Trace: [ 1211.651124] dump_stack+0x107/0x167 [ 1211.651911] should_fail.cold+0x5/0xa [ 1211.652716] ? io_uring_setup+0x33c/0x2980 [ 1211.653621] should_failslab+0x5/0x20 [ 1211.654425] __kmalloc+0x72/0x390 [ 1211.655162] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1211.656254] io_uring_setup+0x33c/0x2980 [ 1211.657118] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1211.658145] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1211.659219] ? wait_for_completion_io+0x270/0x270 [ 1211.660268] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1211.661383] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1211.662483] do_syscall_64+0x33/0x40 [ 1211.663282] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1211.664362] RIP: 0033:0x7f741addcb19 [ 1211.665146] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1211.669054] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1211.670718] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1211.672548] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1211.674384] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1211.676234] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1211.677906] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1211.681096] FAULT_INJECTION: forcing a failure. [ 1211.681096] name failslab, interval 1, probability 0, space 0, times 0 [ 1211.683498] CPU: 0 PID: 8743 Comm: syz-executor.6 Not tainted 5.10.262 #1 [ 1211.684943] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1211.686676] Call Trace: [ 1211.687246] dump_stack+0x107/0x167 [ 1211.688027] should_fail.cold+0x5/0xa [ 1211.688849] ? create_object.isra.0+0x3a/0xa30 [ 1211.689812] should_failslab+0x5/0x20 [ 1211.690609] kmem_cache_alloc+0x5b/0x310 [ 1211.691477] create_object.isra.0+0x3a/0xa30 [ 1211.692406] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1211.693469] kmem_cache_alloc+0x159/0x310 [ 1211.694342] vm_area_alloc+0x1c/0x110 [ 1211.695131] mmap_region+0x982/0x1500 [ 1211.695956] do_mmap+0x868/0x1370 [ 1211.696697] vm_mmap_pgoff+0x198/0x1f0 [ 1211.697514] ? randomize_page+0xb0/0xb0 [ 1211.698374] ksys_mmap_pgoff+0x41c/0x560 [ 1211.699232] ? find_mergeable_anon_vma+0x250/0x250 [ 1211.700285] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1211.701395] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1211.702487] do_syscall_64+0x33/0x40 [ 1211.703280] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1211.704362] RIP: 0033:0x7fdf8b8bfb19 [ 1211.705139] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1211.709016] RSP: 002b:00007fdf88e35188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1211.710622] RAX: ffffffffffffffda RBX: 00007fdf8b9d2f60 RCX: 00007fdf8b8bfb19 [ 1211.712133] RDX: 000000000100000e RSI: 0000000000004000 RDI: 0000000020ffc000 [ 1211.713630] RBP: 00007fdf88e351d0 R08: 0000000000000004 R09: 0000000000000000 [ 1211.715128] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1211.716641] R13: 00007fff859166bf R14: 00007fdf88e35300 R15: 0000000000022000 21:44:48 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:44:48 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 5) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:44:48 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x0, 0x0}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, 0xffffffffffffffff, 0x0) 21:44:48 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0xb00, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:44:48 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:44:48 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x0, 0x0}, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r5, r6, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r7, 0x0, 0x0}, 0x0) 21:44:48 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 5) [ 1211.838856] FAULT_INJECTION: forcing a failure. [ 1211.838856] name failslab, interval 1, probability 0, space 0, times 0 [ 1211.841456] CPU: 1 PID: 8755 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1211.842912] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1211.844721] Call Trace: [ 1211.845283] dump_stack+0x107/0x167 [ 1211.846061] should_fail.cold+0x5/0xa [ 1211.846863] ? create_object.isra.0+0x3a/0xa30 [ 1211.847835] should_failslab+0x5/0x20 [ 1211.848649] kmem_cache_alloc+0x5b/0x310 [ 1211.849511] create_object.isra.0+0x3a/0xa30 [ 1211.850439] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1211.851518] __kmalloc+0x16e/0x390 [ 1211.852273] io_uring_setup+0x33c/0x2980 [ 1211.853134] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1211.854114] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1211.855196] ? wait_for_completion_io+0x270/0x270 [ 1211.856201] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1211.857311] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1211.858397] do_syscall_64+0x33/0x40 [ 1211.859195] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1211.860232] RIP: 0033:0x7f741addcb19 [ 1211.861023] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1211.864904] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1211.866515] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1211.868026] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1211.869533] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1211.871036] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1211.872551] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:44:48 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) (fail_nth: 5) 21:44:49 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0xb00, 0x100000e, 0x13, r0, 0x0) [ 1211.915883] FAULT_INJECTION: forcing a failure. [ 1211.915883] name failslab, interval 1, probability 0, space 0, times 0 [ 1211.918506] CPU: 0 PID: 8761 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1211.919960] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1211.921700] Call Trace: [ 1211.922258] dump_stack+0x107/0x167 [ 1211.923029] should_fail.cold+0x5/0xa [ 1211.923841] ? create_object.isra.0+0x3a/0xa30 [ 1211.924805] should_failslab+0x5/0x20 [ 1211.925608] kmem_cache_alloc+0x5b/0x310 [ 1211.926467] create_object.isra.0+0x3a/0xa30 [ 1211.927402] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1211.928470] __kmalloc+0x16e/0x390 [ 1211.929224] io_uring_setup+0x33c/0x2980 [ 1211.930082] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1211.931096] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1211.932164] ? wait_for_completion_io+0x270/0x270 [ 1211.933208] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1211.934327] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1211.935438] do_syscall_64+0x33/0x40 [ 1211.936229] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1211.937304] RIP: 0033:0x7f43c90c3b19 21:44:49 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4002, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1211.938091] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1211.942157] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1211.943753] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1211.945237] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 21:44:49 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x0, 0x0}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, 0xffffffffffffffff, 0x0) [ 1211.946721] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1211.948279] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1211.949752] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:44:49 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x0, 0x0}, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) 21:44:49 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1212.026897] FAULT_INJECTION: forcing a failure. [ 1212.026897] name failslab, interval 1, probability 0, space 0, times 0 [ 1212.029453] CPU: 0 PID: 8771 Comm: syz-executor.6 Not tainted 5.10.262 #1 [ 1212.030863] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1212.032588] Call Trace: [ 1212.033156] dump_stack+0x107/0x167 [ 1212.033933] should_fail.cold+0x5/0xa [ 1212.034745] ? perf_event_mmap+0x51a/0xd90 [ 1212.035653] should_failslab+0x5/0x20 [ 1212.036467] kmem_cache_alloc_trace+0x55/0x320 [ 1212.037451] perf_event_mmap+0x51a/0xd90 [ 1212.038324] ? perf_event_namespaces+0x50/0x50 [ 1212.039313] ? vma_link+0x619/0x820 [ 1212.040106] mmap_region+0x3a6/0x1500 [ 1212.040933] do_mmap+0x868/0x1370 [ 1212.041681] vm_mmap_pgoff+0x198/0x1f0 [ 1212.042509] ? randomize_page+0xb0/0xb0 [ 1212.043379] ksys_mmap_pgoff+0x41c/0x560 [ 1212.044245] ? find_mergeable_anon_vma+0x250/0x250 [ 1212.045290] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1212.046411] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1212.047526] do_syscall_64+0x33/0x40 [ 1212.048318] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1212.049403] RIP: 0033:0x7fdf8b8bfb19 [ 1212.050190] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1212.054119] RSP: 002b:00007fdf88e35188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1212.055745] RAX: ffffffffffffffda RBX: 00007fdf8b9d2f60 RCX: 00007fdf8b8bfb19 [ 1212.057259] RDX: 000000000100000e RSI: 0000000000004000 RDI: 0000000020ffc000 [ 1212.058754] RBP: 00007fdf88e351d0 R08: 0000000000000004 R09: 0000000000000000 [ 1212.060258] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1212.061748] R13: 00007fff859166bf R14: 00007fdf88e35300 R15: 0000000000022000 21:44:49 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4003, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:45:03 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 6) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:45:03 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:45:03 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) (fail_nth: 6) 21:45:03 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4002, 0x100000e, 0x13, r0, 0x0) 21:45:03 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x0, 0x0}, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:45:03 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x0, 0x0}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, 0xffffffffffffffff, 0x0) 21:45:03 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 6) 21:45:03 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4004, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1226.512543] FAULT_INJECTION: forcing a failure. [ 1226.512543] name failslab, interval 1, probability 0, space 0, times 0 [ 1226.513860] CPU: 1 PID: 8789 Comm: syz-executor.6 Not tainted 5.10.262 #1 [ 1226.514631] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1226.515568] Call Trace: [ 1226.515873] dump_stack+0x107/0x167 [ 1226.516288] should_fail.cold+0x5/0xa [ 1226.516722] ? create_object.isra.0+0x3a/0xa30 [ 1226.517236] should_failslab+0x5/0x20 [ 1226.517666] kmem_cache_alloc+0x5b/0x310 [ 1226.518133] create_object.isra.0+0x3a/0xa30 [ 1226.518629] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1226.519204] kmem_cache_alloc_trace+0x151/0x320 [ 1226.519741] perf_event_mmap+0x51a/0xd90 [ 1226.520202] ? perf_event_namespaces+0x50/0x50 [ 1226.520724] ? vma_link+0x619/0x820 [ 1226.521149] mmap_region+0x3a6/0x1500 [ 1226.521584] do_mmap+0x868/0x1370 [ 1226.521980] vm_mmap_pgoff+0x198/0x1f0 [ 1226.522421] ? randomize_page+0xb0/0xb0 [ 1226.522874] ksys_mmap_pgoff+0x41c/0x560 [ 1226.523339] ? find_mergeable_anon_vma+0x250/0x250 [ 1226.523895] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1226.523959] FAULT_INJECTION: forcing a failure. [ 1226.523959] name failslab, interval 1, probability 0, space 0, times 0 [ 1226.524496] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1226.524517] do_syscall_64+0x33/0x40 [ 1226.527848] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1226.528429] RIP: 0033:0x7fdf8b8bfb19 [ 1226.528854] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1226.530930] RSP: 002b:00007fdf88e35188 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1226.531803] RAX: ffffffffffffffda RBX: 00007fdf8b9d2f60 RCX: 00007fdf8b8bfb19 [ 1226.532607] RDX: 000000000100000e RSI: 0000000000004000 RDI: 0000000020ffc000 [ 1226.533413] RBP: 00007fdf88e351d0 R08: 0000000000000004 R09: 0000000000000000 [ 1226.534213] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1226.535013] R13: 00007fff859166bf R14: 00007fdf88e35300 R15: 0000000000022000 [ 1226.535848] CPU: 0 PID: 8796 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1226.537312] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1226.539048] Call Trace: [ 1226.539630] dump_stack+0x107/0x167 [ 1226.539680] FAULT_INJECTION: forcing a failure. [ 1226.539680] name failslab, interval 1, probability 0, space 0, times 0 [ 1226.540407] should_fail.cold+0x5/0xa [ 1226.540429] ? io_uring_setup+0x40b/0x2980 [ 1226.540446] should_failslab+0x5/0x20 [ 1226.540465] kmem_cache_alloc_trace+0x55/0x320 [ 1226.540482] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1226.540504] io_uring_setup+0x40b/0x2980 [ 1226.540524] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1226.540545] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1226.540559] ? wait_for_completion_io+0x270/0x270 [ 1226.540599] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1226.540618] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1226.540640] do_syscall_64+0x33/0x40 [ 1226.540658] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1226.540670] RIP: 0033:0x7f43c90c3b19 [ 1226.540686] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1226.540695] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1226.540713] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1226.540723] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1226.540732] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1226.540742] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1226.540751] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1226.556697] CPU: 1 PID: 8801 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1226.557464] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1226.558392] Call Trace: [ 1226.558687] dump_stack+0x107/0x167 [ 1226.559096] should_fail.cold+0x5/0xa [ 1226.559537] ? io_uring_setup+0x40b/0x2980 [ 1226.560015] should_failslab+0x5/0x20 [ 1226.560441] kmem_cache_alloc_trace+0x55/0x320 [ 1226.560954] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1226.561523] io_uring_setup+0x40b/0x2980 [ 1226.561978] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1226.562525] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1226.563094] ? wait_for_completion_io+0x270/0x270 [ 1226.563658] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1226.564249] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1226.564829] do_syscall_64+0x33/0x40 [ 1226.565247] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1226.565820] RIP: 0033:0x7f741addcb19 [ 1226.566236] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1226.568306] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1226.569161] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1226.569959] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1226.570758] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1226.571566] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1226.572367] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:45:03 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:45:03 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:45:18 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1241.422784] FAULT_INJECTION: forcing a failure. [ 1241.422784] name failslab, interval 1, probability 0, space 0, times 0 [ 1241.425438] CPU: 0 PID: 8818 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1241.426884] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1241.428650] Call Trace: [ 1241.429220] dump_stack+0x107/0x167 [ 1241.429991] should_fail.cold+0x5/0xa [ 1241.430796] ? create_object.isra.0+0x3a/0xa30 [ 1241.431774] should_failslab+0x5/0x20 [ 1241.432570] kmem_cache_alloc+0x5b/0x310 [ 1241.433435] create_object.isra.0+0x3a/0xa30 [ 1241.434357] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1241.435428] kmem_cache_alloc_trace+0x151/0x320 [ 1241.436424] io_uring_setup+0x40b/0x2980 [ 1241.437284] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1241.438300] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1241.439367] ? wait_for_completion_io+0x270/0x270 [ 1241.440412] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1241.441522] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1241.442619] do_syscall_64+0x33/0x40 [ 1241.443405] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1241.444498] RIP: 0033:0x7f43c90c3b19 [ 1241.445282] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1241.449181] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1241.450781] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1241.452287] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1241.453800] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1241.455301] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1241.456812] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:45:18 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 7) 21:45:18 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4003, 0x100000e, 0x13, r0, 0x0) 21:45:18 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x0, 0x0}, 0x0) 21:45:18 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:45:18 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4005, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:45:18 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) (fail_nth: 7) 21:45:18 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 7) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) [ 1241.490468] FAULT_INJECTION: forcing a failure. [ 1241.490468] name failslab, interval 1, probability 0, space 0, times 0 [ 1241.495444] CPU: 0 PID: 8826 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1241.496911] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1241.498665] Call Trace: [ 1241.499227] dump_stack+0x107/0x167 [ 1241.500006] should_fail.cold+0x5/0xa [ 1241.500810] ? create_object.isra.0+0x3a/0xa30 [ 1241.501772] should_failslab+0x5/0x20 [ 1241.502573] kmem_cache_alloc+0x5b/0x310 [ 1241.503429] create_object.isra.0+0x3a/0xa30 [ 1241.504359] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1241.505432] kmem_cache_alloc_trace+0x151/0x320 [ 1241.506419] io_uring_setup+0x40b/0x2980 [ 1241.507280] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1241.508308] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1241.509375] ? wait_for_completion_io+0x270/0x270 [ 1241.510410] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1241.511520] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1241.512617] do_syscall_64+0x33/0x40 [ 1241.513399] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1241.514482] RIP: 0033:0x7f741addcb19 [ 1241.515268] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1241.519164] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1241.520787] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1241.522293] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1241.523806] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1241.525320] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1241.526830] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:45:18 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1241.542828] FAULT_INJECTION: forcing a failure. [ 1241.542828] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1241.545349] CPU: 0 PID: 8830 Comm: syz-executor.6 Not tainted 5.10.262 #1 [ 1241.546791] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1241.548545] Call Trace: [ 1241.549105] dump_stack+0x107/0x167 [ 1241.549882] should_fail.cold+0x5/0xa [ 1241.550689] _copy_to_user+0x2e/0x180 [ 1241.551506] simple_read_from_buffer+0xcc/0x160 [ 1241.552486] proc_fail_nth_read+0x198/0x230 [ 1241.553398] ? proc_sessionid_read+0x230/0x230 [ 1241.554361] ? security_file_permission+0xb1/0xe0 [ 1241.555386] ? proc_sessionid_read+0x230/0x230 [ 1241.556357] vfs_read+0x228/0x620 [ 1241.557096] ksys_read+0x12d/0x260 [ 1241.557840] ? vfs_write+0xb10/0xb10 [ 1241.558628] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1241.559748] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1241.560848] do_syscall_64+0x33/0x40 [ 1241.561633] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1241.562714] RIP: 0033:0x7fdf8b87269c [ 1241.563507] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1241.567400] RSP: 002b:00007fdf88e35170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1241.569010] RAX: ffffffffffffffda RBX: 0000000020ffc000 RCX: 00007fdf8b87269c [ 1241.570516] RDX: 000000000000000f RSI: 00007fdf88e351e0 RDI: 0000000000000005 [ 1241.572027] RBP: 00007fdf88e351d0 R08: 0000000000000000 R09: 0000000000000000 [ 1241.573526] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1241.575024] R13: 00007fff859166bf R14: 00007fdf88e35300 R15: 0000000000022000 21:45:18 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:45:18 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4004, 0x100000e, 0x13, r0, 0x0) 21:45:18 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) 21:45:18 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4006, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:45:18 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 8) 21:45:18 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:45:18 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 8) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) [ 1241.757804] FAULT_INJECTION: forcing a failure. [ 1241.757804] name failslab, interval 1, probability 0, space 0, times 0 [ 1241.760333] CPU: 1 PID: 8849 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1241.761756] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1241.763472] Call Trace: [ 1241.764036] dump_stack+0x107/0x167 [ 1241.764798] should_fail.cold+0x5/0xa [ 1241.765603] ? create_object.isra.0+0x3a/0xa30 [ 1241.766555] should_failslab+0x5/0x20 [ 1241.767353] kmem_cache_alloc+0x5b/0x310 [ 1241.768212] create_object.isra.0+0x3a/0xa30 [ 1241.769127] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1241.770185] kmem_cache_alloc_trace+0x151/0x320 [ 1241.771162] io_uring_setup+0x40b/0x2980 [ 1241.772025] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1241.773037] ? __do_sys_io_uring_enter+0x1890/0x1890 21:45:18 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) socket$inet_icmp(0x2, 0x2, 0x1) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) [ 1241.774088] ? wait_for_completion_io+0x270/0x270 [ 1241.775478] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1241.776560] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1241.777636] do_syscall_64+0x33/0x40 [ 1241.778420] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1241.779498] RIP: 0033:0x7f43c90c3b19 [ 1241.780286] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1241.784073] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1241.785668] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1241.787135] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1241.788604] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1241.790069] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1241.791538] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:45:18 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4007, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1241.813894] FAULT_INJECTION: forcing a failure. [ 1241.813894] name failslab, interval 1, probability 0, space 0, times 0 [ 1241.816494] CPU: 0 PID: 8850 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1241.817945] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1241.819707] Call Trace: [ 1241.820272] dump_stack+0x107/0x167 [ 1241.821039] should_fail.cold+0x5/0xa [ 1241.821846] ? create_object.isra.0+0x3a/0xa30 [ 1241.822811] should_failslab+0x5/0x20 [ 1241.823620] kmem_cache_alloc+0x5b/0x310 [ 1241.824473] create_object.isra.0+0x3a/0xa30 [ 1241.825399] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1241.826473] kmem_cache_alloc_trace+0x151/0x320 [ 1241.827474] io_uring_setup+0x40b/0x2980 [ 1241.828330] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1241.829342] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1241.830404] ? wait_for_completion_io+0x270/0x270 [ 1241.831435] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1241.832553] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1241.833647] do_syscall_64+0x33/0x40 [ 1241.834429] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1241.835510] RIP: 0033:0x7f741addcb19 [ 1241.836295] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1241.840170] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1241.841767] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1241.843266] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1241.844774] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1241.846272] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1241.847776] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:45:34 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 9) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:45:34 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x100000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:45:34 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:45:34 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4005, 0x100000e, 0x13, r0, 0x0) 21:45:34 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:45:34 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0xb00, 0x100000e, 0x13, r0, 0x0) 21:45:34 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:45:34 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 9) [ 1257.000139] FAULT_INJECTION: forcing a failure. [ 1257.000139] name failslab, interval 1, probability 0, space 0, times 0 [ 1257.003203] CPU: 0 PID: 8863 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1257.004936] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1257.007023] Call Trace: [ 1257.007696] dump_stack+0x107/0x167 [ 1257.008610] should_fail.cold+0x5/0xa [ 1257.009569] ? create_object.isra.0+0x3a/0xa30 [ 1257.010713] should_failslab+0x5/0x20 [ 1257.011673] kmem_cache_alloc+0x5b/0x310 [ 1257.012698] create_object.isra.0+0x3a/0xa30 [ 1257.013800] kmemleak_alloc_percpu+0xa0/0x100 [ 1257.014930] pcpu_alloc+0x4e2/0x1240 [ 1257.015890] ? io_tctx_exit_cb+0xf0/0xf0 [ 1257.016919] percpu_ref_init+0x31/0x3d0 [ 1257.017914] io_uring_setup+0x47a/0x2980 [ 1257.018934] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1257.020156] ? __do_sys_io_uring_enter+0x1890/0x1890 21:45:34 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:45:34 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4006, 0x100000e, 0x13, r0, 0x0) [ 1257.021431] ? wait_for_completion_io+0x270/0x270 [ 1257.022793] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1257.024146] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1257.025470] do_syscall_64+0x33/0x40 [ 1257.026427] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1257.027746] RIP: 0033:0x7f741addcb19 [ 1257.028691] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1257.033369] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1257.035309] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1257.037041] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1257.038665] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1257.040303] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1257.041918] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:45:34 executing program 4: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) [ 1257.082540] FAULT_INJECTION: forcing a failure. [ 1257.082540] name failslab, interval 1, probability 0, space 0, times 0 [ 1257.085258] CPU: 0 PID: 8883 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1257.086807] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 21:45:34 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) [ 1257.088716] Call Trace: [ 1257.089489] dump_stack+0x107/0x167 [ 1257.090314] should_fail.cold+0x5/0xa [ 1257.091169] ? create_object.isra.0+0x3a/0xa30 [ 1257.092196] should_failslab+0x5/0x20 [ 1257.093047] kmem_cache_alloc+0x5b/0x310 [ 1257.093955] create_object.isra.0+0x3a/0xa30 [ 1257.094949] kmemleak_alloc_percpu+0xa0/0x100 [ 1257.095974] pcpu_alloc+0x4e2/0x1240 [ 1257.096814] ? io_tctx_exit_cb+0xf0/0xf0 [ 1257.097734] percpu_ref_init+0x31/0x3d0 [ 1257.098628] io_uring_setup+0x47a/0x2980 [ 1257.099543] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1257.100633] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1257.101769] ? wait_for_completion_io+0x270/0x270 [ 1257.102869] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 21:45:34 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x7fffdf003000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1257.104047] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1257.105253] do_syscall_64+0x33/0x40 [ 1257.106105] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1257.107260] RIP: 0033:0x7f43c90c3b19 [ 1257.108114] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1257.112299] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1257.114014] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1257.115637] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1257.117255] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1257.118865] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1257.120501] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1257.139216] FAULT_INJECTION: forcing a failure. [ 1257.139216] name failslab, interval 1, probability 0, space 0, times 0 [ 1257.140565] CPU: 1 PID: 8891 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1257.141331] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1257.142265] Call Trace: [ 1257.142571] dump_stack+0x107/0x167 [ 1257.142982] should_fail.cold+0x5/0xa [ 1257.143415] ? percpu_ref_init+0xd8/0x3d0 [ 1257.143896] should_failslab+0x5/0x20 [ 1257.144325] kmem_cache_alloc_trace+0x55/0x320 [ 1257.144842] ? io_tctx_exit_cb+0xf0/0xf0 [ 1257.145298] percpu_ref_init+0xd8/0x3d0 [ 1257.145748] io_uring_setup+0x47a/0x2980 [ 1257.146210] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1257.146753] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1257.147326] ? wait_for_completion_io+0x270/0x270 [ 1257.147929] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1257.148524] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1257.149106] do_syscall_64+0x33/0x40 [ 1257.149524] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1257.150101] RIP: 0033:0x7f741addcb19 [ 1257.150519] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1257.152597] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1257.153450] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1257.154249] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1257.155052] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1257.155859] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1257.156659] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:45:34 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:45:34 executing program 4: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:45:34 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) io_uring_enter(r1, 0x6ca3, 0x3237, 0x6, &(0x7f0000000000)={[0x20]}, 0x8) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:45:34 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4007, 0x100000e, 0x13, r0, 0x0) 21:45:34 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4002, 0x100000e, 0x13, r0, 0x0) 21:45:34 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x7ffffffff000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:45:34 executing program 4: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:45:34 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:45:34 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x100000, 0x100000e, 0x13, r0, 0x0) 21:45:50 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 10) 21:45:50 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x7fffdf003000, 0x100000e, 0x13, r0, 0x0) 21:45:50 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) 21:45:50 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 11) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:45:50 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4003, 0x100000e, 0x13, r0, 0x0) 21:45:50 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:45:50 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:45:50 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) [ 1273.232399] FAULT_INJECTION: forcing a failure. [ 1273.232399] name failslab, interval 1, probability 0, space 0, times 0 [ 1273.236667] CPU: 0 PID: 8935 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1273.238087] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1273.239812] Call Trace: [ 1273.240351] dump_stack+0x107/0x167 [ 1273.241102] should_fail.cold+0x5/0xa [ 1273.241888] ? percpu_ref_init+0xd8/0x3d0 [ 1273.242726] should_failslab+0x5/0x20 [ 1273.243526] kmem_cache_alloc_trace+0x55/0x320 [ 1273.244479] ? io_tctx_exit_cb+0xf0/0xf0 [ 1273.245316] percpu_ref_init+0xd8/0x3d0 [ 1273.246148] io_uring_setup+0x47a/0x2980 [ 1273.247117] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1273.248390] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1273.249629] ? wait_for_completion_io+0x270/0x270 [ 1273.250851] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1273.252272] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1273.253604] do_syscall_64+0x33/0x40 [ 1273.254554] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1273.255748] RIP: 0033:0x7f43c90c3b19 [ 1273.256539] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1273.256767] FAULT_INJECTION: forcing a failure. [ 1273.256767] name failslab, interval 1, probability 0, space 0, times 0 [ 1273.261326] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1273.261353] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1273.261367] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1273.261381] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1273.261397] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1273.261412] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1273.273898] CPU: 1 PID: 8941 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1273.275318] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1273.277058] Call Trace: [ 1273.277624] dump_stack+0x107/0x167 [ 1273.278388] should_fail.cold+0x5/0xa [ 1273.279187] ? create_object.isra.0+0x3a/0xa30 [ 1273.280155] should_failslab+0x5/0x20 [ 1273.280956] kmem_cache_alloc+0x5b/0x310 [ 1273.281818] create_object.isra.0+0x3a/0xa30 [ 1273.282742] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1273.284048] kmem_cache_alloc_trace+0x151/0x320 [ 1273.285004] ? io_tctx_exit_cb+0xf0/0xf0 [ 1273.286021] percpu_ref_init+0xd8/0x3d0 [ 1273.287036] io_uring_setup+0x47a/0x2980 [ 1273.288084] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1273.289312] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1273.290584] ? wait_for_completion_io+0x270/0x270 [ 1273.291859] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1273.293188] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1273.294517] do_syscall_64+0x33/0x40 [ 1273.295473] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1273.296805] RIP: 0033:0x7f741addcb19 [ 1273.297754] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1273.302420] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1273.304332] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1273.305838] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1273.307440] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1273.309199] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1273.310711] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:45:50 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) 21:45:50 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:45:50 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x2) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:45:50 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4004, 0x100000e, 0x13, r0, 0x0) [ 1288.334671] FAULT_INJECTION: forcing a failure. [ 1288.334671] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 1288.337499] CPU: 0 PID: 8965 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1288.339058] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1288.340911] Call Trace: [ 1288.341506] dump_stack+0x107/0x167 [ 1288.342321] should_fail.cold+0x5/0xa [ 1288.343181] __alloc_pages_nodemask+0x182/0x600 [ 1288.344229] ? __alloc_pages_slowpath.constprop.0+0x2320/0x2320 [ 1288.345563] ? cap_capable+0x1cd/0x230 [ 1288.346443] alloc_pages_current+0x187/0x280 [ 1288.347412] __get_free_pages+0xc/0xa0 [ 1288.348274] io_uring_setup+0xe27/0x2980 [ 1288.349174] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1288.350280] ? wait_for_completion_io+0x270/0x270 [ 1288.351382] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1288.352547] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1288.353688] do_syscall_64+0x33/0x40 [ 1288.354498] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1288.355626] RIP: 0033:0x7f741addcb19 [ 1288.356445] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1288.360486] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1288.362156] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1288.363739] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1288.365317] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1288.366885] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1288.368459] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1288.387788] FAULT_INJECTION: forcing a failure. [ 1288.387788] name failslab, interval 1, probability 0, space 0, times 0 [ 1288.391409] CPU: 1 PID: 8973 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1288.392892] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1288.394656] Call Trace: [ 1288.395218] dump_stack+0x107/0x167 21:46:05 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x7ffffffff000, 0x100000e, 0x13, r0, 0x0) 21:46:05 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x3) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:46:05 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 12) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:46:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:46:05 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 11) 21:46:05 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:46:05 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) 21:46:05 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4005, 0x100000e, 0x13, r0, 0x0) [ 1288.396281] should_fail.cold+0x5/0xa [ 1288.397274] ? create_object.isra.0+0x3a/0xa30 [ 1288.398238] should_failslab+0x5/0x20 [ 1288.399037] kmem_cache_alloc+0x5b/0x310 [ 1288.399894] create_object.isra.0+0x3a/0xa30 [ 1288.400835] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1288.401904] kmem_cache_alloc_trace+0x151/0x320 [ 1288.402900] ? io_tctx_exit_cb+0xf0/0xf0 [ 1288.403749] percpu_ref_init+0xd8/0x3d0 [ 1288.404611] io_uring_setup+0x47a/0x2980 [ 1288.405463] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1288.406471] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1288.407522] ? wait_for_completion_io+0x270/0x270 [ 1288.408554] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1288.409650] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1288.410737] do_syscall_64+0x33/0x40 [ 1288.411522] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1288.412615] RIP: 0033:0x7f43c90c3b19 [ 1288.413405] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1288.417311] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1288.418930] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1288.420421] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1288.421906] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1288.423391] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1288.424899] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:46:05 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:46:05 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4006, 0x100000e, 0x13, r0, 0x0) 21:46:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:46:05 executing program 4: r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r0, 0xffffffffffffffff) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) 21:46:05 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x13, r0, 0x0) 21:46:05 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x4) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:46:05 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:46:05 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4007, 0x100000e, 0x13, r0, 0x0) [ 1301.813259] FAULT_INJECTION: forcing a failure. [ 1301.813259] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1301.814692] CPU: 1 PID: 9015 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1301.815467] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1301.816428] Call Trace: [ 1301.816739] dump_stack+0x107/0x167 [ 1301.817165] should_fail.cold+0x5/0xa [ 1301.817616] __alloc_pages_nodemask+0x182/0x600 [ 1301.818150] ? __alloc_pages_slowpath.constprop.0+0x2320/0x2320 [ 1301.818844] ? cap_capable+0x1cd/0x230 [ 1301.819295] alloc_pages_current+0x187/0x280 [ 1301.819808] __get_free_pages+0xc/0xa0 [ 1301.820267] io_uring_setup+0xf9a/0x2980 [ 1301.820734] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1301.821323] ? wait_for_completion_io+0x270/0x270 [ 1301.821887] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1301.822488] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1301.823081] do_syscall_64+0x33/0x40 [ 1301.823504] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1301.824116] RIP: 0033:0x7f741addcb19 [ 1301.824542] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1301.826652] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1301.827526] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1301.828383] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1301.829216] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1301.830023] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1301.830831] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:46:18 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 12) 21:46:18 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x100000, 0x100000e, 0x13, r0, 0x0) 21:46:18 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:46:18 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 13) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:46:18 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:46:18 executing program 4: r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r0, 0xffffffffffffffff) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) 21:46:18 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x2) 21:46:18 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x5) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:46:18 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x3) [ 1301.867513] FAULT_INJECTION: forcing a failure. [ 1301.867513] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1301.868931] CPU: 1 PID: 9025 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1301.869707] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1301.870655] Call Trace: [ 1301.870969] dump_stack+0x107/0x167 [ 1301.871392] should_fail.cold+0x5/0xa [ 1301.871833] __alloc_pages_nodemask+0x182/0x600 [ 1301.872378] ? __alloc_pages_slowpath.constprop.0+0x2320/0x2320 [ 1301.873075] ? cap_capable+0x1cd/0x230 [ 1301.873524] alloc_pages_current+0x187/0x280 [ 1301.874035] __get_free_pages+0xc/0xa0 [ 1301.874485] io_uring_setup+0xe27/0x2980 [ 1301.874977] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1301.875559] ? wait_for_completion_io+0x270/0x270 [ 1301.876128] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1301.876729] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1301.877318] do_syscall_64+0x33/0x40 [ 1301.877747] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1301.878337] RIP: 0033:0x7f43c90c3b19 [ 1301.878761] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1301.880872] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1301.881747] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1301.882563] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1301.883384] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1301.884208] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1301.885026] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:46:18 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 14) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:46:19 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x7fffdf003000, 0x100000e, 0x13, r0, 0x0) 21:46:19 executing program 1: r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r0, 0xffffffffffffffff) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) [ 1301.946611] FAULT_INJECTION: forcing a failure. [ 1301.946611] name failslab, interval 1, probability 0, space 0, times 0 [ 1301.948002] CPU: 1 PID: 9035 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1301.948803] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1301.949751] Call Trace: [ 1301.950064] dump_stack+0x107/0x167 [ 1301.950487] should_fail.cold+0x5/0xa [ 1301.950925] ? io_rsrc_node_switch_start.part.0+0x43/0x250 [ 1301.951563] should_failslab+0x5/0x20 [ 1301.952000] kmem_cache_alloc_trace+0x55/0x320 [ 1301.952530] io_rsrc_node_switch_start.part.0+0x43/0x250 [ 1301.953148] io_uring_setup+0x14f6/0x2980 [ 1301.953626] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1301.954211] ? wait_for_completion_io+0x270/0x270 [ 1301.954775] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1301.955378] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1301.955972] do_syscall_64+0x33/0x40 [ 1301.956408] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1301.956994] RIP: 0033:0x7f741addcb19 [ 1301.957417] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1301.959523] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1301.960457] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1301.961276] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1301.962096] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1301.962908] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1301.963728] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:46:40 executing program 1: r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r0, 0xffffffffffffffff) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:46:40 executing program 4: r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r0, 0xffffffffffffffff) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) 21:46:40 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x7ffffffff000, 0x100000e, 0x13, r0, 0x0) 21:46:40 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 13) 21:46:40 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x6) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1323.499720] FAULT_INJECTION: forcing a failure. [ 1323.499720] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1323.502470] CPU: 1 PID: 9053 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1323.503895] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1323.505642] Call Trace: [ 1323.506196] dump_stack+0x107/0x167 [ 1323.506957] should_fail.cold+0x5/0xa [ 1323.507753] __alloc_pages_nodemask+0x182/0x600 [ 1323.508737] ? __alloc_pages_slowpath.constprop.0+0x2320/0x2320 [ 1323.509993] ? cap_capable+0x1cd/0x230 [ 1323.510809] alloc_pages_current+0x187/0x280 [ 1323.511728] __get_free_pages+0xc/0xa0 [ 1323.512561] io_uring_setup+0xf9a/0x2980 [ 1323.513409] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1323.514466] ? wait_for_completion_io+0x270/0x270 [ 1323.515507] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1323.516629] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1323.517703] do_syscall_64+0x33/0x40 [ 1323.518486] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1323.519564] RIP: 0033:0x7f43c90c3b19 [ 1323.520346] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1323.524177] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1323.525780] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1323.527262] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1323.528765] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1323.530255] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1323.531754] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:46:40 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:46:40 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x4) 21:46:40 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 15) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) [ 1323.569525] FAULT_INJECTION: forcing a failure. [ 1323.569525] name failslab, interval 1, probability 0, space 0, times 0 [ 1323.572134] CPU: 0 PID: 9060 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1323.573577] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1323.575302] Call Trace: [ 1323.575870] dump_stack+0x107/0x167 [ 1323.576637] should_fail.cold+0x5/0xa [ 1323.577443] ? create_object.isra.0+0x3a/0xa30 [ 1323.578388] should_failslab+0x5/0x20 [ 1323.579181] kmem_cache_alloc+0x5b/0x310 [ 1323.580030] ? __alloc_pages_slowpath.constprop.0+0x2320/0x2320 [ 1323.581300] create_object.isra.0+0x3a/0xa30 [ 1323.582222] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1323.583285] kmem_cache_alloc_trace+0x151/0x320 [ 1323.584287] io_rsrc_node_switch_start.part.0+0x43/0x250 [ 1323.585432] io_uring_setup+0x14f6/0x2980 [ 1323.586314] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1323.587378] ? wait_for_completion_io+0x270/0x270 [ 1323.588431] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1323.589544] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1323.590632] do_syscall_64+0x33/0x40 [ 1323.591421] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1323.592500] RIP: 0033:0x7f741addcb19 [ 1323.593288] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1323.597176] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1323.598769] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1323.600276] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1323.601793] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1323.603295] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1323.604809] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:46:40 executing program 4: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:46:40 executing program 1: r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r0, 0xffffffffffffffff) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:46:40 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x7) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:46:40 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:46:40 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x13, r0, 0x0) 21:46:40 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x5) 21:46:56 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:46:56 executing program 1: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:46:56 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x6) 21:46:56 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 14) 21:46:56 executing program 4: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:46:56 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x8) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:46:56 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 16) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:46:56 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x2) 21:46:56 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x3) [ 1339.520829] FAULT_INJECTION: forcing a failure. [ 1339.520829] name failslab, interval 1, probability 0, space 0, times 0 [ 1339.522461] CPU: 1 PID: 9104 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1339.523412] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1339.524596] Call Trace: [ 1339.524972] dump_stack+0x107/0x167 [ 1339.525498] should_fail.cold+0x5/0xa [ 1339.526047] ? io_rsrc_node_switch_start.part.0+0x43/0x250 [ 1339.526827] should_failslab+0x5/0x20 [ 1339.527371] kmem_cache_alloc_trace+0x55/0x320 [ 1339.528032] io_rsrc_node_switch_start.part.0+0x43/0x250 [ 1339.528799] io_uring_setup+0x14f6/0x2980 [ 1339.529386] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1339.530097] ? wait_for_completion_io+0x270/0x270 [ 1339.530792] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1339.531535] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1339.532267] do_syscall_64+0x33/0x40 [ 1339.532814] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1339.533559] RIP: 0033:0x7f43c90c3b19 [ 1339.534086] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1339.536730] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1339.537816] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1339.538815] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1339.539813] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1339.540847] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1339.541845] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1339.545904] FAULT_INJECTION: forcing a failure. [ 1339.545904] name failslab, interval 1, probability 0, space 0, times 0 [ 1339.547578] CPU: 1 PID: 9105 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1339.548547] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1339.549709] Call Trace: [ 1339.550092] dump_stack+0x107/0x167 [ 1339.550603] should_fail.cold+0x5/0xa [ 1339.551141] ? create_object.isra.0+0x3a/0xa30 [ 1339.551776] should_failslab+0x5/0x20 [ 1339.552317] kmem_cache_alloc+0x5b/0x310 [ 1339.552902] create_object.isra.0+0x3a/0xa30 [ 1339.553615] kmemleak_alloc_percpu+0xa0/0x100 [ 1339.554243] pcpu_alloc+0x4e2/0x1240 [ 1339.554785] ? io_async_queue_proc+0x80/0x80 [ 1339.555403] percpu_ref_init+0x31/0x3d0 [ 1339.555961] io_rsrc_node_switch_start.part.0+0x6a/0x250 [ 1339.556719] io_uring_setup+0x14f6/0x2980 [ 1339.557300] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1339.558010] ? wait_for_completion_io+0x270/0x270 [ 1339.558695] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1339.559428] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1339.560149] do_syscall_64+0x33/0x40 [ 1339.560675] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1339.561398] RIP: 0033:0x7f741addcb19 [ 1339.561911] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1339.564510] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1339.565582] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1339.566574] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1339.567563] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1339.568556] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1339.569551] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:46:56 executing program 1: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:46:56 executing program 4: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:46:56 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x10) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:46:56 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x7) 21:46:56 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:46:56 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x8) 21:46:56 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:46:56 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 15) 21:46:56 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x4) 21:46:56 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x0, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:46:56 executing program 1: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) [ 1339.771774] FAULT_INJECTION: forcing a failure. [ 1339.771774] name failslab, interval 1, probability 0, space 0, times 0 [ 1339.774665] CPU: 0 PID: 9131 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1339.776201] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1339.778097] Call Trace: [ 1339.778692] dump_stack+0x107/0x167 [ 1339.779516] should_fail.cold+0x5/0xa [ 1339.780370] ? io_rsrc_node_switch_start.part.0+0x43/0x250 [ 1339.781646] should_failslab+0x5/0x20 [ 1339.782504] kmem_cache_alloc_trace+0x55/0x320 [ 1339.783540] io_rsrc_node_switch_start.part.0+0x43/0x250 [ 1339.784779] io_uring_setup+0x14f6/0x2980 [ 1339.785712] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1339.786846] ? wait_for_completion_io+0x270/0x270 [ 1339.787949] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1339.789163] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1339.790327] do_syscall_64+0x33/0x40 [ 1339.791158] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1339.792303] RIP: 0033:0x7f43c90c3b19 [ 1339.793163] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1339.797301] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1339.799007] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1339.800628] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1339.802224] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1339.803817] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1339.805454] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:46:56 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x10) 21:46:56 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x5) 21:47:10 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x0, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) [ 1353.264693] FAULT_INJECTION: forcing a failure. [ 1353.264693] name failslab, interval 1, probability 0, space 0, times 0 [ 1353.267877] CPU: 0 PID: 9154 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1353.269597] FAULT_INJECTION: forcing a failure. [ 1353.269597] name failslab, interval 1, probability 0, space 0, times 0 [ 1353.269656] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1353.269672] Call Trace: [ 1353.273825] dump_stack+0x107/0x167 [ 1353.274766] should_fail.cold+0x5/0xa [ 1353.275754] ? create_object.isra.0+0x3a/0xa30 [ 1353.276939] should_failslab+0x5/0x20 [ 1353.277921] kmem_cache_alloc+0x5b/0x310 [ 1353.278971] create_object.isra.0+0x3a/0xa30 [ 1353.280110] kmemleak_alloc_percpu+0xa0/0x100 [ 1353.281281] pcpu_alloc+0x4e2/0x1240 [ 1353.282254] ? io_async_queue_proc+0x80/0x80 [ 1353.283380] percpu_ref_init+0x31/0x3d0 [ 1353.284409] io_rsrc_node_switch_start.part.0+0x6a/0x250 [ 1353.285785] io_uring_setup+0x14f6/0x2980 [ 1353.286837] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1353.288107] ? wait_for_completion_io+0x270/0x270 [ 1353.289411] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1353.290769] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1353.292103] do_syscall_64+0x33/0x40 [ 1353.293052] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1353.294342] RIP: 0033:0x7f43c90c3b19 [ 1353.295280] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1353.299934] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1353.301905] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1353.303748] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1353.305563] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1353.307398] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1353.309248] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1353.311116] CPU: 1 PID: 9159 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1353.311956] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1353.312925] Call Trace: [ 1353.313255] dump_stack+0x107/0x167 [ 1353.313680] should_fail.cold+0x5/0xa [ 1353.314120] ? create_object.isra.0+0x3a/0xa30 [ 1353.314649] should_failslab+0x5/0x20 [ 1353.315084] kmem_cache_alloc+0x5b/0x310 [ 1353.315553] create_object.isra.0+0x3a/0xa30 [ 1353.316065] kmemleak_alloc_percpu+0xa0/0x100 [ 1353.316591] pcpu_alloc+0x4e2/0x1240 [ 1353.317028] ? io_async_queue_proc+0x80/0x80 [ 1353.317537] percpu_ref_init+0x31/0x3d0 [ 1353.317996] io_rsrc_node_switch_start.part.0+0x6a/0x250 [ 1353.318618] io_uring_setup+0x14f6/0x2980 [ 1353.319096] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1353.319679] ? wait_for_completion_io+0x270/0x270 [ 1353.320248] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1353.320862] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1353.321461] do_syscall_64+0x33/0x40 [ 1353.321894] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1353.322484] RIP: 0033:0x7f741addcb19 [ 1353.322913] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1353.325053] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1353.325934] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1353.326746] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1353.327574] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1353.328384] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1353.329204] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:47:10 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x6) 21:47:10 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x60) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:47:10 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x60) 21:47:10 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 16) 21:47:10 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:47:10 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:47:10 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 17) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:47:10 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x0, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) [ 1367.819797] FAULT_INJECTION: forcing a failure. [ 1367.819797] name failslab, interval 1, probability 0, space 0, times 0 [ 1367.822585] CPU: 1 PID: 9181 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1367.824321] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 21:47:24 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 18) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:47:24 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x300) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:47:24 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:47:24 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 17) 21:47:24 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x7) 21:47:24 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, 0x0, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:47:24 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x0, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:47:24 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x300) [ 1367.826254] Call Trace: [ 1367.826980] dump_stack+0x107/0x167 [ 1367.827781] should_fail.cold+0x5/0xa [ 1367.828621] ? create_object.isra.0+0x3a/0xa30 [ 1367.829624] should_failslab+0x5/0x20 [ 1367.830450] kmem_cache_alloc+0x5b/0x310 [ 1367.831334] create_object.isra.0+0x3a/0xa30 [ 1367.832261] kmemleak_alloc_percpu+0xa0/0x100 [ 1367.833247] pcpu_alloc+0x4e2/0x1240 [ 1367.834061] ? io_async_queue_proc+0x80/0x80 [ 1367.834980] percpu_ref_init+0x31/0x3d0 [ 1367.835794] io_rsrc_node_switch_start.part.0+0x6a/0x250 [ 1367.836960] io_uring_setup+0x14f6/0x2980 [ 1367.837854] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1367.838949] ? wait_for_completion_io+0x270/0x270 [ 1367.839995] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1367.841137] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1367.842253] do_syscall_64+0x33/0x40 [ 1367.843057] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1367.844162] RIP: 0033:0x7f741addcb19 [ 1367.844967] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1367.848887] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1367.850508] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1367.852036] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1367.853556] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1367.855071] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1367.856598] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1367.869272] FAULT_INJECTION: forcing a failure. [ 1367.869272] name failslab, interval 1, probability 0, space 0, times 0 [ 1367.871860] CPU: 1 PID: 9190 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1367.873346] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1367.875128] Call Trace: [ 1367.875696] dump_stack+0x107/0x167 [ 1367.876487] should_fail.cold+0x5/0xa [ 1367.877319] ? create_object.isra.0+0x3a/0xa30 [ 1367.878301] should_failslab+0x5/0x20 [ 1367.879120] kmem_cache_alloc+0x5b/0x310 [ 1367.879999] create_object.isra.0+0x3a/0xa30 [ 1367.880956] kmemleak_alloc_percpu+0xa0/0x100 [ 1367.881925] pcpu_alloc+0x4e2/0x1240 [ 1367.882736] ? io_async_queue_proc+0x80/0x80 [ 1367.883685] percpu_ref_init+0x31/0x3d0 [ 1367.884539] io_rsrc_node_switch_start.part.0+0x6a/0x250 [ 1367.885710] io_uring_setup+0x14f6/0x2980 [ 1367.886603] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1367.887686] ? wait_for_completion_io+0x270/0x270 [ 1367.888748] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1367.889872] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1367.890979] do_syscall_64+0x33/0x40 [ 1367.891779] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1367.892879] RIP: 0033:0x7f43c90c3b19 [ 1367.893647] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 21:47:24 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x500) [ 1367.897599] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1367.899456] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1367.900989] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1367.902514] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1367.904042] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1367.905572] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:47:25 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x0, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:47:25 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x8) 21:47:25 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:47:25 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 19) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:47:25 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x500) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:47:25 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, 0x0, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) [ 1368.046635] FAULT_INJECTION: forcing a failure. [ 1368.046635] name failslab, interval 1, probability 0, space 0, times 0 [ 1368.048745] CPU: 0 PID: 9212 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1368.049941] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1368.051400] Call Trace: [ 1368.051871] dump_stack+0x107/0x167 [ 1368.052505] should_fail.cold+0x5/0xa [ 1368.053192] ? percpu_ref_init+0xd8/0x3d0 [ 1368.053926] should_failslab+0x5/0x20 [ 1368.054596] kmem_cache_alloc_trace+0x55/0x320 [ 1368.055387] ? io_async_queue_proc+0x80/0x80 [ 1368.056163] percpu_ref_init+0xd8/0x3d0 [ 1368.056871] io_rsrc_node_switch_start.part.0+0x6a/0x250 [ 1368.057786] io_uring_setup+0x14f6/0x2980 [ 1368.058513] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1368.059391] ? wait_for_completion_io+0x270/0x270 [ 1368.060261] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1368.061175] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1368.062075] do_syscall_64+0x33/0x40 [ 1368.062726] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1368.063604] RIP: 0033:0x7f741addcb19 [ 1368.064243] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1368.067420] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1368.068763] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1368.070008] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1368.071212] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1368.072423] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1368.073654] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:47:25 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x10) 21:47:25 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x0, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:47:25 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x600) 21:47:25 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 18) 21:47:25 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x600) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:47:25 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, 0x0, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:47:25 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x60) 21:47:25 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, 0x0, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) [ 1368.235362] FAULT_INJECTION: forcing a failure. [ 1368.235362] name failslab, interval 1, probability 0, space 0, times 0 [ 1368.237340] CPU: 0 PID: 9230 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1368.238397] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1368.239671] Call Trace: [ 1368.240080] dump_stack+0x107/0x167 [ 1368.240641] should_fail.cold+0x5/0xa [ 1368.241237] ? percpu_ref_init+0xd8/0x3d0 [ 1368.241868] should_failslab+0x5/0x20 [ 1368.242451] kmem_cache_alloc_trace+0x55/0x320 [ 1368.243155] ? io_async_queue_proc+0x80/0x80 [ 1368.243828] percpu_ref_init+0xd8/0x3d0 [ 1368.244427] io_rsrc_node_switch_start.part.0+0x6a/0x250 [ 1368.245261] io_uring_setup+0x14f6/0x2980 [ 1368.245880] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1368.246626] ? wait_for_completion_io+0x270/0x270 [ 1368.247360] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1368.248153] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1368.248918] do_syscall_64+0x33/0x40 [ 1368.249488] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1368.250272] RIP: 0033:0x7f43c90c3b19 [ 1368.250813] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1368.253540] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1368.254655] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1368.255708] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1368.256799] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1368.257876] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1368.258929] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:47:25 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1380.720355] FAULT_INJECTION: forcing a failure. [ 1380.720355] name failslab, interval 1, probability 0, space 0, times 0 21:47:37 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 20) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:47:37 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, 0x0, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:47:37 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x300) 21:47:37 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x700) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:47:37 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:47:37 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x700) 21:47:37 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 19) 21:47:37 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) [ 1380.721852] CPU: 1 PID: 9261 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1380.722878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1380.723850] Call Trace: [ 1380.724181] dump_stack+0x107/0x167 [ 1380.724633] should_fail.cold+0x5/0xa [ 1380.725103] ? create_object.isra.0+0x3a/0xa30 [ 1380.725645] should_failslab+0x5/0x20 [ 1380.726092] kmem_cache_alloc+0x5b/0x310 [ 1380.726573] create_object.isra.0+0x3a/0xa30 [ 1380.727086] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1380.727682] kmem_cache_alloc_trace+0x151/0x320 [ 1380.728229] ? io_async_queue_proc+0x80/0x80 [ 1380.728743] percpu_ref_init+0xd8/0x3d0 [ 1380.729244] io_rsrc_node_switch_start.part.0+0x6a/0x250 [ 1380.729879] io_uring_setup+0x14f6/0x2980 [ 1380.730369] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1380.730955] ? wait_for_completion_io+0x270/0x270 [ 1380.731531] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1380.731918] FAULT_INJECTION: forcing a failure. [ 1380.731918] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1380.732140] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1380.732154] do_syscall_64+0x33/0x40 [ 1380.732166] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1380.732174] RIP: 0033:0x7f43c90c3b19 [ 1380.732184] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1380.732190] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1380.732201] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1380.732207] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1380.732213] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1380.732219] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1380.732224] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1380.754265] CPU: 0 PID: 9266 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1380.755772] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1380.757503] Call Trace: [ 1380.758061] dump_stack+0x107/0x167 [ 1380.758817] should_fail.cold+0x5/0xa [ 1380.759617] _copy_to_user+0x2e/0x180 [ 1380.760412] io_uring_setup+0x11b5/0x2980 [ 1380.761305] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1380.762358] ? wait_for_completion_io+0x270/0x270 [ 1380.763391] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1380.764486] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1380.765577] do_syscall_64+0x33/0x40 [ 1380.766351] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1380.767425] RIP: 0033:0x7f741addcb19 [ 1380.768203] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1380.772044] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1380.773635] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1380.775124] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1380.776603] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1380.778110] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1380.779602] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:47:37 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x4000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:47:37 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 20) 21:47:37 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x500) 21:47:37 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:47:37 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x4000) 21:47:37 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, 0x0, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) [ 1380.887876] FAULT_INJECTION: forcing a failure. [ 1380.887876] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1380.890645] CPU: 0 PID: 9277 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1380.892080] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1380.893828] Call Trace: [ 1380.894386] dump_stack+0x107/0x167 [ 1380.895150] should_fail.cold+0x5/0xa [ 1380.895957] _copy_to_user+0x2e/0x180 [ 1380.896753] io_uring_setup+0x11b5/0x2980 [ 1380.897642] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1380.898697] ? wait_for_completion_io+0x270/0x270 [ 1380.899733] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1380.900890] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1380.901971] do_syscall_64+0x33/0x40 [ 1380.902755] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1380.903823] RIP: 0033:0x7f43c90c3b19 [ 1380.904603] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1380.904839] FAULT_INJECTION: forcing a failure. [ 1380.904839] name failslab, interval 1, probability 0, space 0, times 0 [ 1380.908467] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1380.908488] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1380.908505] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1380.914312] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1380.915807] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1380.917309] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:47:37 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 21) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) [ 1380.918834] CPU: 1 PID: 9282 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1380.919784] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1380.920749] Call Trace: [ 1380.921071] dump_stack+0x107/0x167 [ 1380.921490] should_fail.cold+0x5/0xa [ 1380.921932] ? __d_alloc+0x2a/0x990 [ 1380.922352] should_failslab+0x5/0x20 [ 1380.922788] kmem_cache_alloc+0x5b/0x310 [ 1380.923257] __d_alloc+0x2a/0x990 [ 1380.923656] ? find_held_lock+0x2c/0x110 [ 1380.924098] d_alloc_pseudo+0x19/0x70 [ 1380.924532] alloc_file_pseudo+0xce/0x250 [ 1380.924989] ? trace_hardirqs_on+0x5b/0x180 [ 1380.925480] ? alloc_file+0x5a0/0x5a0 [ 1380.925904] anon_inode_getfile+0xc8/0x1f0 [ 1380.926402] io_uring_setup+0x138b/0x2980 [ 1380.926854] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1380.927396] ? wait_for_completion_io+0x270/0x270 [ 1380.927923] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1380.928523] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1380.929090] do_syscall_64+0x33/0x40 [ 1380.929516] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1380.930069] RIP: 0033:0x7f741addcb19 [ 1380.930495] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1380.932453] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1380.933329] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1380.934139] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1380.934952] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1380.935764] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1380.936577] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:47:51 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 21) 21:47:51 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1394.574953] FAULT_INJECTION: forcing a failure. [ 1394.574953] name failslab, interval 1, probability 0, space 0, times 0 [ 1394.577946] CPU: 1 PID: 9293 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1394.579482] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 21:47:51 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 22) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:47:51 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) [ 1394.581360] Call Trace: [ 1394.582113] dump_stack+0x107/0x167 [ 1394.583089] should_fail.cold+0x5/0xa [ 1394.583946] ? __d_alloc+0x2a/0x990 [ 1394.584763] should_failslab+0x5/0x20 [ 1394.585651] kmem_cache_alloc+0x5b/0x310 [ 1394.586679] __d_alloc+0x2a/0x990 [ 1394.587567] ? find_held_lock+0x2c/0x110 [ 1394.588604] d_alloc_pseudo+0x19/0x70 21:47:51 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x6000) 21:47:51 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) [ 1394.589581] alloc_file_pseudo+0xce/0x250 [ 1394.590798] ? trace_hardirqs_on+0x5b/0x180 [ 1394.591895] ? alloc_file+0x5a0/0x5a0 [ 1394.592314] FAULT_INJECTION: forcing a failure. [ 1394.592314] name failslab, interval 1, probability 0, space 0, times 0 [ 1394.592891] anon_inode_getfile+0xc8/0x1f0 [ 1394.596342] io_uring_setup+0x138b/0x2980 [ 1394.597636] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1394.599170] ? wait_for_completion_io+0x270/0x270 [ 1394.600663] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1394.602277] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1394.603847] do_syscall_64+0x33/0x40 [ 1394.605002] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1394.606560] RIP: 0033:0x7f43c90c3b19 [ 1394.607697] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1394.613263] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1394.615556] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1394.617735] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1394.619893] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1394.622080] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1394.624245] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1394.626439] CPU: 0 PID: 9296 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1394.627772] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1394.629381] Call Trace: [ 1394.629894] dump_stack+0x107/0x167 [ 1394.630595] should_fail.cold+0x5/0xa [ 1394.631324] ? __d_alloc+0x2a/0x990 [ 1394.632035] should_failslab+0x5/0x20 [ 1394.632780] kmem_cache_alloc+0x5b/0x310 [ 1394.633605] __d_alloc+0x2a/0x990 [ 1394.634301] ? find_held_lock+0x2c/0x110 [ 1394.635117] d_alloc_pseudo+0x19/0x70 [ 1394.635880] alloc_file_pseudo+0xce/0x250 [ 1394.636702] ? trace_hardirqs_on+0x5b/0x180 [ 1394.637560] ? alloc_file+0x5a0/0x5a0 [ 1394.638336] anon_inode_getfile+0xc8/0x1f0 [ 1394.639192] io_uring_setup+0x138b/0x2980 [ 1394.640041] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1394.641055] ? wait_for_completion_io+0x270/0x270 [ 1394.642039] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1394.643090] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1394.644124] do_syscall_64+0x33/0x40 [ 1394.644877] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1394.645907] RIP: 0033:0x7f741addcb19 [ 1394.646641] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1394.650327] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1394.651843] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1394.653264] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1394.654698] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1394.656117] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1394.657538] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:47:51 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x6000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:47:51 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x600) 21:47:51 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r2, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r2, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r2, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r3) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:47:51 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x700) 21:48:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r2, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r2, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r2, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r3) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:48:05 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:48:05 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x4000) 21:48:05 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x400000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:48:05 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x400000) 21:48:05 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:48:05 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 23) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:48:05 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 22) [ 1408.150248] FAULT_INJECTION: forcing a failure. [ 1408.150248] name failslab, interval 1, probability 0, space 0, times 0 [ 1408.152875] CPU: 1 PID: 9337 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1408.153491] FAULT_INJECTION: forcing a failure. [ 1408.153491] name failslab, interval 1, probability 0, space 0, times 0 [ 1408.154400] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1408.154406] Call Trace: [ 1408.154432] dump_stack+0x107/0x167 [ 1408.154459] should_fail.cold+0x5/0xa [ 1408.154479] ? __alloc_file+0x21/0x320 [ 1408.154496] should_failslab+0x5/0x20 [ 1408.154522] kmem_cache_alloc+0x5b/0x310 [ 1408.163374] __alloc_file+0x21/0x320 [ 1408.164206] alloc_empty_file+0x6d/0x170 [ 1408.165120] alloc_file+0x5e/0x5a0 [ 1408.165921] alloc_file_pseudo+0x16a/0x250 [ 1408.166858] ? alloc_file+0x5a0/0x5a0 [ 1408.167734] anon_inode_getfile+0xc8/0x1f0 [ 1408.168681] io_uring_setup+0x138b/0x2980 [ 1408.169621] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1408.170741] ? wait_for_completion_io+0x270/0x270 [ 1408.171837] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1408.173004] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1408.174171] do_syscall_64+0x33/0x40 [ 1408.175000] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1408.176148] RIP: 0033:0x7f741addcb19 [ 1408.176974] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1408.181061] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1408.182762] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1408.184351] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1408.185957] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1408.187539] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1408.189144] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1408.190755] CPU: 0 PID: 9339 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1408.192196] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1408.193932] Call Trace: [ 1408.194494] dump_stack+0x107/0x167 [ 1408.195256] should_fail.cold+0x5/0xa [ 1408.196052] ? create_object.isra.0+0x3a/0xa30 [ 1408.196997] should_failslab+0x5/0x20 [ 1408.197803] kmem_cache_alloc+0x5b/0x310 [ 1408.198665] create_object.isra.0+0x3a/0xa30 [ 1408.199593] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1408.200660] kmem_cache_alloc+0x159/0x310 [ 1408.201543] __d_alloc+0x2a/0x990 [ 1408.202260] ? find_held_lock+0x2c/0x110 [ 1408.203111] d_alloc_pseudo+0x19/0x70 [ 1408.203902] alloc_file_pseudo+0xce/0x250 [ 1408.204764] ? trace_hardirqs_on+0x5b/0x180 [ 1408.205661] ? alloc_file+0x5a0/0x5a0 [ 1408.206477] anon_inode_getfile+0xc8/0x1f0 [ 1408.207362] io_uring_setup+0x138b/0x2980 [ 1408.208233] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1408.209291] ? wait_for_completion_io+0x270/0x270 [ 1408.210322] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1408.211406] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1408.212483] do_syscall_64+0x33/0x40 [ 1408.213271] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1408.214341] RIP: 0033:0x7f43c90c3b19 [ 1408.215111] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1408.218961] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1408.220548] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1408.222048] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1408.223534] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1408.225013] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1408.226504] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:48:05 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x600000) 21:48:05 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:48:05 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x6000) 21:48:05 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:48:05 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x800000) 21:48:05 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 24) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:48:05 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) [ 1408.421680] FAULT_INJECTION: forcing a failure. [ 1408.421680] name failslab, interval 1, probability 0, space 0, times 0 [ 1408.424242] CPU: 0 PID: 9357 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1408.425686] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1408.427417] Call Trace: [ 1408.427971] dump_stack+0x107/0x167 [ 1408.428739] should_fail.cold+0x5/0xa [ 1408.429546] ? create_object.isra.0+0x3a/0xa30 [ 1408.430496] should_failslab+0x5/0x20 [ 1408.431292] kmem_cache_alloc+0x5b/0x310 [ 1408.432143] create_object.isra.0+0x3a/0xa30 [ 1408.433061] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1408.434130] kmem_cache_alloc+0x159/0x310 [ 1408.435008] __alloc_file+0x21/0x320 [ 1408.435784] alloc_empty_file+0x6d/0x170 [ 1408.436628] alloc_file+0x5e/0x5a0 [ 1408.437378] alloc_file_pseudo+0x16a/0x250 [ 1408.438256] ? alloc_file+0x5a0/0x5a0 [ 1408.439066] anon_inode_getfile+0xc8/0x1f0 [ 1408.439953] io_uring_setup+0x138b/0x2980 [ 1408.440825] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1408.441886] ? wait_for_completion_io+0x270/0x270 [ 1408.442912] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1408.444016] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1408.445093] do_syscall_64+0x33/0x40 [ 1408.445926] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1408.446991] RIP: 0033:0x7f741addcb19 [ 1408.447771] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1408.451617] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1408.453207] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1408.454697] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1408.456177] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1408.457669] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1408.459159] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:48:05 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r2, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r2, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r2, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r3) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:48:05 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x600000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:48:20 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x80ffff) 21:48:20 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:48:20 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x800000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:48:20 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 23) 21:48:20 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:48:20 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(0xffffffffffffffff, r0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) 21:48:20 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 25) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:48:20 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x10004) [ 1423.038469] FAULT_INJECTION: forcing a failure. [ 1423.038469] name failslab, interval 1, probability 0, space 0, times 0 [ 1423.041698] CPU: 1 PID: 9384 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1423.043296] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1423.045133] Call Trace: [ 1423.045752] dump_stack+0x107/0x167 [ 1423.046566] should_fail.cold+0x5/0xa [ 1423.047421] ? security_file_alloc+0x34/0x170 [ 1423.048430] should_failslab+0x5/0x20 [ 1423.049283] kmem_cache_alloc+0x5b/0x310 [ 1423.050206] security_file_alloc+0x34/0x170 [ 1423.051176] __alloc_file+0xb7/0x320 [ 1423.052017] alloc_empty_file+0x6d/0x170 [ 1423.052929] alloc_file+0x5e/0x5a0 [ 1423.053734] alloc_file_pseudo+0x16a/0x250 [ 1423.054666] ? alloc_file+0x5a0/0x5a0 [ 1423.055522] anon_inode_getfile+0xc8/0x1f0 [ 1423.056465] io_uring_setup+0x138b/0x2980 [ 1423.057392] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1423.058512] ? wait_for_completion_io+0x270/0x270 [ 1423.059610] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1423.060765] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1423.061905] do_syscall_64+0x33/0x40 [ 1423.062719] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1423.063835] RIP: 0033:0x7f741addcb19 [ 1423.064656] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1423.068710] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1423.070455] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1423.072030] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1423.073595] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1423.075144] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1423.076716] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1423.083753] FAULT_INJECTION: forcing a failure. [ 1423.083753] name failslab, interval 1, probability 0, space 0, times 0 [ 1423.086423] CPU: 1 PID: 9385 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1423.088002] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1423.089829] Call Trace: [ 1423.090413] dump_stack+0x107/0x167 [ 1423.091223] should_fail.cold+0x5/0xa [ 1423.092044] ? __alloc_file+0x21/0x320 [ 1423.092907] should_failslab+0x5/0x20 [ 1423.093759] kmem_cache_alloc+0x5b/0x310 [ 1423.094664] __alloc_file+0x21/0x320 [ 1423.095507] alloc_empty_file+0x6d/0x170 [ 1423.096421] alloc_file+0x5e/0x5a0 [ 1423.097226] alloc_file_pseudo+0x16a/0x250 [ 1423.098168] ? alloc_file+0x5a0/0x5a0 [ 1423.099012] anon_inode_getfile+0xc8/0x1f0 [ 1423.099936] io_uring_setup+0x138b/0x2980 [ 1423.100883] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1423.102021] ? wait_for_completion_io+0x270/0x270 [ 1423.103101] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1423.104247] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1423.105390] do_syscall_64+0x33/0x40 [ 1423.106194] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1423.107311] RIP: 0033:0x7f43c90c3b19 [ 1423.108119] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1423.112172] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1423.113862] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1423.115428] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1423.116987] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1423.118607] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1423.120216] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:48:20 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:48:20 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x400000) 21:48:20 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x1000000) 21:48:20 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x80ffff) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:48:20 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(0xffffffffffffffff, r0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) 21:48:20 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:48:20 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 24) 21:48:20 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x600000) 21:48:20 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x1000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1423.380356] FAULT_INJECTION: forcing a failure. [ 1423.380356] name failslab, interval 1, probability 0, space 0, times 0 [ 1423.382854] CPU: 0 PID: 9415 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1423.384222] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1423.385893] Call Trace: [ 1423.386430] dump_stack+0x107/0x167 [ 1423.387166] should_fail.cold+0x5/0xa [ 1423.387933] ? create_object.isra.0+0x3a/0xa30 [ 1423.388860] should_failslab+0x5/0x20 [ 1423.389642] kmem_cache_alloc+0x5b/0x310 [ 1423.390466] create_object.isra.0+0x3a/0xa30 [ 1423.391348] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1423.392374] kmem_cache_alloc+0x159/0x310 [ 1423.393207] __alloc_file+0x21/0x320 [ 1423.393961] alloc_empty_file+0x6d/0x170 [ 1423.394772] alloc_file+0x5e/0x5a0 [ 1423.395481] alloc_file_pseudo+0x16a/0x250 [ 1423.396328] ? alloc_file+0x5a0/0x5a0 [ 1423.397110] anon_inode_getfile+0xc8/0x1f0 [ 1423.397977] io_uring_setup+0x138b/0x2980 [ 1423.398820] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1423.399837] ? wait_for_completion_io+0x270/0x270 [ 1423.400832] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1423.401898] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1423.402936] do_syscall_64+0x33/0x40 [ 1423.403683] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1423.404723] RIP: 0033:0x7f43c90c3b19 [ 1423.405477] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1423.409160] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1423.410690] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1423.412120] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1423.413556] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1423.414982] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1423.416412] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:48:35 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x2000000) 21:48:35 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 25) 21:48:35 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x800000) 21:48:35 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x2000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:48:35 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:48:35 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(0xffffffffffffffff, r0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) 21:48:35 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(0xffffffffffffffff, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:48:35 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 26) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:48:35 executing program 4: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r0, 0xffffffffffffffff) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) [ 1438.859621] FAULT_INJECTION: forcing a failure. [ 1438.859621] name failslab, interval 1, probability 0, space 0, times 0 [ 1438.861196] CPU: 1 PID: 9436 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1438.862058] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1438.863064] Call Trace: [ 1438.863398] dump_stack+0x107/0x167 [ 1438.863845] should_fail.cold+0x5/0xa [ 1438.864314] ? create_object.isra.0+0x3a/0xa30 [ 1438.864870] should_failslab+0x5/0x20 [ 1438.865338] kmem_cache_alloc+0x5b/0x310 [ 1438.865836] ? percpu_ref_put_many.constprop.0+0x4e/0x110 [ 1438.866499] create_object.isra.0+0x3a/0xa30 [ 1438.867029] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1438.867651] kmem_cache_alloc+0x159/0x310 [ 1438.868159] security_file_alloc+0x34/0x170 [ 1438.868680] __alloc_file+0xb7/0x320 [ 1438.869142] alloc_empty_file+0x6d/0x170 [ 1438.869648] alloc_file+0x5e/0x5a0 [ 1438.870084] alloc_file_pseudo+0x16a/0x250 [ 1438.870601] ? alloc_file+0x5a0/0x5a0 [ 1438.871073] anon_inode_getfile+0xc8/0x1f0 [ 1438.871591] io_uring_setup+0x138b/0x2980 [ 1438.872100] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1438.872713] ? wait_for_completion_io+0x270/0x270 [ 1438.873312] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1438.873953] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1438.874581] do_syscall_64+0x33/0x40 [ 1438.875033] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1438.875655] RIP: 0033:0x7f741addcb19 [ 1438.876106] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1438.878391] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1438.879411] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1438.880326] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1438.881209] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1438.881234] FAULT_INJECTION: forcing a failure. [ 1438.881234] name failslab, interval 1, probability 0, space 0, times 0 [ 1438.883467] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1438.884346] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1438.885239] CPU: 0 PID: 9439 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1438.886880] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1438.888695] Call Trace: [ 1438.889288] dump_stack+0x107/0x167 [ 1438.890112] should_fail.cold+0x5/0xa [ 1438.890962] ? security_file_alloc+0x34/0x170 [ 1438.891956] should_failslab+0x5/0x20 [ 1438.892777] kmem_cache_alloc+0x5b/0x310 [ 1438.893663] security_file_alloc+0x34/0x170 [ 1438.894581] __alloc_file+0xb7/0x320 [ 1438.895374] alloc_empty_file+0x6d/0x170 [ 1438.896235] alloc_file+0x5e/0x5a0 [ 1438.896988] alloc_file_pseudo+0x16a/0x250 [ 1438.897903] ? alloc_file+0x5a0/0x5a0 [ 1438.898714] anon_inode_getfile+0xc8/0x1f0 [ 1438.899610] io_uring_setup+0x138b/0x2980 [ 1438.900484] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1438.901567] ? wait_for_completion_io+0x270/0x270 [ 1438.902611] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1438.903720] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1438.904804] do_syscall_64+0x33/0x40 [ 1438.905599] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1438.906671] RIP: 0033:0x7f43c90c3b19 [ 1438.907453] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1438.911356] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1438.912962] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1438.914478] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1438.915979] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1438.917503] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1438.919013] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:48:36 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(0xffffffffffffffff, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:48:36 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 27) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:48:36 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x80ffff) [ 1439.005448] FAULT_INJECTION: forcing a failure. [ 1439.005448] name failslab, interval 1, probability 0, space 0, times 0 [ 1439.006803] CPU: 1 PID: 9451 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1439.007547] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1439.008442] Call Trace: [ 1439.008735] dump_stack+0x107/0x167 [ 1439.009131] should_fail.cold+0x5/0xa [ 1439.009557] ? io_uring_alloc_task_context+0x99/0x6a0 [ 1439.010152] should_failslab+0x5/0x20 [ 1439.010597] kmem_cache_alloc_trace+0x55/0x320 [ 1439.011096] io_uring_alloc_task_context+0x99/0x6a0 [ 1439.011637] ? io_import_iovec+0x1120/0x1120 [ 1439.012157] ? lock_downgrade+0x6d0/0x6d0 [ 1439.012610] ? do_raw_spin_lock+0x121/0x260 [ 1439.013112] ? rwlock_bug.part.0+0x90/0x90 [ 1439.013611] __io_uring_add_tctx_node+0x2c6/0x520 [ 1439.014131] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1439.014696] ? alloc_fd+0x2e7/0x670 [ 1439.015092] io_uring_setup+0x1fbb/0x2980 [ 1439.015541] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1439.016085] ? wait_for_completion_io+0x270/0x270 [ 1439.016616] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1439.017181] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1439.017740] do_syscall_64+0x33/0x40 [ 1439.018170] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1439.018720] RIP: 0033:0x7f741addcb19 [ 1439.019117] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1439.021081] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1439.021899] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1439.022661] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1439.023426] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1439.024191] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1439.024952] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:48:36 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x3000000) 21:48:36 executing program 4: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r0, 0xffffffffffffffff) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) [ 1454.516950] FAULT_INJECTION: forcing a failure. [ 1454.516950] name failslab, interval 1, probability 0, space 0, times 0 [ 1454.519700] CPU: 0 PID: 9468 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1454.521146] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1454.522910] Call Trace: [ 1454.523470] dump_stack+0x107/0x167 [ 1454.524247] should_fail.cold+0x5/0xa [ 1454.525054] ? create_object.isra.0+0x3a/0xa30 [ 1454.526034] should_failslab+0x5/0x20 [ 1454.526839] kmem_cache_alloc+0x5b/0x310 [ 1454.527698] create_object.isra.0+0x3a/0xa30 [ 1454.528618] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1454.529698] kmem_cache_alloc_trace+0x151/0x320 [ 1454.530681] io_uring_alloc_task_context+0x99/0x6a0 [ 1454.531733] ? io_import_iovec+0x1120/0x1120 [ 1454.532663] ? lock_downgrade+0x6d0/0x6d0 [ 1454.533523] ? do_raw_spin_lock+0x121/0x260 [ 1454.534441] ? rwlock_bug.part.0+0x90/0x90 [ 1454.535335] __io_uring_add_tctx_node+0x2c6/0x520 [ 1454.536348] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1454.537449] ? alloc_fd+0x2e7/0x670 [ 1454.538232] io_uring_setup+0x1fbb/0x2980 [ 1454.539368] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1454.540437] ? wait_for_completion_io+0x270/0x270 [ 1454.541467] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1454.542584] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1454.543672] do_syscall_64+0x33/0x40 [ 1454.544461] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1454.545535] RIP: 0033:0x7f741addcb19 [ 1454.546329] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1454.550151] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1454.551201] FAULT_INJECTION: forcing a failure. [ 1454.551201] name failslab, interval 1, probability 0, space 0, times 0 [ 1454.551753] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1454.551764] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1454.551774] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1454.551785] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1454.551805] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1454.561792] CPU: 1 PID: 9478 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1454.563370] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1454.565231] Call Trace: [ 1454.565847] dump_stack+0x107/0x167 [ 1454.566678] should_fail.cold+0x5/0xa [ 1454.567534] ? create_object.isra.0+0x3a/0xa30 [ 1454.568555] should_failslab+0x5/0x20 21:48:51 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x4000000) 21:48:51 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(0xffffffffffffffff, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:48:51 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 26) 21:48:51 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:48:51 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x3000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:48:51 executing program 4: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r0, 0xffffffffffffffff) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) 21:48:51 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x1000000) 21:48:51 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 28) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) [ 1454.569436] kmem_cache_alloc+0x5b/0x310 [ 1454.570626] ? percpu_ref_put_many.constprop.0+0x4e/0x110 [ 1454.571914] create_object.isra.0+0x3a/0xa30 [ 1454.572893] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1454.574042] kmem_cache_alloc+0x159/0x310 [ 1454.574989] security_file_alloc+0x34/0x170 [ 1454.575951] __alloc_file+0xb7/0x320 [ 1454.576780] alloc_empty_file+0x6d/0x170 [ 1454.577696] alloc_file+0x5e/0x5a0 [ 1454.578492] alloc_file_pseudo+0x16a/0x250 [ 1454.579436] ? alloc_file+0x5a0/0x5a0 [ 1454.580307] anon_inode_getfile+0xc8/0x1f0 [ 1454.581261] io_uring_setup+0x138b/0x2980 [ 1454.582203] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1454.583340] ? wait_for_completion_io+0x270/0x270 [ 1454.584443] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1454.585641] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1454.586805] do_syscall_64+0x33/0x40 [ 1454.587647] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1454.588799] RIP: 0033:0x7f43c90c3b19 [ 1454.589641] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1454.593766] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1454.595468] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1454.597084] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1454.598700] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1454.600296] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1454.601907] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:48:51 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r0, 0xffffffffffffffff) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:48:51 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x2000000) 21:48:51 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x5000000) 21:48:51 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x4000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:48:51 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x0, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:48:51 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 27) 21:48:51 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 29) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:48:51 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00'}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r2, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r2, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r2, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r3) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:48:51 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x6000000) 21:48:51 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x3000000) 21:48:51 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x0, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) [ 1454.877586] FAULT_INJECTION: forcing a failure. [ 1454.877586] name failslab, interval 1, probability 0, space 0, times 0 [ 1454.880296] CPU: 0 PID: 9501 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1454.881794] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1454.883593] Call Trace: [ 1454.884168] dump_stack+0x107/0x167 [ 1454.884960] should_fail.cold+0x5/0xa [ 1454.885795] ? io_uring_alloc_task_context+0x99/0x6a0 [ 1454.886909] should_failslab+0x5/0x20 [ 1454.887738] kmem_cache_alloc_trace+0x55/0x320 [ 1454.888724] io_uring_alloc_task_context+0x99/0x6a0 [ 1454.889805] ? io_import_iovec+0x1120/0x1120 [ 1454.890757] ? lock_downgrade+0x6d0/0x6d0 [ 1454.891649] ? do_raw_spin_lock+0x121/0x260 [ 1454.892553] ? rwlock_bug.part.0+0x90/0x90 [ 1454.893469] __io_uring_add_tctx_node+0x2c6/0x520 [ 1454.894489] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1454.895632] ? alloc_fd+0x2e7/0x670 [ 1454.896433] io_uring_setup+0x1fbb/0x2980 [ 1454.897350] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1454.898459] ? wait_for_completion_io+0x270/0x270 [ 1454.899527] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1454.900665] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1454.901793] do_syscall_64+0x33/0x40 [ 1454.902598] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1454.903716] RIP: 0033:0x7f43c90c3b19 [ 1454.904520] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1454.908506] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1454.910112] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1454.911618] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1454.913120] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1454.914632] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1454.916131] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1454.922364] FAULT_INJECTION: forcing a failure. [ 1454.922364] name failslab, interval 1, probability 0, space 0, times 0 [ 1454.925252] CPU: 0 PID: 9503 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1454.926749] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1454.928541] Call Trace: [ 1454.929109] dump_stack+0x107/0x167 [ 1454.929907] should_fail.cold+0x5/0xa [ 1454.930731] ? create_object.isra.0+0x3a/0xa30 [ 1454.931715] should_failslab+0x5/0x20 [ 1454.932538] kmem_cache_alloc+0x5b/0x310 [ 1454.933421] create_object.isra.0+0x3a/0xa30 [ 1454.934390] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1454.935496] kmem_cache_alloc_trace+0x151/0x320 [ 1454.936512] io_uring_alloc_task_context+0x99/0x6a0 [ 1454.937608] ? io_import_iovec+0x1120/0x1120 [ 1454.938566] ? lock_downgrade+0x6d0/0x6d0 [ 1454.939466] ? do_raw_spin_lock+0x121/0x260 [ 1454.940410] ? rwlock_bug.part.0+0x90/0x90 [ 1454.941338] __io_uring_add_tctx_node+0x2c6/0x520 [ 1454.942399] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1454.943537] ? alloc_fd+0x2e7/0x670 [ 1454.944339] io_uring_setup+0x1fbb/0x2980 [ 1454.945249] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1454.946351] ? wait_for_completion_io+0x270/0x270 [ 1454.947410] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1454.948549] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1454.949674] do_syscall_64+0x33/0x40 [ 1454.950479] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1454.951586] RIP: 0033:0x7f741addcb19 [ 1454.952387] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1454.956386] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1454.958040] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1454.959576] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1454.961075] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1454.962587] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1454.964085] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:49:06 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 30) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:49:06 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 28) 21:49:06 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x4000000) 21:49:06 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r0, 0xffffffffffffffff) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:49:06 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x0, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:49:06 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x7000000) 21:49:06 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00'}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r2, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r2, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r2, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r3) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:49:06 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x5000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:49:06 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x4000100) [ 1469.019799] FAULT_INJECTION: forcing a failure. [ 1469.019799] name failslab, interval 1, probability 0, space 0, times 0 [ 1469.022903] CPU: 0 PID: 9528 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1469.024624] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1469.026735] Call Trace: 21:49:06 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x6000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1469.027412] dump_stack+0x107/0x167 [ 1469.028483] should_fail.cold+0x5/0xa [ 1469.029448] ? create_object.isra.0+0x3a/0xa30 [ 1469.030604] should_failslab+0x5/0x20 [ 1469.031454] kmem_cache_alloc+0x5b/0x310 [ 1469.032316] create_object.isra.0+0x3a/0xa30 [ 1469.033245] kmemleak_alloc_percpu+0xa0/0x100 [ 1469.034197] pcpu_alloc+0x4e2/0x1240 [ 1469.035000] __percpu_counter_init+0x10d/0x2d0 [ 1469.035970] io_uring_alloc_task_context+0xcc/0x6a0 [ 1469.037017] ? io_import_iovec+0x1120/0x1120 [ 1469.037956] ? lock_downgrade+0x6d0/0x6d0 [ 1469.038818] ? do_raw_spin_lock+0x121/0x260 [ 1469.039726] ? rwlock_bug.part.0+0x90/0x90 [ 1469.040628] __io_uring_add_tctx_node+0x2c6/0x520 [ 1469.041636] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1469.042731] ? alloc_fd+0x2e7/0x670 [ 1469.043498] io_uring_setup+0x1fbb/0x2980 [ 1469.044353] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1469.045408] ? wait_for_completion_io+0x270/0x270 [ 1469.046430] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1469.047534] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1469.048598] do_syscall_64+0x33/0x40 [ 1469.049381] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1469.050445] RIP: 0033:0x7f741addcb19 [ 1469.051219] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1469.055061] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1469.056627] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1469.058129] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1469.059622] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1469.061111] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1469.062613] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1469.084589] FAULT_INJECTION: forcing a failure. [ 1469.084589] name failslab, interval 1, probability 0, space 0, times 0 [ 1469.087200] CPU: 0 PID: 9546 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1469.088636] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1469.090386] Call Trace: [ 1469.090943] dump_stack+0x107/0x167 [ 1469.091710] should_fail.cold+0x5/0xa [ 1469.092515] ? create_object.isra.0+0x3a/0xa30 21:49:06 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x7000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1469.093471] should_failslab+0x5/0x20 [ 1469.094421] kmem_cache_alloc+0x5b/0x310 [ 1469.095280] create_object.isra.0+0x3a/0xa30 [ 1469.096212] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1469.097276] kmem_cache_alloc_trace+0x151/0x320 [ 1469.098287] io_uring_alloc_task_context+0x99/0x6a0 [ 1469.099335] ? io_import_iovec+0x1120/0x1120 [ 1469.100254] ? lock_downgrade+0x6d0/0x6d0 [ 1469.101123] ? do_raw_spin_lock+0x121/0x260 [ 1469.102033] ? rwlock_bug.part.0+0x90/0x90 [ 1469.102933] __io_uring_add_tctx_node+0x2c6/0x520 [ 1469.103957] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1469.105071] ? alloc_fd+0x2e7/0x670 [ 1469.105852] io_uring_setup+0x1fbb/0x2980 [ 1469.106731] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1469.107809] ? wait_for_completion_io+0x270/0x270 [ 1469.108844] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1469.109976] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1469.111064] do_syscall_64+0x33/0x40 [ 1469.111850] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1469.112951] RIP: 0033:0x7f43c90c3b19 [ 1469.113746] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1469.117624] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1469.119268] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1469.120794] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1469.122294] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1469.123788] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1469.125285] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:49:18 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x5000000) 21:49:18 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 29) 21:49:18 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x8000000) [ 1481.060281] FAULT_INJECTION: forcing a failure. [ 1481.060281] name failslab, interval 1, probability 0, space 0, times 0 21:49:18 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, 0x0, &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) [ 1481.062957] CPU: 0 PID: 9560 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1481.064482] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1481.066218] Call Trace: [ 1481.066823] dump_stack+0x107/0x167 [ 1481.067742] should_fail.cold+0x5/0xa 21:49:18 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x8000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1481.068704] ? create_object.isra.0+0x3a/0xa30 [ 1481.069908] should_failslab+0x5/0x20 [ 1481.070869] kmem_cache_alloc+0x5b/0x310 [ 1481.071904] create_object.isra.0+0x3a/0xa30 [ 1481.073004] kmemleak_alloc_percpu+0xa0/0x100 [ 1481.074156] pcpu_alloc+0x4e2/0x1240 [ 1481.075114] __percpu_counter_init+0x10d/0x2d0 [ 1481.076269] io_uring_alloc_task_context+0xcc/0x6a0 [ 1481.077525] ? io_import_iovec+0x1120/0x1120 [ 1481.078635] ? lock_downgrade+0x6d0/0x6d0 [ 1481.079679] ? do_raw_spin_lock+0x121/0x260 [ 1481.080775] ? rwlock_bug.part.0+0x90/0x90 [ 1481.081850] __io_uring_add_tctx_node+0x2c6/0x520 21:49:18 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r0, 0xffffffffffffffff) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) [ 1481.083063] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1481.084427] ? alloc_fd+0x2e7/0x670 [ 1481.085347] io_uring_setup+0x1fbb/0x2980 [ 1481.086425] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1481.087712] ? wait_for_completion_io+0x270/0x270 [ 1481.088960] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1481.090304] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1481.091622] do_syscall_64+0x33/0x40 [ 1481.092567] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1481.093872] RIP: 0033:0x7f43c90c3b19 [ 1481.094814] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1481.099449] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1481.101394] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1481.103258] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1481.105110] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1481.106967] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1481.108817] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:49:18 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00'}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r2, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r2, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r2, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r3) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:49:18 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 31) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:49:18 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x6000000) [ 1481.125383] FAULT_INJECTION: forcing a failure. [ 1481.125383] name failslab, interval 1, probability 0, space 0, times 0 [ 1481.128270] CPU: 0 PID: 9572 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1481.129723] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1481.131499] Call Trace: [ 1481.132062] dump_stack+0x107/0x167 [ 1481.132840] should_fail.cold+0x5/0xa [ 1481.133651] ? io_uring_alloc_task_context+0x4a3/0x6a0 [ 1481.134772] should_failslab+0x5/0x20 [ 1481.135581] kmem_cache_alloc_trace+0x55/0x320 [ 1481.136563] io_uring_alloc_task_context+0x4a3/0x6a0 [ 1481.137637] ? io_import_iovec+0x1120/0x1120 [ 1481.138587] ? lock_downgrade+0x6d0/0x6d0 [ 1481.139474] ? do_raw_spin_lock+0x121/0x260 [ 1481.140389] ? rwlock_bug.part.0+0x90/0x90 [ 1481.141297] __io_uring_add_tctx_node+0x2c6/0x520 [ 1481.142328] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1481.143446] ? alloc_fd+0x2e7/0x670 [ 1481.144225] io_uring_setup+0x1fbb/0x2980 [ 1481.145110] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1481.146194] ? wait_for_completion_io+0x270/0x270 [ 1481.147239] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1481.148343] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1481.149432] do_syscall_64+0x33/0x40 [ 1481.150229] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1481.151314] RIP: 0033:0x7f741addcb19 [ 1481.152098] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1481.155983] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 21:49:18 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00'}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r2, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r2, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r2, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r3) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1481.157583] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1481.159213] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1481.160711] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1481.162222] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1481.163716] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:49:18 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x7000000) 21:49:18 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 30) 21:49:18 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x10000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:49:18 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, 0x0, &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:49:18 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x0, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) [ 1481.270339] FAULT_INJECTION: forcing a failure. [ 1481.270339] name failslab, interval 1, probability 0, space 0, times 0 [ 1481.271825] CPU: 1 PID: 9592 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1481.272689] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1481.273732] Call Trace: [ 1481.274080] dump_stack+0x107/0x167 [ 1481.274540] should_fail.cold+0x5/0xa [ 1481.275021] ? create_object.isra.0+0x3a/0xa30 [ 1481.275598] should_failslab+0x5/0x20 [ 1481.276078] kmem_cache_alloc+0x5b/0x310 [ 1481.276595] create_object.isra.0+0x3a/0xa30 [ 1481.277148] kmemleak_alloc_percpu+0xa0/0x100 [ 1481.277719] pcpu_alloc+0x4e2/0x1240 [ 1481.278208] __percpu_counter_init+0x10d/0x2d0 [ 1481.278789] io_uring_alloc_task_context+0xcc/0x6a0 [ 1481.279419] ? io_import_iovec+0x1120/0x1120 [ 1481.279980] ? lock_downgrade+0x6d0/0x6d0 [ 1481.280500] ? do_raw_spin_lock+0x121/0x260 [ 1481.281044] ? rwlock_bug.part.0+0x90/0x90 [ 1481.281573] __io_uring_add_tctx_node+0x2c6/0x520 [ 1481.282222] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1481.282875] ? alloc_fd+0x2e7/0x670 [ 1481.283336] io_uring_setup+0x1fbb/0x2980 [ 1481.283855] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1481.284485] ? wait_for_completion_io+0x270/0x270 [ 1481.285096] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1481.285747] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1481.286402] do_syscall_64+0x33/0x40 [ 1481.286872] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1481.287510] RIP: 0033:0x7f43c90c3b19 [ 1481.287973] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1481.290266] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1481.291222] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1481.292113] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1481.293002] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1481.293898] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1481.294781] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:49:18 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 32) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:49:18 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x10000000) 21:49:18 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x0, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:49:18 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x8000000) [ 1481.357606] FAULT_INJECTION: forcing a failure. [ 1481.357606] name failslab, interval 1, probability 0, space 0, times 0 [ 1481.359162] CPU: 1 PID: 9597 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1481.359994] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1481.360992] Call Trace: [ 1481.361315] dump_stack+0x107/0x167 [ 1481.361757] should_fail.cold+0x5/0xa [ 1481.362235] ? create_object.isra.0+0x3a/0xa30 [ 1481.362788] should_failslab+0x5/0x20 [ 1481.363250] kmem_cache_alloc+0x5b/0x310 [ 1481.363748] create_object.isra.0+0x3a/0xa30 [ 1481.364281] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1481.364897] kmem_cache_alloc_trace+0x151/0x320 [ 1481.365466] io_uring_alloc_task_context+0x4a3/0x6a0 [ 1481.366091] ? io_import_iovec+0x1120/0x1120 [ 1481.366624] ? lock_downgrade+0x6d0/0x6d0 [ 1481.367125] ? do_raw_spin_lock+0x121/0x260 [ 1481.367642] ? rwlock_bug.part.0+0x90/0x90 [ 1481.368157] __io_uring_add_tctx_node+0x2c6/0x520 [ 1481.368740] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1481.369375] ? alloc_fd+0x2e7/0x670 [ 1481.369830] io_uring_setup+0x1fbb/0x2980 [ 1481.370337] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1481.370952] ? wait_for_completion_io+0x270/0x270 [ 1481.371546] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1481.372182] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1481.372807] do_syscall_64+0x33/0x40 [ 1481.373257] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1481.373885] RIP: 0033:0x7f741addcb19 [ 1481.374334] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1481.376537] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1481.377448] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1481.378310] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1481.379162] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1481.380014] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1481.380941] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:49:30 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x40000000) 21:49:30 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, 0x0, &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:49:30 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x10000000) 21:49:30 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00'}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r2, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r2, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r2, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r3) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:49:30 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x40000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:49:30 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x0, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:49:30 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 33) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:49:30 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 31) 21:49:30 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x40000000) [ 1493.684210] FAULT_INJECTION: forcing a failure. [ 1493.684210] name failslab, interval 1, probability 0, space 0, times 0 [ 1493.685645] CPU: 0 PID: 9632 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1493.686493] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1493.687523] Call Trace: [ 1493.687850] dump_stack+0x107/0x167 [ 1493.688297] should_fail.cold+0x5/0xa [ 1493.688767] ? io_wq_create+0xeb/0xc00 [ 1493.689248] should_failslab+0x5/0x20 [ 1493.689714] __kmalloc+0x72/0x390 [ 1493.690152] io_wq_create+0xeb/0xc00 [ 1493.690615] io_uring_alloc_task_context+0x1f1/0x6a0 [ 1493.691157] FAULT_INJECTION: forcing a failure. [ 1493.691157] name failslab, interval 1, probability 0, space 0, times 0 [ 1493.691248] ? io_import_iovec+0x1120/0x1120 [ 1493.694296] ? io_apoll_task_func+0x2d0/0x2d0 [ 1493.694836] ? __io_req_find_next+0x300/0x300 [ 1493.695386] ? do_raw_spin_lock+0x121/0x260 [ 1493.695902] ? rwlock_bug.part.0+0x90/0x90 [ 1493.696418] __io_uring_add_tctx_node+0x2c6/0x520 [ 1493.696998] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1493.697632] ? alloc_fd+0x2e7/0x670 [ 1493.698086] io_uring_setup+0x1fbb/0x2980 [ 1493.698589] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1493.699204] ? wait_for_completion_io+0x270/0x270 [ 1493.699803] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1493.700437] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1493.701064] do_syscall_64+0x33/0x40 [ 1493.701517] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1493.702145] RIP: 0033:0x7f741addcb19 [ 1493.702610] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1493.704836] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1493.705770] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1493.706645] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1493.707511] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1493.708369] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1493.709232] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1493.710138] CPU: 1 PID: 9634 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1493.711710] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1493.713595] Call Trace: [ 1493.714208] dump_stack+0x107/0x167 [ 1493.715040] should_fail.cold+0x5/0xa [ 1493.716109] ? io_uring_alloc_task_context+0x4a3/0x6a0 [ 1493.717299] should_failslab+0x5/0x20 [ 1493.718174] kmem_cache_alloc_trace+0x55/0x320 [ 1493.719219] io_uring_alloc_task_context+0x4a3/0x6a0 [ 1493.720369] ? io_import_iovec+0x1120/0x1120 [ 1493.721363] ? lock_downgrade+0x6d0/0x6d0 [ 1493.722311] ? do_raw_spin_lock+0x121/0x260 [ 1493.723283] ? rwlock_bug.part.0+0x90/0x90 [ 1493.724248] __io_uring_add_tctx_node+0x2c6/0x520 [ 1493.725338] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1493.726531] ? alloc_fd+0x2e7/0x670 [ 1493.727364] io_uring_setup+0x1fbb/0x2980 [ 1493.728313] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1493.729453] ? wait_for_completion_io+0x270/0x270 [ 1493.730580] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1493.731766] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1493.732939] do_syscall_64+0x33/0x40 [ 1493.733783] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1493.734951] RIP: 0033:0x7f43c90c3b19 [ 1493.735794] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1493.739973] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1493.741693] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1493.743317] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1493.744941] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1493.746565] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1493.748179] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:49:30 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, 0x0, &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:49:30 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x49c03fff) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:49:30 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x47700fff) 21:49:30 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, 0x0, &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) 21:49:30 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:49:30 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 34) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:49:30 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x49803fff) [ 1493.871719] FAULT_INJECTION: forcing a failure. [ 1493.871719] name failslab, interval 1, probability 0, space 0, times 0 [ 1493.873213] CPU: 0 PID: 9651 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1493.874007] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1493.874956] Call Trace: [ 1493.875262] dump_stack+0x107/0x167 [ 1493.875680] should_fail.cold+0x5/0xa [ 1493.876122] ? io_wq_create+0xeb/0xc00 [ 1493.876570] should_failslab+0x5/0x20 [ 1493.877012] __kmalloc+0x72/0x390 [ 1493.877415] io_wq_create+0xeb/0xc00 [ 1493.877848] io_uring_alloc_task_context+0x1f1/0x6a0 [ 1493.878436] ? io_import_iovec+0x1120/0x1120 [ 1493.878942] ? io_apoll_task_func+0x2d0/0x2d0 [ 1493.879452] ? __io_req_find_next+0x300/0x300 [ 1493.879970] ? do_raw_spin_lock+0x121/0x260 [ 1493.880461] ? rwlock_bug.part.0+0x90/0x90 [ 1493.880952] __io_uring_add_tctx_node+0x2c6/0x520 [ 1493.881507] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1493.882116] ? alloc_fd+0x2e7/0x670 [ 1493.882535] io_uring_setup+0x1fbb/0x2980 [ 1493.883016] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1493.883599] ? wait_for_completion_io+0x270/0x270 [ 1493.884170] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1493.884775] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1493.885371] do_syscall_64+0x33/0x40 [ 1493.885804] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1493.886400] RIP: 0033:0x7f741addcb19 [ 1493.886827] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1493.888935] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1493.889812] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1493.890634] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1493.891449] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1493.892265] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1493.893087] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:49:30 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 32) 21:49:31 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:49:31 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00'}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r2, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r2, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r2, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r3) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:49:31 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x49f00fff) 21:49:31 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x47703fff) [ 1493.973345] FAULT_INJECTION: forcing a failure. [ 1493.973345] name failslab, interval 1, probability 0, space 0, times 0 [ 1493.976229] CPU: 1 PID: 9663 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1493.977729] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1493.979552] Call Trace: [ 1493.980140] dump_stack+0x107/0x167 [ 1493.980948] should_fail.cold+0x5/0xa [ 1493.981783] ? create_object.isra.0+0x3a/0xa30 [ 1493.982793] should_failslab+0x5/0x20 [ 1493.983637] kmem_cache_alloc+0x5b/0x310 [ 1493.984531] create_object.isra.0+0x3a/0xa30 [ 1493.985482] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1493.986598] kmem_cache_alloc_trace+0x151/0x320 [ 1493.987644] io_uring_alloc_task_context+0x4a3/0x6a0 [ 1493.988753] ? io_import_iovec+0x1120/0x1120 [ 1493.989694] ? lock_downgrade+0x6d0/0x6d0 [ 1493.990605] ? do_raw_spin_lock+0x121/0x260 [ 1493.991563] ? rwlock_bug.part.0+0x90/0x90 [ 1493.992507] __io_uring_add_tctx_node+0x2c6/0x520 [ 1493.993581] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1493.994714] ? alloc_fd+0x2e7/0x670 [ 1493.995522] io_uring_setup+0x1fbb/0x2980 [ 1493.996446] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1493.997546] ? wait_for_completion_io+0x270/0x270 [ 1493.998633] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1493.999805] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1494.000965] do_syscall_64+0x33/0x40 [ 1494.001759] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1494.002902] RIP: 0033:0x7f43c90c3b19 [ 1494.003740] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1494.007878] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1494.009584] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1494.011132] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1494.012747] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1494.014317] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1494.015927] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:49:44 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:49:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:49:44 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 33) 21:49:44 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 35) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:49:44 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x49f03fff) 21:49:44 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x49e03fff) 21:49:44 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, 0x0, &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) [ 1507.173869] FAULT_INJECTION: forcing a failure. [ 1507.173869] name failslab, interval 1, probability 0, space 0, times 0 [ 1507.176529] CPU: 1 PID: 9682 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1507.178008] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1507.179815] Call Trace: [ 1507.180392] dump_stack+0x107/0x167 [ 1507.181184] should_fail.cold+0x5/0xa [ 1507.182015] ? io_wq_create+0xeb/0xc00 [ 1507.182861] should_failslab+0x5/0x20 [ 1507.183681] __kmalloc+0x72/0x390 [ 1507.184440] io_wq_create+0xeb/0xc00 [ 1507.185256] io_uring_alloc_task_context+0x1f1/0x6a0 [ 1507.186367] ? io_import_iovec+0x1120/0x1120 [ 1507.187328] ? io_apoll_task_func+0x2d0/0x2d0 [ 1507.188297] ? __io_req_find_next+0x300/0x300 [ 1507.189260] ? do_raw_spin_lock+0x121/0x260 [ 1507.190204] ? rwlock_bug.part.0+0x90/0x90 [ 1507.191125] __io_uring_add_tctx_node+0x2c6/0x520 [ 1507.192171] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1507.193309] ? alloc_fd+0x2e7/0x670 [ 1507.194121] io_uring_setup+0x1fbb/0x2980 [ 1507.195029] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1507.196129] ? wait_for_completion_io+0x270/0x270 [ 1507.197193] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1507.198336] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1507.199453] do_syscall_64+0x33/0x40 [ 1507.200259] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1507.201367] RIP: 0033:0x7f43c90c3b19 [ 1507.202180] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1507.206193] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1507.207844] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1507.209391] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1507.210935] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1507.212474] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1507.214017] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1507.218284] FAULT_INJECTION: forcing a failure. [ 1507.218284] name failslab, interval 1, probability 0, space 0, times 0 [ 1507.221339] CPU: 0 PID: 9684 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1507.222334] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1507.223516] Call Trace: [ 1507.223902] dump_stack+0x107/0x167 [ 1507.224424] should_fail.cold+0x5/0xa [ 1507.224974] ? io_wq_create+0x6ef/0xc00 [ 1507.225552] should_failslab+0x5/0x20 [ 1507.226111] kmem_cache_alloc_node_trace+0x59/0x340 [ 1507.226830] io_wq_create+0x6ef/0xc00 [ 1507.227380] io_uring_alloc_task_context+0x1f1/0x6a0 [ 1507.228109] ? io_import_iovec+0x1120/0x1120 [ 1507.228740] ? io_apoll_task_func+0x2d0/0x2d0 [ 1507.229379] ? __io_req_find_next+0x300/0x300 [ 1507.230021] ? do_raw_spin_lock+0x121/0x260 [ 1507.230652] ? rwlock_bug.part.0+0x90/0x90 [ 1507.231264] __io_uring_add_tctx_node+0x2c6/0x520 [ 1507.231963] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1507.232717] ? alloc_fd+0x2e7/0x670 [ 1507.233242] io_uring_setup+0x1fbb/0x2980 [ 1507.233841] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1507.234590] ? wait_for_completion_io+0x270/0x270 [ 1507.235337] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1507.236093] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1507.236831] do_syscall_64+0x33/0x40 [ 1507.237369] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1507.238118] RIP: 0033:0x7f741addcb19 [ 1507.238650] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1507.241307] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1507.242411] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1507.243433] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1507.244462] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 21:49:44 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x49f00fff) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:49:44 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) [ 1507.245492] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1507.246711] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:49:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:49:44 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff0ff049) 21:49:59 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff3f8049) 21:49:59 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff0f7047) 21:49:59 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:49:59 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000140)) 21:49:59 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:49:59 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x49f03fff) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:49:59 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 36) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:49:59 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 34) [ 1522.448650] FAULT_INJECTION: forcing a failure. [ 1522.448650] name failslab, interval 1, probability 0, space 0, times 0 [ 1522.451071] CPU: 0 PID: 9723 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1522.452384] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1522.453982] Call Trace: [ 1522.454516] dump_stack+0x107/0x167 [ 1522.455214] should_fail.cold+0x5/0xa [ 1522.455952] ? io_wq_create+0x6ef/0xc00 [ 1522.456716] should_failslab+0x5/0x20 [ 1522.457455] kmem_cache_alloc_node_trace+0x59/0x340 [ 1522.458420] io_wq_create+0x6ef/0xc00 [ 1522.459161] io_uring_alloc_task_context+0x1f1/0x6a0 [ 1522.460140] ? io_import_iovec+0x1120/0x1120 [ 1522.460991] ? io_apoll_task_func+0x2d0/0x2d0 [ 1522.461852] ? __io_req_find_next+0x300/0x300 [ 1522.462709] ? do_raw_spin_lock+0x121/0x260 [ 1522.463551] ? rwlock_bug.part.0+0x90/0x90 [ 1522.464371] __io_uring_add_tctx_node+0x2c6/0x520 [ 1522.465298] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1522.466308] ? alloc_fd+0x2e7/0x670 [ 1522.467009] io_uring_setup+0x1fbb/0x2980 [ 1522.467806] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1522.468766] ? wait_for_completion_io+0x270/0x270 [ 1522.469689] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1522.470676] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1522.471644] do_syscall_64+0x33/0x40 [ 1522.472347] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1522.473310] RIP: 0033:0x7f741addcb19 [ 1522.474009] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1522.477473] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1522.478896] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1522.480229] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1522.481587] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1522.482926] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1522.484266] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1522.493291] FAULT_INJECTION: forcing a failure. [ 1522.493291] name failslab, interval 1, probability 0, space 0, times 0 [ 1522.495738] CPU: 0 PID: 9724 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1522.497000] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1522.498531] Call Trace: [ 1522.499019] dump_stack+0x107/0x167 [ 1522.499689] should_fail.cold+0x5/0xa [ 1522.500400] ? io_wq_create+0xeb/0xc00 [ 1522.501115] should_failslab+0x5/0x20 [ 1522.501829] __kmalloc+0x72/0x390 [ 1522.502492] io_wq_create+0xeb/0xc00 [ 1522.503192] io_uring_alloc_task_context+0x1f1/0x6a0 [ 1522.504134] ? io_import_iovec+0x1120/0x1120 [ 1522.504961] ? io_apoll_task_func+0x2d0/0x2d0 [ 1522.505797] ? __io_req_find_next+0x300/0x300 [ 1522.506638] __io_uring_add_tctx_node+0x2c6/0x520 [ 1522.507537] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1522.508499] ? alloc_fd+0x2e7/0x670 [ 1522.509181] io_uring_setup+0x1fbb/0x2980 [ 1522.509950] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1522.510894] ? wait_for_completion_io+0x270/0x270 [ 1522.511799] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1522.512754] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1522.513697] do_syscall_64+0x33/0x40 [ 1522.514375] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1522.515291] RIP: 0033:0x7f43c90c3b19 [ 1522.515953] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1522.519253] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1522.520636] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1522.521931] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1522.523229] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1522.524534] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1522.525835] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:49:59 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000140)) 21:49:59 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff3ff049) 21:49:59 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff3f7047) 21:49:59 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff0ff049) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:49:59 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 35) 21:49:59 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:49:59 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:49:59 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 37) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) [ 1522.657582] FAULT_INJECTION: forcing a failure. [ 1522.657582] name failslab, interval 1, probability 0, space 0, times 0 [ 1522.660589] CPU: 1 PID: 9740 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1522.662203] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1522.664179] Call Trace: [ 1522.664808] dump_stack+0x107/0x167 [ 1522.665677] should_fail.cold+0x5/0xa [ 1522.666592] ? io_wq_create+0x6ef/0xc00 [ 1522.667537] should_failslab+0x5/0x20 [ 1522.668440] kmem_cache_alloc_node_trace+0x59/0x340 [ 1522.669624] io_wq_create+0x6ef/0xc00 [ 1522.670554] io_uring_alloc_task_context+0x1f1/0x6a0 [ 1522.671792] ? io_import_iovec+0x1120/0x1120 [ 1522.672850] ? io_apoll_task_func+0x2d0/0x2d0 [ 1522.673920] ? __io_req_find_next+0x300/0x300 [ 1522.674996] ? do_raw_spin_lock+0x121/0x260 [ 1522.676029] ? rwlock_bug.part.0+0x90/0x90 [ 1522.677067] __io_uring_add_tctx_node+0x2c6/0x520 [ 1522.678257] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1522.679548] ? alloc_fd+0x2e7/0x670 [ 1522.680457] io_uring_setup+0x1fbb/0x2980 [ 1522.681499] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1522.682742] ? wait_for_completion_io+0x270/0x270 [ 1522.683950] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1522.685212] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1522.686299] do_syscall_64+0x33/0x40 [ 1522.687086] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1522.688171] RIP: 0033:0x7f43c90c3b19 [ 1522.688954] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1522.692848] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1522.694474] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1522.695986] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1522.697499] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1522.699023] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1522.700543] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:49:59 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xffff8000) [ 1522.750320] FAULT_INJECTION: forcing a failure. [ 1522.750320] name failslab, interval 1, probability 0, space 0, times 0 [ 1522.752993] CPU: 1 PID: 9747 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1522.754576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1522.756481] Call Trace: [ 1522.757093] dump_stack+0x107/0x167 [ 1522.757949] should_fail.cold+0x5/0xa [ 1522.758844] ? create_object.isra.0+0x3a/0xa30 [ 1522.759905] should_failslab+0x5/0x20 [ 1522.760787] kmem_cache_alloc+0x5b/0x310 [ 1522.761732] ? io_wq_create+0x114/0xc00 [ 1522.762663] create_object.isra.0+0x3a/0xa30 [ 1522.763683] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1522.764880] kmem_cache_alloc_node_trace+0x16d/0x340 [ 1522.766079] io_wq_create+0x6ef/0xc00 [ 1522.766979] io_uring_alloc_task_context+0x1f1/0x6a0 [ 1522.768170] ? io_import_iovec+0x1120/0x1120 [ 1522.769197] ? io_apoll_task_func+0x2d0/0x2d0 [ 1522.770264] ? __io_req_find_next+0x300/0x300 [ 1522.771322] ? do_raw_spin_lock+0x121/0x260 [ 1522.772343] ? rwlock_bug.part.0+0x90/0x90 [ 1522.773348] __io_uring_add_tctx_node+0x2c6/0x520 [ 1522.774498] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1522.775733] ? alloc_fd+0x2e7/0x670 [ 1522.776616] io_uring_setup+0x1fbb/0x2980 [ 1522.777613] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1522.778870] ? wait_for_completion_io+0x270/0x270 [ 1522.780053] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1522.781312] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1522.782574] do_syscall_64+0x33/0x40 [ 1522.783493] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1522.784729] RIP: 0033:0x7f741addcb19 [ 1522.785626] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1522.790077] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1522.791932] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1522.793679] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1522.795432] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1522.797213] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1522.798991] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:50:15 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff3fe049) 21:50:15 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:50:15 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 38) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:50:15 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0x0) 21:50:15 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff3fc049) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:50:15 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000140)) 21:50:15 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x800000000) 21:50:15 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 36) 21:50:15 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1538.330201] FAULT_INJECTION: forcing a failure. [ 1538.330201] name failslab, interval 1, probability 0, space 0, times 0 [ 1538.331712] CPU: 0 PID: 9771 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1538.332494] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1538.333437] Call Trace: [ 1538.333746] dump_stack+0x107/0x167 [ 1538.334163] should_fail.cold+0x5/0xa [ 1538.334614] ? create_object.isra.0+0x3a/0xa30 [ 1538.335135] should_failslab+0x5/0x20 [ 1538.335567] kmem_cache_alloc+0x5b/0x310 [ 1538.336030] create_object.isra.0+0x3a/0xa30 [ 1538.336530] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1538.337108] kmem_cache_alloc_trace+0x151/0x320 [ 1538.337642] __io_uring_add_tctx_node+0x15c/0x520 [ 1538.338191] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1538.338799] ? alloc_fd+0x2e7/0x670 [ 1538.339217] io_uring_setup+0x1fbb/0x2980 [ 1538.339693] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1538.340272] ? wait_for_completion_io+0x270/0x270 [ 1538.340836] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1538.341437] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1538.342022] do_syscall_64+0x33/0x40 [ 1538.342456] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1538.343045] RIP: 0033:0x7f741addcb19 [ 1538.343372] FAULT_INJECTION: forcing a failure. [ 1538.343372] name failslab, interval 1, probability 0, space 0, times 0 [ 1538.343471] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1538.343488] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1538.349277] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1538.350090] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1538.350906] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1538.351721] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1538.352541] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1538.353379] CPU: 1 PID: 9776 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1538.354956] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1538.356821] Call Trace: [ 1538.357419] dump_stack+0x107/0x167 [ 1538.358241] should_fail.cold+0x5/0xa [ 1538.359106] ? create_object.isra.0+0x3a/0xa30 [ 1538.360144] should_failslab+0x5/0x20 [ 1538.361000] kmem_cache_alloc+0x5b/0x310 [ 1538.361917] ? io_wq_create+0x114/0xc00 [ 1538.362827] create_object.isra.0+0x3a/0xa30 [ 1538.363815] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1538.364956] kmem_cache_alloc_node_trace+0x16d/0x340 [ 1538.366104] io_wq_create+0x6ef/0xc00 [ 1538.366977] io_uring_alloc_task_context+0x1f1/0x6a0 [ 1538.368132] ? io_import_iovec+0x1120/0x1120 [ 1538.369130] ? io_apoll_task_func+0x2d0/0x2d0 [ 1538.370138] ? __io_req_find_next+0x300/0x300 [ 1538.371148] ? do_raw_spin_lock+0x121/0x260 [ 1538.372116] ? rwlock_bug.part.0+0x90/0x90 [ 1538.373074] __io_uring_add_tctx_node+0x2c6/0x520 [ 1538.374162] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1538.375349] ? alloc_fd+0x2e7/0x670 [ 1538.376178] io_uring_setup+0x1fbb/0x2980 [ 1538.377124] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1538.378263] ? wait_for_completion_io+0x270/0x270 [ 1538.379378] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1538.380555] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1538.381723] do_syscall_64+0x33/0x40 [ 1538.382574] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1538.383729] RIP: 0033:0x7f43c90c3b19 [ 1538.384564] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1538.388701] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1538.390436] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1538.392036] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1538.393642] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1538.395253] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1538.396862] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:50:15 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) 21:50:15 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x1000000000) 21:50:15 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0x0) 21:50:15 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xffff8000) 21:50:15 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 39) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:50:15 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff3ff049) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1538.474162] FAULT_INJECTION: forcing a failure. [ 1538.474162] name failslab, interval 1, probability 0, space 0, times 0 [ 1538.475633] CPU: 0 PID: 9788 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1538.476412] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1538.477354] Call Trace: [ 1538.477662] dump_stack+0x107/0x167 [ 1538.478080] should_fail.cold+0x5/0xa [ 1538.478535] ? create_object.isra.0+0x3a/0xa30 [ 1538.479061] should_failslab+0x5/0x20 [ 1538.479500] kmem_cache_alloc+0x5b/0x310 [ 1538.479965] create_object.isra.0+0x3a/0xa30 [ 1538.480472] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1538.481052] kmem_cache_alloc_trace+0x151/0x320 [ 1538.481596] __io_uring_add_tctx_node+0x15c/0x520 [ 1538.482144] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1538.482745] ? alloc_fd+0x2e7/0x670 [ 1538.483165] io_uring_setup+0x1fbb/0x2980 [ 1538.483637] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1538.484218] ? wait_for_completion_io+0x270/0x270 [ 1538.484779] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1538.485379] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1538.485964] do_syscall_64+0x33/0x40 [ 1538.486397] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1538.486985] RIP: 0033:0x7f741addcb19 [ 1538.487411] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1538.489493] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1538.490366] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1538.491187] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1538.492005] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1538.492820] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1538.493637] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:50:15 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 37) [ 1538.536500] FAULT_INJECTION: forcing a failure. [ 1538.536500] name failslab, interval 1, probability 0, space 0, times 0 [ 1538.538048] CPU: 0 PID: 9798 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1538.538829] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1538.539776] Call Trace: [ 1538.540089] dump_stack+0x107/0x167 [ 1538.540506] should_fail.cold+0x5/0xa [ 1538.540944] ? __io_uring_add_tctx_node+0x15c/0x520 [ 1538.541512] should_failslab+0x5/0x20 [ 1538.541946] kmem_cache_alloc_trace+0x55/0x320 [ 1538.542476] __io_uring_add_tctx_node+0x15c/0x520 [ 1538.543025] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1538.543624] ? alloc_fd+0x2e7/0x670 [ 1538.544045] io_uring_setup+0x1fbb/0x2980 [ 1538.544521] ? setup_APIC_eilvt+0x2f0/0x2f0 [ 1538.545015] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1538.545595] ? tick_program_event+0xa8/0x140 [ 1538.546107] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1538.546714] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1538.547305] do_syscall_64+0x33/0x40 [ 1538.547729] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1538.548310] RIP: 0033:0x7f43c90c3b19 [ 1538.548735] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1538.550826] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1538.551700] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1538.552507] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1538.553319] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1538.554128] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1538.554952] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:50:27 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 38) 21:50:27 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) 21:50:27 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xffff8000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:50:27 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x800000000) 21:50:27 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:50:27 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, r2, 0x0) 21:50:27 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x10000000000) 21:50:27 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 40) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) [ 1550.680693] FAULT_INJECTION: forcing a failure. [ 1550.680693] name failslab, interval 1, probability 0, space 0, times 0 [ 1550.682639] CPU: 0 PID: 9814 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1550.683751] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1550.685055] Call Trace: [ 1550.685475] dump_stack+0x107/0x167 [ 1550.686074] should_fail.cold+0x5/0xa [ 1550.686698] ? create_object.isra.0+0x3a/0xa30 [ 1550.687447] should_failslab+0x5/0x20 [ 1550.688050] kmem_cache_alloc+0x5b/0x310 [ 1550.688708] create_object.isra.0+0x3a/0xa30 [ 1550.689410] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1550.690208] kmem_cache_alloc_trace+0x151/0x320 [ 1550.690969] __io_uring_add_tctx_node+0x15c/0x520 [ 1550.691750] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1550.692593] ? alloc_fd+0x2e7/0x670 [ 1550.693170] io_uring_setup+0x1fbb/0x2980 [ 1550.693847] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1550.694672] ? wait_for_completion_io+0x270/0x270 [ 1550.695461] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1550.696301] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1550.697131] do_syscall_64+0x33/0x40 [ 1550.697725] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1550.698558] RIP: 0033:0x7f43c90c3b19 [ 1550.699149] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1550.700572] FAULT_INJECTION: forcing a failure. [ 1550.700572] name failslab, interval 1, probability 0, space 0, times 0 [ 1550.702117] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1550.702133] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1550.702141] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1550.702148] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1550.702156] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1550.702163] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1550.713678] CPU: 1 PID: 9817 Comm: syz-executor.5 Not tainted 5.10.262 #1 21:50:27 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x10, r2, 0x0) [ 1550.715020] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1550.716815] Call Trace: [ 1550.717331] dump_stack+0x107/0x167 [ 1550.718047] should_fail.cold+0x5/0xa [ 1550.718800] ? ___slab_alloc+0x360/0x700 [ 1550.719597] ? create_object.isra.0+0x3a/0xa30 [ 1550.720488] should_failslab+0x5/0x20 [ 1550.721230] kmem_cache_alloc+0x5b/0x310 [ 1550.722032] create_object.isra.0+0x3a/0xa30 [ 1550.722919] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1550.723922] kmem_cache_alloc+0x159/0x310 [ 1550.724749] xas_alloc+0x336/0x440 [ 1550.725444] xas_create+0x34a/0x10d0 [ 1550.726178] ? kernel_text_address+0xf2/0x120 [ 1550.727062] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1550.728083] xas_store+0x8c/0x1c40 [ 1550.728800] __xa_store+0x164/0x2d0 [ 1550.729519] ? xa_delete_node+0x280/0x280 [ 1550.730333] ? trace_hardirqs_on+0x5b/0x180 [ 1550.731192] xa_store+0x31/0x50 [ 1550.731841] __io_uring_add_tctx_node+0x1cf/0x520 [ 1550.732784] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1550.733841] ? alloc_fd+0x2e7/0x670 [ 1550.734610] io_uring_setup+0x1fbb/0x2980 [ 1550.735440] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1550.736457] ? wait_for_completion_io+0x270/0x270 [ 1550.737437] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1550.738489] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1550.739551] do_syscall_64+0x33/0x40 [ 1550.740309] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1550.741359] RIP: 0033:0x7f741addcb19 [ 1550.742117] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1550.745854] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1550.747419] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1550.748867] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1550.750289] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1550.751733] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1550.753172] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:50:27 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x10, r2, 0x0) 21:50:27 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 39) 21:50:27 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:50:27 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xffffffffffffb) 21:50:27 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) 21:50:27 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x800000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:50:27 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x1000000000) [ 1550.889432] FAULT_INJECTION: forcing a failure. [ 1550.889432] name failslab, interval 1, probability 0, space 0, times 0 [ 1550.891703] CPU: 0 PID: 9839 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1550.892829] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1550.894148] Call Trace: [ 1550.894590] dump_stack+0x107/0x167 [ 1550.895183] should_fail.cold+0x5/0xa [ 1550.895797] ? xas_alloc+0x336/0x440 [ 1550.896394] should_failslab+0x5/0x20 [ 1550.897010] kmem_cache_alloc+0x5b/0x310 [ 1550.897670] ? stack_trace_consume_entry+0x160/0x160 [ 1550.898485] xas_alloc+0x336/0x440 [ 1550.899184] xas_create+0x34a/0x10d0 [ 1550.899913] ? kernel_text_address+0xf2/0x120 [ 1550.900781] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1550.901800] xas_store+0x8c/0x1c40 [ 1550.902523] __xa_store+0x164/0x2d0 [ 1550.903113] ? xa_delete_node+0x280/0x280 [ 1550.903935] ? trace_hardirqs_on+0x5b/0x180 [ 1550.904783] xa_store+0x31/0x50 [ 1550.905430] __io_uring_add_tctx_node+0x1cf/0x520 [ 1550.906358] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1550.907370] ? alloc_fd+0x2e7/0x670 [ 1550.908093] io_uring_setup+0x1fbb/0x2980 [ 1550.908897] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1550.909876] ? wait_for_completion_io+0x270/0x270 [ 1550.910846] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1550.911865] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1550.912862] do_syscall_64+0x33/0x40 [ 1550.913581] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1550.914572] RIP: 0033:0x7f43c90c3b19 [ 1550.915300] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1550.918847] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1550.920306] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1550.921669] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1550.923053] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 21:50:28 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1550.924418] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1550.926006] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:50:40 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x1000000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1563.730998] FAULT_INJECTION: forcing a failure. [ 1563.730998] name failslab, interval 1, probability 0, space 0, times 0 [ 1563.732641] CPU: 1 PID: 9857 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1563.733590] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1563.734741] Call Trace: [ 1563.735112] dump_stack+0x107/0x167 [ 1563.735616] should_fail.cold+0x5/0xa [ 1563.736145] ? create_object.isra.0+0x3a/0xa30 [ 1563.736769] should_failslab+0x5/0x20 [ 1563.737285] kmem_cache_alloc+0x5b/0x310 [ 1563.737853] ? lock_chain_count+0x20/0x20 [ 1563.738443] create_object.isra.0+0x3a/0xa30 [ 1563.739049] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1563.739761] kmem_cache_alloc+0x159/0x310 [ 1563.740331] xas_alloc+0x336/0x440 [ 1563.740815] xas_create+0x34a/0x10d0 [ 1563.741343] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1563.742060] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1563.742858] xas_store+0x8c/0x1c40 [ 1563.743356] ? xas_store+0x2/0x1c40 [ 1563.743870] __xa_store+0x164/0x2d0 [ 1563.744367] ? xa_delete_node+0x280/0x280 [ 1563.744936] ? trace_hardirqs_on+0x5b/0x180 [ 1563.745545] xa_store+0x31/0x50 [ 1563.746004] __io_uring_add_tctx_node+0x1cf/0x520 [ 1563.746676] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1563.747394] ? alloc_fd+0x2e7/0x670 [ 1563.747899] io_uring_setup+0x1fbb/0x2980 [ 1563.748457] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1563.749144] ? wait_for_completion_io+0x270/0x270 [ 1563.749811] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1563.750531] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1563.751232] do_syscall_64+0x33/0x40 [ 1563.751735] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1563.752438] RIP: 0033:0x7f43c90c3b19 [ 1563.752938] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1563.755436] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 21:50:40 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:50:40 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x10000000000) 21:50:40 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x10, r2, 0x0) 21:50:40 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 41) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:50:40 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x10, r2, 0x0) 21:50:40 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 40) [ 1563.756636] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1563.757793] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1563.758782] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1563.759753] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1563.760748] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1563.766787] FAULT_INJECTION: forcing a failure. [ 1563.766787] name failslab, interval 1, probability 0, space 0, times 0 [ 1563.768507] CPU: 1 PID: 9864 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1563.769445] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1563.770566] Call Trace: [ 1563.770927] dump_stack+0x107/0x167 [ 1563.771416] should_fail.cold+0x5/0xa [ 1563.771929] ? xas_alloc+0x336/0x440 [ 1563.772428] should_failslab+0x5/0x20 [ 1563.772943] kmem_cache_alloc+0x5b/0x310 [ 1563.773496] xas_alloc+0x336/0x440 [ 1563.773980] xas_create+0x34a/0x10d0 [ 1563.774492] ? kernel_text_address+0xf2/0x120 [ 1563.775115] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1563.775848] xas_store+0x8c/0x1c40 [ 1563.776358] __xa_store+0x164/0x2d0 [ 1563.776881] ? xa_delete_node+0x280/0x280 [ 1563.777486] ? trace_hardirqs_on+0x5b/0x180 [ 1563.778095] xa_store+0x31/0x50 [ 1563.778567] __io_uring_add_tctx_node+0x1cf/0x520 [ 1563.779247] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1563.779981] ? alloc_fd+0x2e7/0x670 [ 1563.780494] io_uring_setup+0x1fbb/0x2980 [ 1563.781090] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1563.781800] ? wait_for_completion_io+0x270/0x270 [ 1563.782495] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1563.783212] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1563.783909] do_syscall_64+0x33/0x40 [ 1563.784411] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1563.785099] RIP: 0033:0x7f741addcb19 21:50:40 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x40000000000000) [ 1563.785597] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1563.788361] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1563.789450] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1563.790412] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1563.791367] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1563.792316] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1563.793274] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:50:40 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x10000000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:50:40 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xffffffffffffb) 21:50:54 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x40000000000000) 21:50:54 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:50:54 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x10, r2, 0x0) 21:50:54 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 41) 21:50:54 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xffffffffffffb) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1576.982641] FAULT_INJECTION: forcing a failure. 21:50:54 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, 0xffffffffffffffff, 0x0) [ 1576.982641] name failslab, interval 1, probability 0, space 0, times 0 [ 1576.985433] CPU: 0 PID: 9892 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1576.986893] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1576.988630] Call Trace: [ 1576.989187] dump_stack+0x107/0x167 21:50:54 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 42) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:50:54 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x60000000000000) [ 1576.989958] should_fail.cold+0x5/0xa [ 1576.990810] ? xas_alloc+0x336/0x440 [ 1576.991597] should_failslab+0x5/0x20 [ 1576.992398] kmem_cache_alloc+0x5b/0x310 [ 1576.993251] xas_alloc+0x336/0x440 [ 1576.993999] xas_create+0x34a/0x10d0 [ 1576.994804] ? kernel_text_address+0xf2/0x120 [ 1576.995762] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1576.996865] xas_store+0x8c/0x1c40 [ 1576.997630] __xa_store+0x164/0x2d0 [ 1576.998401] ? xa_delete_node+0x280/0x280 [ 1576.999300] ? trace_hardirqs_on+0x5b/0x180 [ 1577.000215] xa_store+0x31/0x50 [ 1577.000916] __io_uring_add_tctx_node+0x1cf/0x520 [ 1577.001927] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1577.003035] ? alloc_fd+0x2e7/0x670 [ 1577.003810] io_uring_setup+0x1fbb/0x2980 [ 1577.004691] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1577.005757] ? wait_for_completion_io+0x270/0x270 [ 1577.006806] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1577.007905] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1577.008994] do_syscall_64+0x33/0x40 [ 1577.009778] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1577.010858] RIP: 0033:0x7f43c90c3b19 [ 1577.011642] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1577.015526] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1577.017144] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1577.018649] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1577.020171] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1577.021677] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1577.023182] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:50:54 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x40000000000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:50:54 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, 0xffffffffffffffff, 0x0) [ 1577.041937] FAULT_INJECTION: forcing a failure. [ 1577.041937] name failslab, interval 1, probability 0, space 0, times 0 [ 1577.043743] CPU: 1 PID: 9904 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1577.044513] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1577.045445] Call Trace: [ 1577.045754] dump_stack+0x107/0x167 [ 1577.046168] should_fail.cold+0x5/0xa [ 1577.046604] ? create_object.isra.0+0x3a/0xa30 [ 1577.047124] should_failslab+0x5/0x20 [ 1577.047554] kmem_cache_alloc+0x5b/0x310 [ 1577.048014] ? mark_held_locks+0x9e/0xe0 [ 1577.048476] create_object.isra.0+0x3a/0xa30 [ 1577.048968] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1577.049539] kmem_cache_alloc+0x159/0x310 [ 1577.050011] xas_alloc+0x336/0x440 [ 1577.050413] xas_create+0x34a/0x10d0 [ 1577.050847] ? kernel_text_address+0xf2/0x120 [ 1577.051353] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1577.051947] xas_store+0x8c/0x1c40 [ 1577.052356] __xa_store+0x164/0x2d0 [ 1577.052765] ? xa_delete_node+0x280/0x280 [ 1577.053239] ? trace_hardirqs_on+0x5b/0x180 [ 1577.053726] xa_store+0x31/0x50 [ 1577.054099] __io_uring_add_tctx_node+0x1cf/0x520 [ 1577.054645] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1577.055243] ? alloc_fd+0x2e7/0x670 [ 1577.055658] io_uring_setup+0x1fbb/0x2980 [ 1577.056131] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1577.056700] ? wait_for_completion_io+0x270/0x270 [ 1577.057268] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1577.057867] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1577.058451] do_syscall_64+0x33/0x40 [ 1577.058876] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1577.059451] RIP: 0033:0x7f741addcb19 [ 1577.059868] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1577.061931] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1577.062790] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1577.063587] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1577.064383] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1577.065184] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1577.065983] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:50:54 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, 0xffffffffffffffff, 0x0) 21:50:54 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x60000000000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:50:54 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x80000000000000) 21:50:54 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x10, r2, 0x0) 21:50:54 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x60000000000000) 21:50:54 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x80ffff00000000) 21:50:54 executing program 4: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4002, 0x100000e, 0x13, r0, 0x0) 21:51:11 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x80000000000000) 21:51:11 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:51:11 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 42) 21:51:11 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x100000000000000) 21:51:11 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) (fail_nth: 1) 21:51:11 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 43) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:51:11 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x80000000000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:51:11 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) [ 1594.210507] FAULT_INJECTION: forcing a failure. [ 1594.210507] name failslab, interval 1, probability 0, space 0, times 0 [ 1594.211582] FAULT_INJECTION: forcing a failure. [ 1594.211582] name failslab, interval 1, probability 0, space 0, times 0 [ 1594.213067] CPU: 0 PID: 9947 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1594.216578] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1594.218346] Call Trace: [ 1594.218913] dump_stack+0x107/0x167 [ 1594.219707] should_fail.cold+0x5/0xa [ 1594.220523] ? xas_alloc+0x336/0x440 [ 1594.221314] should_failslab+0x5/0x20 [ 1594.222132] kmem_cache_alloc+0x5b/0x310 [ 1594.223011] xas_alloc+0x336/0x440 [ 1594.223770] xas_create+0x34a/0x10d0 [ 1594.224570] ? kernel_text_address+0xf2/0x120 [ 1594.225529] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1594.226646] xas_store+0x8c/0x1c40 [ 1594.227427] __xa_store+0x164/0x2d0 [ 1594.228209] ? xa_delete_node+0x280/0x280 [ 1594.229097] ? trace_hardirqs_on+0x5b/0x180 [ 1594.230019] xa_store+0x31/0x50 [ 1594.230727] __io_uring_add_tctx_node+0x1cf/0x520 [ 1594.231761] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1594.232874] ? alloc_fd+0x2e7/0x670 [ 1594.233660] io_uring_setup+0x1fbb/0x2980 [ 1594.234554] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1594.235640] ? wait_for_completion_io+0x270/0x270 [ 1594.236679] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1594.237796] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1594.238891] do_syscall_64+0x33/0x40 [ 1594.240065] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1594.241365] RIP: 0033:0x7f741addcb19 [ 1594.242309] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1594.246463] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1594.248077] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1594.249579] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1594.251089] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1594.252591] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1594.254094] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1594.255637] CPU: 1 PID: 9949 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1594.256947] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1594.258508] Call Trace: [ 1594.259030] dump_stack+0x107/0x167 [ 1594.259713] should_fail.cold+0x5/0xa [ 1594.260432] ? create_object.isra.0+0x3a/0xa30 [ 1594.261283] should_failslab+0x5/0x20 [ 1594.262001] kmem_cache_alloc+0x5b/0x310 [ 1594.262762] ? mark_held_locks+0x9e/0xe0 [ 1594.263546] create_object.isra.0+0x3a/0xa30 [ 1594.264365] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1594.265314] kmem_cache_alloc+0x159/0x310 [ 1594.266097] xas_alloc+0x336/0x440 [ 1594.266765] xas_create+0x34a/0x10d0 [ 1594.267492] ? kernel_text_address+0xf2/0x120 [ 1594.268327] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1594.269305] xas_store+0x8c/0x1c40 [ 1594.269981] __xa_store+0x164/0x2d0 [ 1594.270663] ? xa_delete_node+0x280/0x280 [ 1594.271461] ? trace_hardirqs_on+0x5b/0x180 [ 1594.272273] xa_store+0x31/0x50 [ 1594.272900] __io_uring_add_tctx_node+0x1cf/0x520 [ 1594.273798] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1594.274779] ? alloc_fd+0x2e7/0x670 [ 1594.275567] io_uring_setup+0x1fbb/0x2980 [ 1594.276408] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1594.277355] ? wait_for_completion_io+0x270/0x270 [ 1594.278269] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1594.279265] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1594.280215] do_syscall_64+0x33/0x40 [ 1594.280901] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1594.281846] RIP: 0033:0x7f43c90c3b19 [ 1594.282532] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1594.285899] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1594.287275] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1594.288581] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1594.289886] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1594.291218] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1594.292525] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1594.313048] FAULT_INJECTION: forcing a failure. [ 1594.313048] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1594.315548] CPU: 0 PID: 9954 Comm: syz-executor.4 Not tainted 5.10.262 #1 [ 1594.317001] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1594.318757] Call Trace: [ 1594.319335] dump_stack+0x107/0x167 [ 1594.320114] should_fail.cold+0x5/0xa [ 1594.320938] _copy_to_user+0x2e/0x180 [ 1594.321755] simple_read_from_buffer+0xcc/0x160 [ 1594.322749] proc_fail_nth_read+0x198/0x230 [ 1594.323685] ? proc_sessionid_read+0x230/0x230 [ 1594.324660] ? security_file_permission+0xb1/0xe0 [ 1594.325692] ? proc_sessionid_read+0x230/0x230 [ 1594.326651] vfs_read+0x228/0x620 [ 1594.327404] ksys_read+0x12d/0x260 [ 1594.328139] ? vfs_write+0xb10/0xb10 [ 1594.328938] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1594.330054] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1594.331178] do_syscall_64+0x33/0x40 [ 1594.331967] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1594.333059] RIP: 0033:0x7fbdf3a8c69c [ 1594.333845] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1594.337824] RSP: 002b:00007fbdf102e170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1594.339433] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007fbdf3a8c69c [ 1594.340897] RDX: 000000000000000f RSI: 00007fbdf102e1e0 RDI: 0000000000000006 [ 1594.342418] RBP: 00007fbdf102e1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1594.343905] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1594.345414] R13: 00007ffcff9d87ef R14: 00007fbdf102e300 R15: 0000000000022000 21:51:11 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) 21:51:11 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x200000000000000) 21:51:11 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) 21:51:11 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x80ffff00000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:51:11 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 44) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:51:11 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 43) 21:51:11 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x80ffff00000000) 21:51:11 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) [ 1594.477947] FAULT_INJECTION: forcing a failure. [ 1594.477947] name failslab, interval 1, probability 0, space 0, times 0 [ 1594.480143] CPU: 1 PID: 9968 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1594.481277] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1594.482638] Call Trace: [ 1594.483097] dump_stack+0x107/0x167 [ 1594.483701] should_fail.cold+0x5/0xa [ 1594.484319] ? xas_alloc+0x336/0x440 [ 1594.484922] should_failslab+0x5/0x20 [ 1594.485539] kmem_cache_alloc+0x5b/0x310 [ 1594.486212] xas_alloc+0x336/0x440 [ 1594.486800] xas_create+0x34a/0x10d0 [ 1594.487435] ? kernel_text_address+0xf2/0x120 [ 1594.488170] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1594.489027] xas_store+0x8c/0x1c40 [ 1594.489618] __xa_store+0x164/0x2d0 [ 1594.490213] ? xa_delete_node+0x280/0x280 [ 1594.490896] ? trace_hardirqs_on+0x5b/0x180 [ 1594.491623] xa_store+0x31/0x50 [ 1594.492165] __io_uring_add_tctx_node+0x1cf/0x520 [ 1594.492963] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1594.493818] ? alloc_fd+0x2e7/0x670 [ 1594.494425] io_uring_setup+0x1fbb/0x2980 [ 1594.495125] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1594.495949] ? wait_for_completion_io+0x270/0x270 [ 1594.496754] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1594.497611] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1594.498447] do_syscall_64+0x33/0x40 [ 1594.499070] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1594.499896] RIP: 0033:0x7f741addcb19 [ 1594.500505] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1594.502371] FAULT_INJECTION: forcing a failure. [ 1594.502371] name failslab, interval 1, probability 0, space 0, times 0 [ 1594.503511] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1594.503527] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1594.503535] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1594.503543] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1594.503551] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1594.503559] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1594.515696] CPU: 0 PID: 9971 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1594.517149] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1594.518910] Call Trace: [ 1594.519485] dump_stack+0x107/0x167 [ 1594.520265] should_fail.cold+0x5/0xa [ 1594.521080] ? ___slab_alloc+0x155/0x700 [ 1594.521944] ? create_object.isra.0+0x3a/0xa30 [ 1594.522917] should_failslab+0x5/0x20 [ 1594.523739] kmem_cache_alloc+0x5b/0x310 [ 1594.524614] create_object.isra.0+0x3a/0xa30 [ 1594.525545] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1594.526636] kmem_cache_alloc+0x159/0x310 [ 1594.527534] xas_alloc+0x336/0x440 [ 1594.528296] xas_create+0x34a/0x10d0 [ 1594.529096] ? kernel_text_address+0xf2/0x120 [ 1594.530058] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1594.531179] xas_store+0x8c/0x1c40 [ 1594.531952] __xa_store+0x164/0x2d0 [ 1594.532732] ? xa_delete_node+0x280/0x280 [ 1594.533623] ? trace_hardirqs_on+0x5b/0x180 [ 1594.534547] xa_store+0x31/0x50 [ 1594.535253] __io_uring_add_tctx_node+0x1cf/0x520 [ 1594.536276] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1594.537363] ? alloc_fd+0x2e7/0x670 [ 1594.538139] io_uring_setup+0x1fbb/0x2980 [ 1594.539041] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1594.540128] ? wait_for_completion_io+0x270/0x270 [ 1594.541175] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1594.542277] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1594.543384] do_syscall_64+0x33/0x40 [ 1594.544180] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1594.545270] RIP: 0033:0x7f43c90c3b19 [ 1594.546070] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1594.549979] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1594.551610] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1594.553126] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1594.554641] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1594.556163] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1594.557686] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:51:11 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0xb00, 0x100000e, 0x13, r2, 0x0) 21:51:11 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32]) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:51:11 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x300000000000000) 21:51:11 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x100000000000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:51:11 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 45) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:51:11 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4002, 0x100000e, 0x13, r2, 0x0) [ 1594.691740] FAULT_INJECTION: forcing a failure. [ 1594.691740] name failslab, interval 1, probability 0, space 0, times 0 [ 1594.693387] CPU: 1 PID: 9991 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1594.694345] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1594.695512] Call Trace: [ 1594.695879] dump_stack+0x107/0x167 [ 1594.696377] should_fail.cold+0x5/0xa [ 1594.696895] ? xas_alloc+0x336/0x440 [ 1594.697400] should_failslab+0x5/0x20 [ 1594.697931] kmem_cache_alloc+0x5b/0x310 [ 1594.698490] xas_alloc+0x336/0x440 [ 1594.699037] xas_create+0x34a/0x10d0 [ 1594.699547] ? kernel_text_address+0xf2/0x120 [ 1594.700158] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1594.700873] xas_store+0x8c/0x1c40 [ 1594.701375] __xa_store+0x164/0x2d0 [ 1594.701874] ? xa_delete_node+0x280/0x280 [ 1594.702446] ? trace_hardirqs_on+0x5b/0x180 [ 1594.703065] xa_store+0x31/0x50 [ 1594.703524] __io_uring_add_tctx_node+0x1cf/0x520 [ 1594.704182] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1594.704896] ? alloc_fd+0x2e7/0x670 [ 1594.705398] io_uring_setup+0x1fbb/0x2980 [ 1594.705968] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1594.706661] ? wait_for_completion_io+0x270/0x270 [ 1594.707357] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1594.708087] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1594.708806] do_syscall_64+0x33/0x40 [ 1594.709304] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1594.710007] RIP: 0033:0x7f741addcb19 [ 1594.710511] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1594.713058] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1594.714094] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1594.715075] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1594.716024] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1594.716994] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1594.717950] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:51:25 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 44) [ 1608.883413] FAULT_INJECTION: forcing a failure. [ 1608.883413] name failslab, interval 1, probability 0, space 0, times 0 [ 1608.884759] CPU: 1 PID: 10006 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1608.885548] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1608.886501] Call Trace: [ 1608.886807] dump_stack+0x107/0x167 [ 1608.887230] should_fail.cold+0x5/0xa [ 1608.887679] ? create_object.isra.0+0x3a/0xa30 [ 1608.888199] should_failslab+0x5/0x20 [ 1608.888639] kmem_cache_alloc+0x5b/0x310 [ 1608.889110] ? mark_held_locks+0x9e/0xe0 [ 1608.889571] create_object.isra.0+0x3a/0xa30 [ 1608.890078] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1608.890155] FAULT_INJECTION: forcing a failure. [ 1608.890155] name failslab, interval 1, probability 0, space 0, times 0 [ 1608.890672] kmem_cache_alloc+0x159/0x310 [ 1608.892557] xas_alloc+0x336/0x440 [ 1608.892967] xas_create+0x34a/0x10d0 [ 1608.893406] ? queued_spin_lock_slowpath+0xcc/0x8c0 [ 1608.893986] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1608.894591] xas_store+0x8c/0x1c40 [ 1608.895008] __xa_store+0x164/0x2d0 [ 1608.895442] ? xa_delete_node+0x280/0x280 [ 1608.895938] ? trace_hardirqs_on+0x5b/0x180 [ 1608.896437] xa_store+0x31/0x50 [ 1608.896827] __io_uring_add_tctx_node+0x1cf/0x520 [ 1608.897386] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1608.898000] ? alloc_fd+0x2e7/0x670 [ 1608.898428] io_uring_setup+0x1fbb/0x2980 [ 1608.898903] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1608.899485] ? wait_for_completion_io+0x270/0x270 [ 1608.900042] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1608.900638] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1608.901220] do_syscall_64+0x33/0x40 [ 1608.901641] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1608.902221] RIP: 0033:0x7f741addcb19 [ 1608.902645] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1608.904737] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1608.905590] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1608.906394] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1608.907219] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1608.908019] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1608.908835] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1608.909676] CPU: 0 PID: 10004 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1608.910571] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1608.911632] Call Trace: [ 1608.911980] dump_stack+0x107/0x167 [ 1608.912444] should_fail.cold+0x5/0xa [ 1608.912933] ? create_object.isra.0+0x3a/0xa30 [ 1608.913508] should_failslab+0x5/0x20 [ 1608.914016] kmem_cache_alloc+0x5b/0x310 [ 1608.914539] ? mark_held_locks+0x9e/0xe0 [ 1608.915056] create_object.isra.0+0x3a/0xa30 [ 1608.915617] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1608.916259] kmem_cache_alloc+0x159/0x310 [ 1608.916788] xas_alloc+0x336/0x440 [ 1608.917239] xas_create+0x34a/0x10d0 [ 1608.917715] ? kernel_text_address+0xf2/0x120 [ 1608.918287] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1608.918950] xas_store+0x8c/0x1c40 [ 1608.919451] __xa_store+0x164/0x2d0 [ 1608.919910] ? xa_delete_node+0x280/0x280 [ 1608.920442] ? trace_hardirqs_on+0x5b/0x180 [ 1608.920992] xa_store+0x31/0x50 [ 1608.921415] __io_uring_add_tctx_node+0x1cf/0x520 [ 1608.922040] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1608.922706] ? alloc_fd+0x2e7/0x670 [ 1608.923193] io_uring_setup+0x1fbb/0x2980 [ 1608.923734] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1608.924380] ? wait_for_completion_io+0x270/0x270 [ 1608.925013] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1608.925677] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1608.926347] do_syscall_64+0x33/0x40 [ 1608.926818] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1608.927697] RIP: 0033:0x7f43c90c3b19 [ 1608.928172] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1608.930506] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1608.931479] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1608.932388] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1608.933312] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1608.934257] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1608.935185] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:51:25 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 21:51:25 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32]) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:51:25 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4003, 0x100000e, 0x13, r2, 0x0) 21:51:25 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x400000000000000) 21:51:25 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x200000000000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:51:25 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 46) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:51:26 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x100000000000000) 21:51:26 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x300000000000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:51:26 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1621.163533] FAULT_INJECTION: forcing a failure. [ 1621.163533] name failslab, interval 1, probability 0, space 0, times 0 [ 1621.165305] CPU: 0 PID: 10037 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1621.166291] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1621.167810] Call Trace: [ 1621.168491] dump_stack+0x107/0x167 21:51:38 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 45) 21:51:38 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x200000000000000) 21:51:38 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 47) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:51:38 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x400000000000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:51:38 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x400010000000000) 21:51:38 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4004, 0x100000e, 0x13, r2, 0x0) [ 1621.169412] should_fail.cold+0x5/0xa [ 1621.170605] ? create_object.isra.0+0x3a/0xa30 [ 1621.171777] should_failslab+0x5/0x20 [ 1621.172735] kmem_cache_alloc+0x5b/0x310 [ 1621.173761] ? mark_held_locks+0x9e/0xe0 [ 1621.174786] create_object.isra.0+0x3a/0xa30 [ 1621.175892] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1621.177178] kmem_cache_alloc+0x159/0x310 [ 1621.178227] xas_alloc+0x336/0x440 [ 1621.179126] xas_create+0x34a/0x10d0 [ 1621.180080] ? kernel_text_address+0xf2/0x120 [ 1621.181208] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1621.182541] xas_store+0x8c/0x1c40 [ 1621.183467] __xa_store+0x164/0x2d0 [ 1621.184388] ? xa_delete_node+0x280/0x280 [ 1621.185450] ? trace_hardirqs_on+0x5b/0x180 [ 1621.186592] xa_store+0x31/0x50 [ 1621.187438] __io_uring_add_tctx_node+0x1cf/0x520 [ 1621.188654] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1621.189972] ? alloc_fd+0x2e7/0x670 [ 1621.190906] io_uring_setup+0x1fbb/0x2980 [ 1621.191975] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1621.193247] ? wait_for_completion_io+0x270/0x270 [ 1621.194489] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1621.195817] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1621.197108] do_syscall_64+0x33/0x40 [ 1621.198046] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1621.199345] RIP: 0033:0x7f741addcb19 [ 1621.200298] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1621.204388] FAULT_INJECTION: forcing a failure. [ 1621.204388] name failslab, interval 1, probability 0, space 0, times 0 [ 1621.204957] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1621.204990] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1621.209995] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1621.211806] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1621.213613] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1621.215428] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1621.217000] CPU: 1 PID: 10041 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1621.217838] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1621.218793] Call Trace: [ 1621.219106] dump_stack+0x107/0x167 [ 1621.219540] should_fail.cold+0x5/0xa [ 1621.219994] ? create_object.isra.0+0x3a/0xa30 21:51:38 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 21:51:38 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32]) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1621.220670] should_failslab+0x5/0x20 [ 1621.221178] kmem_cache_alloc+0x5b/0x310 [ 1621.221683] ? mark_held_locks+0x9e/0xe0 [ 1621.222154] create_object.isra.0+0x3a/0xa30 [ 1621.222657] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1621.223251] kmem_cache_alloc+0x159/0x310 [ 1621.223731] xas_alloc+0x336/0x440 [ 1621.224142] xas_create+0x34a/0x10d0 [ 1621.224575] ? kernel_text_address+0xf2/0x120 [ 1621.225094] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1621.225699] xas_store+0x8c/0x1c40 [ 1621.226115] __xa_store+0x164/0x2d0 [ 1621.226533] ? xa_delete_node+0x280/0x280 [ 1621.227018] ? trace_hardirqs_on+0x5b/0x180 [ 1621.227524] xa_store+0x31/0x50 [ 1621.227910] __io_uring_add_tctx_node+0x1cf/0x520 [ 1621.228462] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1621.229070] ? alloc_fd+0x2e7/0x670 [ 1621.229495] io_uring_setup+0x1fbb/0x2980 [ 1621.229979] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1621.230561] ? wait_for_completion_io+0x270/0x270 [ 1621.231128] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1621.231738] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1621.232332] do_syscall_64+0x33/0x40 [ 1621.232757] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1621.233345] RIP: 0033:0x7f43c90c3b19 [ 1621.233774] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1621.235874] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1621.236741] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1621.237554] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1621.238368] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1621.239209] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1621.240035] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:51:38 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x300000000000000) 21:51:38 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x500000000000000) 21:51:38 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4005, 0x100000e, 0x13, r2, 0x0) 21:51:38 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x600000000000000) 21:51:38 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x500000000000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:51:38 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 21:51:38 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 46) [ 1621.406706] FAULT_INJECTION: forcing a failure. [ 1621.406706] name failslab, interval 1, probability 0, space 0, times 0 [ 1621.409356] CPU: 0 PID: 10074 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1621.410819] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1621.412566] Call Trace: [ 1621.413124] dump_stack+0x107/0x167 [ 1621.413890] should_fail.cold+0x5/0xa [ 1621.414851] ? create_object.isra.0+0x3a/0xa30 [ 1621.415819] should_failslab+0x5/0x20 [ 1621.416620] kmem_cache_alloc+0x5b/0x310 [ 1621.417476] ? mark_held_locks+0x9e/0xe0 [ 1621.418327] create_object.isra.0+0x3a/0xa30 [ 1621.419259] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1621.420339] kmem_cache_alloc+0x159/0x310 [ 1621.421215] xas_alloc+0x336/0x440 [ 1621.421967] xas_create+0x34a/0x10d0 [ 1621.422754] ? kernel_text_address+0xf2/0x120 [ 1621.423702] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1621.424797] xas_store+0x8c/0x1c40 [ 1621.425558] __xa_store+0x164/0x2d0 [ 1621.426322] ? xa_delete_node+0x280/0x280 [ 1621.427221] ? trace_hardirqs_on+0x5b/0x180 [ 1621.428140] xa_store+0x31/0x50 [ 1621.428838] __io_uring_add_tctx_node+0x1cf/0x520 [ 1621.429849] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1621.430943] ? alloc_fd+0x2e7/0x670 [ 1621.431749] io_uring_setup+0x1fbb/0x2980 [ 1621.432630] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1621.433689] ? wait_for_completion_io+0x270/0x270 [ 1621.434729] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1621.435839] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1621.436928] do_syscall_64+0x33/0x40 [ 1621.437710] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1621.438783] RIP: 0033:0x7f43c90c3b19 [ 1621.439572] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1621.443454] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1621.445051] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1621.446553] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1621.448052] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1621.449548] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1621.451042] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1636.240733] FAULT_INJECTION: forcing a failure. [ 1636.240733] name failslab, interval 1, probability 0, space 0, times 0 [ 1636.244268] CPU: 1 PID: 10081 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1636.245747] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1636.247501] Call Trace: [ 1636.248059] dump_stack+0x107/0x167 [ 1636.248823] should_fail.cold+0x5/0xa [ 1636.249625] ? create_object.isra.0+0x3a/0xa30 [ 1636.250581] should_failslab+0x5/0x20 [ 1636.251392] kmem_cache_alloc+0x5b/0x310 [ 1636.252243] ? mark_held_locks+0x9e/0xe0 [ 1636.253100] create_object.isra.0+0x3a/0xa30 [ 1636.254015] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1636.255081] kmem_cache_alloc+0x159/0x310 [ 1636.255966] xas_alloc+0x336/0x440 [ 1636.256704] xas_create+0x34a/0x10d0 [ 1636.257491] ? kernel_text_address+0xf2/0x120 [ 1636.258424] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1636.259527] xas_store+0x8c/0x1c40 [ 1636.260291] __xa_store+0x164/0x2d0 [ 1636.261049] ? xa_delete_node+0x280/0x280 [ 1636.261927] ? trace_hardirqs_on+0x5b/0x180 [ 1636.262835] xa_store+0x31/0x50 [ 1636.263545] __io_uring_add_tctx_node+0x1cf/0x520 [ 1636.264552] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1636.265649] ? alloc_fd+0x2e7/0x670 [ 1636.266419] io_uring_setup+0x1fbb/0x2980 [ 1636.267289] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1636.268345] ? wait_for_completion_io+0x270/0x270 [ 1636.269367] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1636.270455] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1636.271533] do_syscall_64+0x33/0x40 [ 1636.272312] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1636.273382] RIP: 0033:0x7f741addcb19 [ 1636.274153] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1636.277963] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1636.279553] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1636.281081] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1636.282567] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1636.284062] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1636.285534] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:51:53 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 21:51:53 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 47) 21:51:53 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 48) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:51:53 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x700000000000000) 21:51:53 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x400000000000000) 21:51:53 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x600000000000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:51:53 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4006, 0x100000e, 0x13, r2, 0x0) 21:51:53 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB]) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1636.322524] FAULT_INJECTION: forcing a failure. [ 1636.322524] name failslab, interval 1, probability 0, space 0, times 0 [ 1636.325163] CPU: 1 PID: 10096 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1636.326623] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1636.328366] Call Trace: [ 1636.328923] dump_stack+0x107/0x167 [ 1636.329686] should_fail.cold+0x5/0xa [ 1636.330486] ? xas_alloc+0x336/0x440 [ 1636.331259] should_failslab+0x5/0x20 [ 1636.332068] kmem_cache_alloc+0x5b/0x310 [ 1636.332912] xas_alloc+0x336/0x440 [ 1636.333651] xas_create+0x34a/0x10d0 [ 1636.334435] ? kernel_text_address+0xf2/0x120 [ 1636.335382] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1636.336468] xas_store+0x8c/0x1c40 [ 1636.337218] __xa_store+0x164/0x2d0 [ 1636.337973] ? xa_delete_node+0x280/0x280 [ 1636.338846] ? trace_hardirqs_on+0x5b/0x180 [ 1636.339765] xa_store+0x31/0x50 [ 1636.340460] __io_uring_add_tctx_node+0x1cf/0x520 [ 1636.341460] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1636.342543] ? alloc_fd+0x2e7/0x670 [ 1636.343307] io_uring_setup+0x1fbb/0x2980 [ 1636.344193] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1636.345247] ? wait_for_completion_io+0x270/0x270 [ 1636.346270] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1636.347372] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1636.348446] do_syscall_64+0x33/0x40 [ 1636.349268] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1636.350345] RIP: 0033:0x7f43c90c3b19 [ 1636.351120] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1636.355015] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1636.356601] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1636.358089] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1636.359573] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1636.361050] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1636.362525] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:51:53 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4007, 0x100000e, 0x13, r2, 0x0) 21:51:53 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x500000000000000) 21:51:53 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x4000000000000000) 21:51:53 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 48) 21:51:53 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x700000000000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:51:53 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 49) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:51:53 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x600000000000000) 21:51:53 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x7fffdf003000, 0x100000e, 0x13, r2, 0x0) 21:51:53 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB]) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1636.575317] FAULT_INJECTION: forcing a failure. [ 1636.575317] name failslab, interval 1, probability 0, space 0, times 0 [ 1636.577864] CPU: 0 PID: 10113 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1636.579290] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1636.581009] Call Trace: [ 1636.581568] dump_stack+0x107/0x167 [ 1636.582323] should_fail.cold+0x5/0xa [ 1636.583113] ? create_object.isra.0+0x3a/0xa30 [ 1636.584064] should_failslab+0x5/0x20 [ 1636.584854] kmem_cache_alloc+0x5b/0x310 [ 1636.585693] ? mark_held_locks+0x9e/0xe0 [ 1636.586534] create_object.isra.0+0x3a/0xa30 [ 1636.587447] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1636.588504] kmem_cache_alloc+0x159/0x310 [ 1636.589375] xas_alloc+0x336/0x440 [ 1636.590118] xas_create+0x34a/0x10d0 [ 1636.590898] ? kernel_text_address+0xf2/0x120 [ 1636.591843] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1636.592929] xas_store+0x8c/0x1c40 [ 1636.593675] __xa_store+0x164/0x2d0 [ 1636.594428] ? xa_delete_node+0x280/0x280 [ 1636.595300] ? trace_hardirqs_on+0x5b/0x180 [ 1636.596207] xa_store+0x31/0x50 [ 1636.596889] __io_uring_add_tctx_node+0x1cf/0x520 [ 1636.597892] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1636.598974] ? alloc_fd+0x2e7/0x670 [ 1636.599747] io_uring_setup+0x1fbb/0x2980 [ 1636.600611] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1636.601661] ? wait_for_completion_io+0x270/0x270 [ 1636.602676] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1636.603766] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1636.604835] do_syscall_64+0x33/0x40 21:51:53 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x4000000000000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1636.605604] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1636.606786] RIP: 0033:0x7f43c90c3b19 [ 1636.607568] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1636.611388] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1636.612964] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1636.614433] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1636.615923] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1636.617393] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1636.618857] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1636.637728] FAULT_INJECTION: forcing a failure. [ 1636.637728] name failslab, interval 1, probability 0, space 0, times 0 [ 1636.640284] CPU: 1 PID: 10120 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1636.641715] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1636.643468] Call Trace: [ 1636.644030] dump_stack+0x107/0x167 [ 1636.644795] should_fail.cold+0x5/0xa [ 1636.645587] ? create_object.isra.0+0x3a/0xa30 [ 1636.646536] should_failslab+0x5/0x20 [ 1636.647325] kmem_cache_alloc+0x5b/0x310 [ 1636.648183] ? mark_held_locks+0x9e/0xe0 [ 1636.649033] create_object.isra.0+0x3a/0xa30 [ 1636.649951] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1636.651022] kmem_cache_alloc+0x159/0x310 [ 1636.651925] xas_alloc+0x336/0x440 [ 1636.652681] xas_create+0x34a/0x10d0 [ 1636.653474] ? kernel_text_address+0xf2/0x120 [ 1636.654413] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1636.655521] xas_store+0x8c/0x1c40 [ 1636.656272] __xa_store+0x164/0x2d0 [ 1636.657031] ? xa_delete_node+0x280/0x280 [ 1636.657903] ? trace_hardirqs_on+0x5b/0x180 [ 1636.659059] xa_store+0x31/0x50 [ 1636.659771] __io_uring_add_tctx_node+0x1cf/0x520 [ 1636.660775] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1636.661881] ? alloc_fd+0x2e7/0x670 [ 1636.662659] io_uring_setup+0x1fbb/0x2980 [ 1636.663542] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1636.664606] ? wait_for_completion_io+0x270/0x270 [ 1636.665804] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1636.667074] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1636.668293] do_syscall_64+0x33/0x40 [ 1636.669081] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1636.670165] RIP: 0033:0x7f741addcb19 [ 1636.670954] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1636.674800] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1636.676415] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1636.677931] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1636.679447] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1636.680957] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1636.682465] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:51:53 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 1) 21:51:53 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 49) [ 1636.708857] FAULT_INJECTION: forcing a failure. [ 1636.708857] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1636.711377] CPU: 0 PID: 10127 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1636.712833] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1636.714560] Call Trace: [ 1636.715116] dump_stack+0x107/0x167 [ 1636.715881] should_fail.cold+0x5/0xa [ 1636.716683] _copy_from_user+0x2e/0x1b0 [ 1636.717530] perf_copy_attr+0x11a/0x8a0 [ 1636.718364] __do_sys_perf_event_open+0xb9/0x2e60 [ 1636.719392] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1636.720396] ? perf_event_set_output+0x5b0/0x5b0 [ 1636.721375] ? wait_for_completion_io+0x270/0x270 [ 1636.722410] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1636.723513] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1636.724581] do_syscall_64+0x33/0x40 [ 1636.725369] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1636.726441] RIP: 0033:0x7fc2d1848b19 [ 1636.727229] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1636.731056] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1636.732658] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1636.734171] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1636.735664] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1636.737152] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1636.738648] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 21:51:53 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xfbffffffffff0f00) [ 1636.796335] FAULT_INJECTION: forcing a failure. [ 1636.796335] name failslab, interval 1, probability 0, space 0, times 0 [ 1636.798916] CPU: 0 PID: 10135 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1636.800371] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1636.802110] Call Trace: [ 1636.802660] dump_stack+0x107/0x167 [ 1636.803435] should_fail.cold+0x5/0xa [ 1636.804236] ? xas_alloc+0x336/0x440 [ 1636.805011] should_failslab+0x5/0x20 [ 1636.805808] kmem_cache_alloc+0x5b/0x310 [ 1636.806668] xas_alloc+0x336/0x440 [ 1636.807430] xas_create+0x34a/0x10d0 [ 1636.808217] ? kernel_text_address+0xf2/0x120 [ 1636.809159] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1636.810258] xas_store+0x8c/0x1c40 [ 1636.811012] __xa_store+0x164/0x2d0 [ 1636.811784] ? xa_delete_node+0x280/0x280 [ 1636.812656] ? trace_hardirqs_on+0x5b/0x180 [ 1636.813566] xa_store+0x31/0x50 [ 1636.814261] __io_uring_add_tctx_node+0x1cf/0x520 [ 1636.815269] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1636.816381] ? alloc_fd+0x2e7/0x670 [ 1636.817164] io_uring_setup+0x1fbb/0x2980 [ 1636.818042] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1636.819100] ? wait_for_completion_io+0x270/0x270 [ 1636.820140] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1636.821234] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1636.822320] do_syscall_64+0x33/0x40 [ 1636.823098] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1636.824171] RIP: 0033:0x7f43c90c3b19 [ 1636.824956] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1636.828847] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1636.830440] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1636.831941] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1636.833449] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1636.834939] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1636.836451] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:52:09 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 50) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:52:09 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x700000000000000) 21:52:09 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 50) 21:52:09 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 2) 21:52:09 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xfbffffffffff0f00) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:52:09 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x7ffffffff000, 0x100000e, 0x13, r2, 0x0) 21:52:09 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff0ff04900000000) 21:52:09 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB]) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1652.334955] FAULT_INJECTION: forcing a failure. [ 1652.334955] name failslab, interval 1, probability 0, space 0, times 0 [ 1652.337890] CPU: 0 PID: 10152 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1652.339676] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1652.341788] Call Trace: [ 1652.341902] FAULT_INJECTION: forcing a failure. [ 1652.341902] name failslab, interval 1, probability 0, space 0, times 0 [ 1652.342462] dump_stack+0x107/0x167 [ 1652.342489] should_fail.cold+0x5/0xa [ 1652.342512] ? perf_event_alloc.part.0+0x5b/0x2b70 [ 1652.342532] should_failslab+0x5/0x20 [ 1652.342554] kmem_cache_alloc_trace+0x55/0x320 [ 1652.342582] perf_event_alloc.part.0+0x5b/0x2b70 [ 1652.351333] ? alloc_fd+0x2e7/0x670 [ 1652.352277] __do_sys_perf_event_open+0x579/0x2e60 [ 1652.353533] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1652.354760] ? perf_event_set_output+0x5b0/0x5b0 [ 1652.355976] ? wait_for_completion_io+0x270/0x270 [ 1652.357230] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1652.358570] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1652.359897] do_syscall_64+0x33/0x40 [ 1652.360770] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1652.361855] RIP: 0033:0x7fc2d1848b19 [ 1652.362640] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1652.366537] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1652.368157] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1652.369659] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1652.371171] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1652.372681] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1652.374294] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 [ 1652.375839] CPU: 1 PID: 10153 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1652.377276] FAULT_INJECTION: forcing a failure. [ 1652.377276] name failslab, interval 1, probability 0, space 0, times 0 [ 1652.377303] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1652.377316] Call Trace: [ 1652.381942] dump_stack+0x107/0x167 [ 1652.382716] should_fail.cold+0x5/0xa [ 1652.383530] ? ___slab_alloc+0x155/0x700 [ 1652.384390] ? create_object.isra.0+0x3a/0xa30 [ 1652.385346] should_failslab+0x5/0x20 [ 1652.386150] kmem_cache_alloc+0x5b/0x310 [ 1652.387008] create_object.isra.0+0x3a/0xa30 [ 1652.387938] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1652.389011] kmem_cache_alloc+0x159/0x310 [ 1652.389885] xas_alloc+0x336/0x440 [ 1652.390635] xas_create+0x34a/0x10d0 [ 1652.391425] ? kernel_text_address+0xf2/0x120 [ 1652.392382] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1652.393482] xas_store+0x8c/0x1c40 [ 1652.394243] __xa_store+0x164/0x2d0 [ 1652.395006] ? xa_delete_node+0x280/0x280 [ 1652.395899] ? trace_hardirqs_on+0x5b/0x180 [ 1652.396810] xa_store+0x31/0x50 [ 1652.397507] __io_uring_add_tctx_node+0x1cf/0x520 [ 1652.398522] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1652.399630] ? alloc_fd+0x2e7/0x670 [ 1652.400406] io_uring_setup+0x1fbb/0x2980 [ 1652.401285] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1652.402351] ? wait_for_completion_io+0x270/0x270 [ 1652.403391] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1652.404504] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1652.405589] do_syscall_64+0x33/0x40 [ 1652.406375] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1652.407455] RIP: 0033:0x7f741addcb19 [ 1652.408246] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1652.412130] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1652.413736] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1652.415241] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1652.416748] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1652.418247] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1652.419757] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1652.421295] CPU: 0 PID: 10146 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1652.422774] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1652.424525] Call Trace: [ 1652.425085] dump_stack+0x107/0x167 [ 1652.425866] should_fail.cold+0x5/0xa [ 1652.426677] ? create_object.isra.0+0x3a/0xa30 [ 1652.427650] should_failslab+0x5/0x20 [ 1652.428464] kmem_cache_alloc+0x5b/0x310 [ 1652.429315] ? mark_held_locks+0x9e/0xe0 [ 1652.430178] create_object.isra.0+0x3a/0xa30 [ 1652.431097] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1652.432195] kmem_cache_alloc+0x159/0x310 [ 1652.433076] xas_alloc+0x336/0x440 [ 1652.433826] xas_create+0x34a/0x10d0 [ 1652.434623] ? kernel_text_address+0xf2/0x120 [ 1652.435580] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1652.436697] xas_store+0x8c/0x1c40 [ 1652.437460] __xa_store+0x164/0x2d0 [ 1652.438228] ? xa_delete_node+0x280/0x280 [ 1652.439103] ? trace_hardirqs_on+0x5b/0x180 [ 1652.440029] xa_store+0x31/0x50 [ 1652.440738] __io_uring_add_tctx_node+0x1cf/0x520 [ 1652.441749] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1652.442843] ? alloc_fd+0x2e7/0x670 [ 1652.443626] io_uring_setup+0x1fbb/0x2980 [ 1652.444513] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1652.445572] ? wait_for_completion_io+0x270/0x270 [ 1652.446604] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1652.447723] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1652.448816] do_syscall_64+0x33/0x40 [ 1652.449609] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1652.450694] RIP: 0033:0x7f43c90c3b19 [ 1652.451471] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1652.455347] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1652.456963] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1652.458464] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1652.459980] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1652.461474] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1652.462985] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:52:09 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x4000000000000000) 21:52:09 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff0ff04900000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:52:09 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff3f804900000000) 21:52:09 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x13, r2, 0x0) 21:52:09 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:52:09 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 3) 21:52:09 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 51) [ 1652.661573] FAULT_INJECTION: forcing a failure. [ 1652.661573] name failslab, interval 1, probability 0, space 0, times 0 [ 1652.664109] CPU: 0 PID: 10182 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1652.665556] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1652.667291] Call Trace: [ 1652.667870] dump_stack+0x107/0x167 [ 1652.668642] should_fail.cold+0x5/0xa [ 1652.669443] ? create_object.isra.0+0x3a/0xa30 [ 1652.670391] should_failslab+0x5/0x20 [ 1652.671197] kmem_cache_alloc+0x5b/0x310 [ 1652.672069] create_object.isra.0+0x3a/0xa30 [ 1652.672997] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1652.674073] kmem_cache_alloc_trace+0x151/0x320 [ 1652.675057] perf_event_alloc.part.0+0x5b/0x2b70 [ 1652.676060] ? alloc_fd+0x2e7/0x670 [ 1652.676843] __do_sys_perf_event_open+0x579/0x2e60 [ 1652.677889] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1652.678909] ? perf_event_set_output+0x5b0/0x5b0 [ 1652.679908] ? wait_for_completion_io+0x270/0x270 [ 1652.680943] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1652.682048] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1652.683136] do_syscall_64+0x33/0x40 [ 1652.683928] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1652.685004] RIP: 0033:0x7fc2d1848b19 [ 1652.685888] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1652.689977] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1652.691616] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1652.691664] FAULT_INJECTION: forcing a failure. [ 1652.691664] name failslab, interval 1, probability 0, space 0, times 0 [ 1652.693152] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1652.693164] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1652.693175] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1652.693186] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 [ 1652.702150] CPU: 1 PID: 10183 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1652.703602] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1652.705347] Call Trace: [ 1652.705902] dump_stack+0x107/0x167 [ 1652.706666] should_fail.cold+0x5/0xa [ 1652.707473] ? xas_alloc+0x336/0x440 [ 1652.708264] should_failslab+0x5/0x20 [ 1652.709066] kmem_cache_alloc+0x5b/0x310 [ 1652.709921] xas_alloc+0x336/0x440 [ 1652.710673] xas_create+0x34a/0x10d0 [ 1652.711458] ? kernel_text_address+0xf2/0x120 [ 1652.712411] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1652.713509] xas_store+0x8c/0x1c40 [ 1652.714272] __xa_store+0x164/0x2d0 [ 1652.715038] ? xa_delete_node+0x280/0x280 [ 1652.715919] ? trace_hardirqs_on+0x5b/0x180 [ 1652.716829] xa_store+0x31/0x50 [ 1652.717521] __io_uring_add_tctx_node+0x1cf/0x520 [ 1652.718529] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1652.719628] ? alloc_fd+0x2e7/0x670 [ 1652.720411] io_uring_setup+0x1fbb/0x2980 [ 1652.721283] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1652.722340] ? wait_for_completion_io+0x270/0x270 [ 1652.723368] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1652.724483] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1652.725560] do_syscall_64+0x33/0x40 [ 1652.726336] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1652.727407] RIP: 0033:0x7f43c90c3b19 [ 1652.728208] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1652.732064] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1652.733650] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1652.735144] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1652.736643] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1652.738128] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1652.739626] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:52:09 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xfbffffffffff0f00) 21:52:09 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 51) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:52:09 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff3ff04900000000) [ 1652.800680] FAULT_INJECTION: forcing a failure. [ 1652.800680] name failslab, interval 1, probability 0, space 0, times 0 [ 1652.803444] CPU: 0 PID: 10185 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1652.804929] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1652.806677] Call Trace: [ 1652.807239] dump_stack+0x107/0x167 [ 1652.808020] should_fail.cold+0x5/0xa [ 1652.808828] ? xas_alloc+0x336/0x440 [ 1652.809611] should_failslab+0x5/0x20 [ 1652.810415] kmem_cache_alloc+0x5b/0x310 [ 1652.811277] xas_alloc+0x336/0x440 [ 1652.812038] xas_create+0x34a/0x10d0 [ 1652.812828] ? kernel_text_address+0xf2/0x120 [ 1652.813776] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1652.814877] xas_store+0x8c/0x1c40 [ 1652.815650] __xa_store+0x164/0x2d0 [ 1652.816420] ? xa_delete_node+0x280/0x280 [ 1652.817304] ? trace_hardirqs_on+0x5b/0x180 [ 1652.818221] xa_store+0x31/0x50 [ 1652.818924] __io_uring_add_tctx_node+0x1cf/0x520 [ 1652.819953] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1652.821062] ? alloc_fd+0x2e7/0x670 [ 1652.821840] io_uring_setup+0x1fbb/0x2980 [ 1652.822722] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1652.823801] ? wait_for_completion_io+0x270/0x270 [ 1652.824839] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1652.825942] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1652.827038] do_syscall_64+0x33/0x40 [ 1652.827831] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1652.828908] RIP: 0033:0x7f741addcb19 [ 1652.829690] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1652.833579] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1652.835172] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1652.836685] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1652.838193] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1652.839704] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1652.841200] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1666.386758] FAULT_INJECTION: forcing a failure. [ 1666.386758] name failslab, interval 1, probability 0, space 0, times 0 [ 1666.389444] CPU: 0 PID: 10200 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1666.390967] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1666.392808] Call Trace: [ 1666.393395] dump_stack+0x107/0x167 [ 1666.394198] should_fail.cold+0x5/0xa [ 1666.395037] ? create_object.isra.0+0x3a/0xa30 [ 1666.396009] should_failslab+0x5/0x20 [ 1666.396799] kmem_cache_alloc+0x5b/0x310 [ 1666.397663] ? mark_held_locks+0x9e/0xe0 [ 1666.398531] create_object.isra.0+0x3a/0xa30 [ 1666.399456] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1666.400534] kmem_cache_alloc+0x159/0x310 [ 1666.401415] xas_alloc+0x336/0x440 [ 1666.402169] xas_create+0x34a/0x10d0 [ 1666.402961] ? kernel_text_address+0xf2/0x120 [ 1666.403895] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1666.404992] xas_store+0x8c/0x1c40 [ 1666.405745] __xa_store+0x164/0x2d0 [ 1666.406502] ? xa_delete_node+0x280/0x280 [ 1666.407377] ? trace_hardirqs_on+0x5b/0x180 [ 1666.408306] xa_store+0x31/0x50 [ 1666.409016] __io_uring_add_tctx_node+0x1cf/0x520 [ 1666.410037] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1666.411136] ? alloc_fd+0x2e7/0x670 [ 1666.411917] io_uring_setup+0x1fbb/0x2980 [ 1666.412791] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1666.413843] ? wait_for_completion_io+0x270/0x270 [ 1666.414863] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1666.415964] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1666.417052] do_syscall_64+0x33/0x40 [ 1666.417832] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1666.418916] RIP: 0033:0x7f43c90c3b19 [ 1666.419703] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1666.423825] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1666.425425] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1666.426925] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1666.428413] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1666.429922] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1666.431414] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:52:23 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 52) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:52:23 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff3fc04900000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:52:23 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 52) 21:52:23 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 4) 21:52:23 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x2) 21:52:23 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff0f704700000000) 21:52:23 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:52:23 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xffffffff00000000) 21:52:23 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff3f704700000000) [ 1666.465638] FAULT_INJECTION: forcing a failure. [ 1666.465638] name failslab, interval 1, probability 0, space 0, times 0 [ 1666.468450] CPU: 1 PID: 10215 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1666.469903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1666.471640] Call Trace: [ 1666.472205] dump_stack+0x107/0x167 [ 1666.472984] should_fail.cold+0x5/0xa [ 1666.473496] FAULT_INJECTION: forcing a failure. [ 1666.473496] name failslab, interval 1, probability 0, space 0, times 0 [ 1666.473806] ? allocate_fake_cpuc+0x45/0x110 [ 1666.477094] should_failslab+0x5/0x20 [ 1666.477903] kmem_cache_alloc_trace+0x55/0x320 [ 1666.478858] ? x86_pmu_hw_config+0x3ec/0x850 [ 1666.479821] allocate_fake_cpuc+0x45/0x110 [ 1666.480715] x86_pmu_event_init+0x4e9/0x6e0 [ 1666.481611] perf_try_init_event+0x130/0x570 [ 1666.482557] perf_event_alloc.part.0+0xd96/0x2b70 [ 1666.483580] __do_sys_perf_event_open+0x579/0x2e60 [ 1666.484649] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1666.485671] ? perf_event_set_output+0x5b0/0x5b0 [ 1666.486676] ? wait_for_completion_io+0x270/0x270 [ 1666.487691] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1666.488757] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1666.489827] do_syscall_64+0x33/0x40 [ 1666.490619] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1666.491713] RIP: 0033:0x7fc2d1848b19 [ 1666.492520] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1666.496312] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1666.497921] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1666.499420] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1666.500928] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1666.502395] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1666.503855] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 [ 1666.505398] CPU: 0 PID: 10217 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1666.506892] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1666.508644] Call Trace: [ 1666.509217] dump_stack+0x107/0x167 [ 1666.509997] should_fail.cold+0x5/0xa [ 1666.510800] ? create_object.isra.0+0x3a/0xa30 [ 1666.511768] should_failslab+0x5/0x20 [ 1666.512574] kmem_cache_alloc+0x5b/0x310 [ 1666.513427] ? mark_held_locks+0x9e/0xe0 [ 1666.514292] create_object.isra.0+0x3a/0xa30 [ 1666.515218] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1666.516300] kmem_cache_alloc+0x159/0x310 [ 1666.517179] xas_alloc+0x336/0x440 [ 1666.517941] xas_create+0x34a/0x10d0 [ 1666.518737] ? kernel_text_address+0xf2/0x120 [ 1666.519702] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1666.520807] xas_store+0x8c/0x1c40 [ 1666.521584] __xa_store+0x164/0x2d0 [ 1666.522352] ? xa_delete_node+0x280/0x280 [ 1666.523246] ? trace_hardirqs_on+0x5b/0x180 [ 1666.524173] xa_store+0x31/0x50 [ 1666.524872] __io_uring_add_tctx_node+0x1cf/0x520 [ 1666.525899] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1666.527006] ? alloc_fd+0x2e7/0x670 [ 1666.527790] io_uring_setup+0x1fbb/0x2980 [ 1666.528678] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1666.529746] ? wait_for_completion_io+0x270/0x270 [ 1666.530775] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1666.531891] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1666.532972] do_syscall_64+0x33/0x40 [ 1666.533752] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1666.534828] RIP: 0033:0x7f741addcb19 [ 1666.535614] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1666.539482] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1666.541097] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1666.542613] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1666.544121] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1666.545647] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1666.547153] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:52:23 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff3ff04900000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:52:38 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 53) 21:52:38 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xffffffff00000000) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:52:38 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 5) 21:52:38 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x3) 21:52:38 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xff3fe04900000000) [ 1681.046827] FAULT_INJECTION: forcing a failure. [ 1681.046827] name failslab, interval 1, probability 0, space 0, times 0 [ 1681.050286] CPU: 0 PID: 10233 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1681.050791] FAULT_INJECTION: forcing a failure. [ 1681.050791] name failslab, interval 1, probability 0, space 0, times 0 [ 1681.052073] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1681.052081] Call Trace: [ 1681.052111] dump_stack+0x107/0x167 [ 1681.052141] should_fail.cold+0x5/0xa [ 1681.058359] ? xas_alloc+0x336/0x440 [ 1681.059306] should_failslab+0x5/0x20 [ 1681.060287] kmem_cache_alloc+0x5b/0x310 [ 1681.061189] xas_alloc+0x336/0x440 [ 1681.061944] xas_create+0x34a/0x10d0 [ 1681.062735] ? kernel_text_address+0xf2/0x120 [ 1681.063688] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1681.064808] xas_store+0x8c/0x1c40 [ 1681.065571] __xa_store+0x164/0x2d0 [ 1681.066340] ? xa_delete_node+0x280/0x280 [ 1681.067226] ? trace_hardirqs_on+0x5b/0x180 [ 1681.068148] xa_store+0x31/0x50 [ 1681.068847] __io_uring_add_tctx_node+0x1cf/0x520 [ 1681.069859] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1681.070967] ? alloc_fd+0x2e7/0x670 [ 1681.071744] io_uring_setup+0x1fbb/0x2980 [ 1681.072642] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1681.073712] ? wait_for_completion_io+0x270/0x270 [ 1681.074746] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1681.075864] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1681.076952] do_syscall_64+0x33/0x40 [ 1681.077734] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1681.078884] RIP: 0033:0x7f43c90c3b19 [ 1681.079910] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1681.084918] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1681.087003] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1681.088601] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1681.090268] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1681.091886] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1681.093351] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1681.094893] CPU: 1 PID: 10244 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1681.096494] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1681.098357] Call Trace: [ 1681.098953] dump_stack+0x107/0x167 [ 1681.099792] should_fail.cold+0x5/0xa [ 1681.100645] ? xas_alloc+0x336/0x440 [ 1681.101480] should_failslab+0x5/0x20 [ 1681.102332] kmem_cache_alloc+0x5b/0x310 [ 1681.103242] xas_alloc+0x336/0x440 [ 1681.103407] FAULT_INJECTION: forcing a failure. [ 1681.103407] name failslab, interval 1, probability 0, space 0, times 0 [ 1681.104065] xas_create+0x34a/0x10d0 [ 1681.104101] ? kernel_text_address+0xf2/0x120 [ 1681.108219] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1681.109403] xas_store+0x8c/0x1c40 [ 1681.110217] __xa_store+0x164/0x2d0 [ 1681.111039] ? xa_delete_node+0x280/0x280 [ 1681.111991] ? trace_hardirqs_on+0x5b/0x180 [ 1681.112971] xa_store+0x31/0x50 [ 1681.113718] __io_uring_add_tctx_node+0x1cf/0x520 [ 1681.114804] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1681.115996] ? alloc_fd+0x2e7/0x670 [ 1681.116826] io_uring_setup+0x1fbb/0x2980 [ 1681.117767] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1681.118903] ? wait_for_completion_io+0x270/0x270 [ 1681.120026] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1681.121206] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1681.122375] do_syscall_64+0x33/0x40 [ 1681.123212] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1681.124381] RIP: 0033:0x7f741addcb19 [ 1681.125217] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1681.129380] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1681.131086] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1681.132691] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1681.134295] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1681.135914] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1681.137513] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1681.139163] CPU: 0 PID: 10247 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1681.141047] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1681.143006] Call Trace: [ 1681.143601] dump_stack+0x107/0x167 [ 1681.144399] should_fail.cold+0x5/0xa [ 1681.145283] ? create_object.isra.0+0x3a/0xa30 [ 1681.146275] should_failslab+0x5/0x20 [ 1681.147114] kmem_cache_alloc+0x5b/0x310 [ 1681.148018] ? lock_release+0x680/0x680 [ 1681.148891] create_object.isra.0+0x3a/0xa30 [ 1681.149835] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1681.150911] kmem_cache_alloc_trace+0x151/0x320 [ 1681.151921] allocate_fake_cpuc+0x45/0x110 [ 1681.152814] x86_pmu_event_init+0x4e9/0x6e0 [ 1681.153723] perf_try_init_event+0x130/0x570 [ 1681.154654] perf_event_alloc.part.0+0xd96/0x2b70 [ 1681.155679] __do_sys_perf_event_open+0x579/0x2e60 [ 1681.156733] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1681.157749] ? perf_event_set_output+0x5b0/0x5b0 [ 1681.158742] ? wait_for_completion_io+0x270/0x270 [ 1681.159795] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1681.160904] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1681.161996] do_syscall_64+0x33/0x40 [ 1681.162779] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1681.163868] RIP: 0033:0x7fc2d1848b19 [ 1681.164652] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1681.168539] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1681.170142] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1681.171655] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1681.173165] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1681.174676] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1681.176195] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 21:52:38 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:52:38 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 53) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:52:38 executing program 6: r0 = fspick(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x44) r1 = syz_io_uring_setup(0x75a, &(0x7f00000000c0)={0x0, 0xa7b1, 0x2, 0x3, 0x26}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000140), &(0x7f00000001c0)=0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/fib_trie\x00') r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_CONNECT={0x10, 0x1, 0x0, 0xffffffffffffffff, 0x80, &(0x7f0000000340)=@un=@abs={0x0, 0x0, 0x8}, 0x0, 0x0, 0x1, {0x0, r4}}, 0x4) syz_io_uring_submit(0x0, r2, &(0x7f0000000380)=@IORING_OP_LINK_TIMEOUT={0xf, 0x4, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x77359400}, 0x1, 0x0, 0x0, {0x0, r4}}, 0x5) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x6}}, './file0\x00'}) syz_io_uring_setup(0x6c2, &(0x7f0000000400)={0x0, 0xfc9c, 0x4, 0x4, 0x34}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000480)=0x0, &(0x7f00000004c0)) syz_io_uring_setup(0x6f08, &(0x7f0000000500)={0x0, 0xcbac, 0x0, 0x2, 0x264, 0x0, r1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000580), &(0x7f00000005c0)=0x0) r7 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r7, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) r8 = syz_open_dev$vcsa(&(0x7f0000000600), 0xfffffffffffffc01, 0x101400) r9 = socket$nl_audit(0x10, 0x3, 0x9) syz_io_uring_submit(r5, r6, &(0x7f0000000640)=@IORING_OP_SPLICE={0x1e, 0x3, 0x0, @fd=r7, 0x5, {0x0, r8}, 0x7fff, 0x6, 0x158d7fef954dde43, {0x0, 0x0, r9}}, 0x1) perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r10 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r10, 0x0) 21:52:38 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0xffffffff00000000) 21:52:38 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x4) 21:52:38 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') writev(r2, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) mmap$IORING_OFF_SQ_RING(&(0x7f0000787000/0x2000)=nil, 0x2000, 0x9, 0x8010, r2, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) r3 = openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x2f4, &(0x7f0000000040)={0x0, 0x74c5, 0x4, 0x3, 0x166, 0x0, r3}, &(0x7f000007b000/0x2000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000100)) syz_io_uring_setup(0x47cf, &(0x7f0000000140)={0x0, 0x1f46, 0x8, 0x1, 0x38, 0x0, r3}, &(0x7f00009e0000/0x4000)=nil, &(0x7f0000b9e000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000340)=0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/fib_trie\x00') r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_CONNECT={0x10, 0x1, 0x0, 0xffffffffffffffff, 0x80, &(0x7f0000000340)=@un=@abs={0x0, 0x0, 0x8}, 0x0, 0x0, 0x1, {0x0, r7}}, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000440)=@IORING_OP_ACCEPT={0xd, 0x2, 0x0, r3, &(0x7f0000000380)=0x80, &(0x7f00000003c0)=@pptp={0x18, 0x2, {0x0, @private}}, 0x0, 0x800, 0x1, {0x0, r7}}, 0x2) 21:52:38 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x5) 21:52:38 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x4000, 0x0) io_uring_enter(r1, 0x4bcd, 0xe2bc, 0x1, &(0x7f0000000040)={[0x40]}, 0x8) 21:52:38 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./fi']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:52:38 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x3c8}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) io_uring_enter(r2, 0x47e6, 0x3aa8, 0x1, &(0x7f0000000080)={[0x7]}, 0x8) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$F2FS_IOC_DEFRAGMENT(r1, 0xc010f508, &(0x7f0000000000)={0x401, 0x2}) 21:52:38 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 54) 21:52:38 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) io_uring_enter(r0, 0x18f3, 0x74ed, 0x1, &(0x7f0000000000)={[0x7ff]}, 0x8) [ 1681.519542] FAULT_INJECTION: forcing a failure. 21:52:38 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x6) 21:52:38 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 6) 21:52:38 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000032000/0x3000)=nil, 0x3000, 0x4000002, 0x20010, r0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1681.519542] name failslab, interval 1, probability 0, space 0, times 0 [ 1681.522614] CPU: 1 PID: 10280 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1681.524189] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1681.526042] Call Trace: [ 1681.526635] dump_stack+0x107/0x167 [ 1681.527454] should_fail.cold+0x5/0xa [ 1681.528319] ? xas_alloc+0x336/0x440 [ 1681.529155] should_failslab+0x5/0x20 [ 1681.530003] kmem_cache_alloc+0x5b/0x310 [ 1681.530914] xas_alloc+0x336/0x440 [ 1681.531721] xas_create+0x34a/0x10d0 [ 1681.532573] ? kernel_text_address+0xf2/0x120 [ 1681.533593] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1681.534765] xas_store+0x8c/0x1c40 [ 1681.535572] __xa_store+0x164/0x2d0 [ 1681.536404] ? xa_delete_node+0x280/0x280 [ 1681.537342] ? trace_hardirqs_on+0x5b/0x180 [ 1681.538319] xa_store+0x31/0x50 [ 1681.539060] __io_uring_add_tctx_node+0x1cf/0x520 [ 1681.540154] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1681.541324] ? alloc_fd+0x2e7/0x670 [ 1681.542146] io_uring_setup+0x1fbb/0x2980 [ 1681.543083] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1681.544232] ? wait_for_completion_io+0x270/0x270 [ 1681.545333] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1681.546508] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1681.547666] do_syscall_64+0x33/0x40 [ 1681.548802] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1681.550098] RIP: 0033:0x7f43c90c3b19 [ 1681.551039] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1681.555133] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1681.556736] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1681.558224] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1681.559713] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1681.561217] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1681.562717] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1681.572612] FAULT_INJECTION: forcing a failure. [ 1681.572612] name failslab, interval 1, probability 0, space 0, times 0 [ 1681.575164] CPU: 0 PID: 10288 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1681.576642] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1681.578403] Call Trace: [ 1681.578947] dump_stack+0x107/0x167 [ 1681.579725] should_fail.cold+0x5/0xa [ 1681.580546] ? create_object.isra.0+0x3a/0xa30 [ 1681.581521] should_failslab+0x5/0x20 [ 1681.582329] kmem_cache_alloc+0x5b/0x310 [ 1681.583192] ? lock_release+0x680/0x680 [ 1681.584044] create_object.isra.0+0x3a/0xa30 [ 1681.584969] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1681.586048] kmem_cache_alloc_trace+0x151/0x320 [ 1681.587038] allocate_fake_cpuc+0x45/0x110 [ 1681.587932] x86_pmu_event_init+0x4e9/0x6e0 [ 1681.588849] perf_try_init_event+0x130/0x570 [ 1681.589779] perf_event_alloc.part.0+0xd96/0x2b70 [ 1681.590881] __do_sys_perf_event_open+0x579/0x2e60 [ 1681.592247] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1681.593587] ? perf_event_set_output+0x5b0/0x5b0 [ 1681.594875] ? wait_for_completion_io+0x270/0x270 [ 1681.596243] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1681.597672] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1681.599095] do_syscall_64+0x33/0x40 [ 1681.599932] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1681.601205] RIP: 0033:0x7fc2d1848b19 [ 1681.602029] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1681.606032] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1681.607637] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1681.609148] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1681.610652] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1681.612161] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1681.613667] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 21:52:38 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 55) 21:52:38 executing program 6: rename(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') perf_event_open(&(0x7f00000000c0)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/mdstat\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:52:38 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 54) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) [ 1681.724588] FAULT_INJECTION: forcing a failure. [ 1681.724588] name failslab, interval 1, probability 0, space 0, times 0 [ 1681.727221] CPU: 1 PID: 10297 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1681.728699] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1681.730447] Call Trace: [ 1681.731005] dump_stack+0x107/0x167 [ 1681.731776] should_fail.cold+0x5/0xa [ 1681.732598] ? create_object.isra.0+0x3a/0xa30 [ 1681.733556] should_failslab+0x5/0x20 [ 1681.734357] kmem_cache_alloc+0x5b/0x310 [ 1681.735215] ? mark_held_locks+0x9e/0xe0 [ 1681.736088] create_object.isra.0+0x3a/0xa30 [ 1681.737015] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1681.738090] kmem_cache_alloc+0x159/0x310 [ 1681.738968] xas_alloc+0x336/0x440 [ 1681.739721] xas_create+0x34a/0x10d0 [ 1681.740520] ? kernel_text_address+0xf2/0x120 [ 1681.741464] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1681.742566] xas_store+0x8c/0x1c40 [ 1681.743328] __xa_store+0x164/0x2d0 [ 1681.744107] ? xa_delete_node+0x280/0x280 [ 1681.744999] ? trace_hardirqs_on+0x5b/0x180 [ 1681.745916] xa_store+0x31/0x50 [ 1681.746620] __io_uring_add_tctx_node+0x1cf/0x520 [ 1681.747633] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1681.748743] ? alloc_fd+0x2e7/0x670 [ 1681.749519] io_uring_setup+0x1fbb/0x2980 [ 1681.750400] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1681.751462] ? wait_for_completion_io+0x270/0x270 [ 1681.752506] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1681.753619] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1681.754721] do_syscall_64+0x33/0x40 [ 1681.755506] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1681.756605] RIP: 0033:0x7f43c90c3b19 [ 1681.757393] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1681.761273] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1681.762872] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1681.764377] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1681.765885] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1681.767397] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1681.768901] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1681.801951] FAULT_INJECTION: forcing a failure. [ 1681.801951] name failslab, interval 1, probability 0, space 0, times 0 [ 1681.804904] CPU: 0 PID: 10301 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1681.806383] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1681.808169] Call Trace: [ 1681.808839] dump_stack+0x107/0x167 [ 1681.809739] should_fail.cold+0x5/0xa [ 1681.810565] ? create_object.isra.0+0x3a/0xa30 [ 1681.811561] should_failslab+0x5/0x20 [ 1681.812386] kmem_cache_alloc+0x5b/0x310 [ 1681.813280] ? mark_held_locks+0x9e/0xe0 [ 1681.814139] create_object.isra.0+0x3a/0xa30 [ 1681.815065] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1681.816146] kmem_cache_alloc+0x159/0x310 [ 1681.817029] xas_alloc+0x336/0x440 [ 1681.817779] xas_create+0x34a/0x10d0 [ 1681.818573] ? kernel_text_address+0xf2/0x120 [ 1681.819517] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1681.820635] xas_store+0x8c/0x1c40 [ 1681.821399] __xa_store+0x164/0x2d0 [ 1681.822167] ? xa_delete_node+0x280/0x280 [ 1681.823046] ? trace_hardirqs_on+0x5b/0x180 [ 1681.823972] xa_store+0x31/0x50 [ 1681.824675] __io_uring_add_tctx_node+0x1cf/0x520 [ 1681.825691] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1681.826797] ? alloc_fd+0x2e7/0x670 [ 1681.827580] io_uring_setup+0x1fbb/0x2980 [ 1681.828471] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1681.829541] ? wait_for_completion_io+0x270/0x270 [ 1681.830582] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1681.831694] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1681.832791] do_syscall_64+0x33/0x40 [ 1681.833583] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1681.834662] RIP: 0033:0x7f741addcb19 [ 1681.835447] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1681.839335] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1681.840950] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1681.842454] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1681.843968] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1681.845472] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1681.846979] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:52:52 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./fi']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1695.709901] FAULT_INJECTION: forcing a failure. [ 1695.709901] name failslab, interval 1, probability 0, space 0, times 0 [ 1695.711893] FAULT_INJECTION: forcing a failure. [ 1695.711893] name failslab, interval 1, probability 0, space 0, times 0 [ 1695.712528] CPU: 0 PID: 10310 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1695.715066] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1695.716840] Call Trace: [ 1695.717399] dump_stack+0x107/0x167 [ 1695.718168] should_fail.cold+0x5/0xa [ 1695.718970] ? xas_alloc+0x336/0x440 [ 1695.719750] should_failslab+0x5/0x20 [ 1695.720577] kmem_cache_alloc+0x5b/0x310 [ 1695.721435] xas_alloc+0x336/0x440 [ 1695.722187] xas_create+0x34a/0x10d0 [ 1695.722977] ? kernel_text_address+0xf2/0x120 [ 1695.723938] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1695.725065] xas_store+0x8c/0x1c40 [ 1695.725822] __xa_store+0x164/0x2d0 [ 1695.726592] ? xa_delete_node+0x280/0x280 [ 1695.727469] ? trace_hardirqs_on+0x5b/0x180 [ 1695.728417] xa_store+0x31/0x50 [ 1695.729116] __io_uring_add_tctx_node+0x1cf/0x520 [ 1695.730126] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1695.731227] ? alloc_fd+0x2e7/0x670 [ 1695.732034] io_uring_setup+0x1fbb/0x2980 [ 1695.732914] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1695.733979] ? wait_for_completion_io+0x270/0x270 [ 1695.735016] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1695.736151] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1695.737243] do_syscall_64+0x33/0x40 [ 1695.738026] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1695.739099] RIP: 0033:0x7f43c90c3b19 [ 1695.739879] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1695.743775] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1695.745396] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1695.746894] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1695.748424] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1695.749932] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1695.751428] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1695.752981] CPU: 1 PID: 10311 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1695.753731] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1695.754619] Call Trace: [ 1695.754907] dump_stack+0x107/0x167 [ 1695.755304] should_fail.cold+0x5/0xa [ 1695.755713] ? xas_alloc+0x336/0x440 [ 1695.756120] should_failslab+0x5/0x20 [ 1695.756527] kmem_cache_alloc+0x5b/0x310 [ 1695.756963] xas_alloc+0x336/0x440 [ 1695.757344] xas_create+0x34a/0x10d0 [ 1695.757749] ? kernel_text_address+0xf2/0x120 [ 1695.758238] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1695.758810] xas_store+0x8c/0x1c40 [ 1695.759204] __xa_store+0x164/0x2d0 [ 1695.759597] ? xa_delete_node+0x280/0x280 [ 1695.760051] ? trace_hardirqs_on+0x5b/0x180 [ 1695.760521] xa_store+0x31/0x50 [ 1695.760877] __io_uring_add_tctx_node+0x1cf/0x520 [ 1695.761393] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1695.761577] FAULT_INJECTION: forcing a failure. [ 1695.761577] name failslab, interval 1, probability 0, space 0, times 0 [ 1695.761954] ? alloc_fd+0x2e7/0x670 [ 1695.761971] io_uring_setup+0x1fbb/0x2980 [ 1695.761991] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1695.765685] ? wait_for_completion_io+0x270/0x270 [ 1695.766212] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1695.766776] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1695.767367] do_syscall_64+0x33/0x40 [ 1695.767767] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1695.768319] RIP: 0033:0x7f741addcb19 [ 1695.768740] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1695.770703] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1695.771512] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1695.772282] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1695.773090] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1695.773852] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1695.774610] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1695.775446] CPU: 0 PID: 10313 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1695.776951] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1695.778702] Call Trace: [ 1695.779256] dump_stack+0x107/0x167 [ 1695.780045] should_fail.cold+0x5/0xa [ 1695.780846] ? create_object.isra.0+0x3a/0xa30 [ 1695.781802] should_failslab+0x5/0x20 [ 1695.782611] kmem_cache_alloc+0x5b/0x310 [ 1695.783463] ? slab_free_freelist_hook+0xa9/0x180 [ 1695.784502] create_object.isra.0+0x3a/0xa30 [ 1695.785415] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1695.786484] kmem_cache_alloc_trace+0x151/0x320 [ 1695.787459] selinux_perf_event_alloc+0x43/0x190 [ 1695.788489] security_perf_event_alloc+0x46/0xa0 [ 1695.789486] perf_event_alloc.part.0+0x18b3/0x2b70 [ 1695.790728] __do_sys_perf_event_open+0x579/0x2e60 [ 1695.791771] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1695.793143] ? perf_event_set_output+0x5b0/0x5b0 [ 1695.794335] ? wait_for_completion_io+0x270/0x270 [ 1695.795562] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1695.796786] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1695.797862] do_syscall_64+0x33/0x40 [ 1695.798636] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1695.799705] RIP: 0033:0x7fc2d1848b19 [ 1695.800503] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1695.804335] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1695.805923] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1695.807406] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1695.808884] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1695.810367] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1695.811850] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 21:52:52 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 55) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:52:52 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 56) 21:52:52 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 7) 21:52:52 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x7) 21:52:52 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x385e, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x214}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:52:52 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:52:52 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000024c0)={0x0, 0x0, 0x4, 0x0, 0xfffffffc}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x3, 0x0) readv(r1, &(0x7f0000002340)=[{&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000000040)=""/59, 0x3b}, {&(0x7f0000000080)=""/248, 0xf8}, {&(0x7f00000001c0)=""/21, 0x15}, {&(0x7f0000001340)=""/4096, 0x1000}], 0x5) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000002440)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r2, 0x8982, &(0x7f0000002480)) pipe(&(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000002400)={'vlan0\x00'}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:53:07 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 56) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:53:07 executing program 0: perf_event_open(&(0x7f0000000240)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)=0x0) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') syz_io_uring_submit(r2, r1, &(0x7f0000000140)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x77359400}, 0x1, 0x1, 0x1}, 0x0) writev(r3, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x3, 0x6, 0x1f, 0x0, 0x3ff, 0x84264, 0x8, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x91, 0x0, @perf_bp={&(0x7f0000000000), 0x6}, 0x800, 0xbf7b, 0xffffffff, 0x4, 0x0, 0x3, 0x6, 0x0, 0xabb6}, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0x1) 21:53:07 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./fi']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:53:07 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 8) [ 1710.724613] FAULT_INJECTION: forcing a failure. [ 1710.724613] name failslab, interval 1, probability 0, space 0, times 0 [ 1710.727191] CPU: 1 PID: 10339 Comm: syz-executor.1 Not tainted 5.10.262 #1 21:53:07 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') writev(r0, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f000021f000/0x3000)=nil, 0x3000, 0x300000e, 0x10, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1710.728680] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1710.730922] Call Trace: [ 1710.731805] dump_stack+0x107/0x167 [ 1710.733064] should_fail.cold+0x5/0xa [ 1710.734359] ? create_object.isra.0+0x3a/0xa30 21:53:07 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 57) [ 1710.735886] should_failslab+0x5/0x20 [ 1710.737138] kmem_cache_alloc+0x5b/0x310 [ 1710.738253] ? slab_free_freelist_hook+0xa9/0x180 [ 1710.739581] create_object.isra.0+0x3a/0xa30 [ 1710.740803] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1710.742201] kmem_cache_alloc_trace+0x151/0x320 [ 1710.743483] selinux_perf_event_alloc+0x43/0x190 [ 1710.744307] FAULT_INJECTION: forcing a failure. [ 1710.744307] name failslab, interval 1, probability 0, space 0, times 0 [ 1710.744799] security_perf_event_alloc+0x46/0xa0 [ 1710.744825] perf_event_alloc.part.0+0x18b3/0x2b70 [ 1710.749083] __do_sys_perf_event_open+0x579/0x2e60 [ 1710.750424] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1710.751739] ? perf_event_set_output+0x5b0/0x5b0 [ 1710.753029] ? wait_for_completion_io+0x270/0x270 [ 1710.754360] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1710.755780] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1710.757194] do_syscall_64+0x33/0x40 [ 1710.758204] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1710.759587] RIP: 0033:0x7fc2d1848b19 [ 1710.760602] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1710.765548] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1710.767598] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1710.769518] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1710.771425] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1710.773343] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1710.775257] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 [ 1710.777206] CPU: 0 PID: 10343 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1710.778252] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1710.779489] Call Trace: [ 1710.779884] dump_stack+0x107/0x167 [ 1710.780432] should_fail.cold+0x5/0xa [ 1710.781005] ? xas_alloc+0x336/0x440 [ 1710.781551] should_failslab+0x5/0x20 [ 1710.782119] kmem_cache_alloc+0x5b/0x310 [ 1710.782720] xas_alloc+0x336/0x440 [ 1710.783248] xas_create+0x34a/0x10d0 [ 1710.783797] ? kernel_text_address+0xf2/0x120 [ 1710.784475] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1710.785248] xas_store+0x8c/0x1c40 [ 1710.785786] __xa_store+0x164/0x2d0 [ 1710.786332] ? xa_delete_node+0x280/0x280 [ 1710.786954] ? trace_hardirqs_on+0x5b/0x180 [ 1710.787600] xa_store+0x31/0x50 [ 1710.788100] __io_uring_add_tctx_node+0x1cf/0x520 [ 1710.788821] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1710.789599] ? alloc_fd+0x2e7/0x670 [ 1710.790138] io_uring_setup+0x1fbb/0x2980 [ 1710.790763] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1710.791506] ? wait_for_completion_io+0x270/0x270 [ 1710.792241] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1710.793014] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1710.793775] do_syscall_64+0x33/0x40 [ 1710.794329] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1710.795078] RIP: 0033:0x7f43c90c3b19 [ 1710.795619] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1710.798331] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1710.799452] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1710.800503] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1710.801550] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1710.802604] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1710.803649] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1710.805898] FAULT_INJECTION: forcing a failure. [ 1710.805898] name failslab, interval 1, probability 0, space 0, times 0 [ 1710.808767] CPU: 1 PID: 10351 Comm: syz-executor.5 Not tainted 5.10.262 #1 21:53:07 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x8) 21:53:07 executing program 6: r0 = syz_io_uring_setup(0x3862, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x35b}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000000, 0x10, r0, 0x8000000) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r0, 0x6628) [ 1710.810394] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1710.812513] Call Trace: [ 1710.813139] dump_stack+0x107/0x167 [ 1710.813996] should_fail.cold+0x5/0xa [ 1710.814886] ? xas_alloc+0x336/0x440 [ 1710.815769] should_failslab+0x5/0x20 [ 1710.816666] kmem_cache_alloc+0x5b/0x310 [ 1710.817632] xas_alloc+0x336/0x440 [ 1710.818465] xas_create+0x34a/0x10d0 [ 1710.819343] ? kernel_text_address+0xf2/0x120 [ 1710.820399] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1710.821620] xas_store+0x8c/0x1c40 [ 1710.822473] __xa_store+0x164/0x2d0 [ 1710.823330] ? xa_delete_node+0x280/0x280 [ 1710.824319] ? trace_hardirqs_on+0x5b/0x180 [ 1710.825332] xa_store+0x31/0x50 [ 1710.826097] __io_uring_add_tctx_node+0x1cf/0x520 [ 1710.827211] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1710.828434] ? alloc_fd+0x2e7/0x670 [ 1710.829290] io_uring_setup+0x1fbb/0x2980 [ 1710.830255] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1710.831423] ? wait_for_completion_io+0x270/0x270 [ 1710.832594] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1710.833418] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1710.834205] do_syscall_64+0x33/0x40 [ 1710.834780] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1710.835555] RIP: 0033:0x7f741addcb19 [ 1710.836135] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1710.838896] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1710.840035] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1710.841103] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1710.842172] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1710.843229] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1710.844307] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1710.855294] kauditd_printk_skb: 8 callbacks suppressed [ 1710.855306] audit: type=1400 audit(1785966787.954:96): avc: denied { execute } for pid=10340 comm="syz-executor.2" path="/proc/10340/attr/prev" dev="proc" ino=35410 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=file permissive=1 21:53:07 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 9) 21:53:08 executing program 0: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x110ca, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={&(0x7f0000000000), 0xa2ef7f6456d08017}, 0x406, 0xffffffeffffffffa, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0x0, 0x5, 0x3f, 0x2, 0x0, 0x8, 0x84800, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0xfffffffb, 0x4, @perf_bp={&(0x7f0000000040), 0x3}, 0x1188a, 0x200000, 0x4fbf, 0x1, 0x5, 0x7f, 0x2, 0x0, 0x0, 0x0, 0x5}, 0xffffffffffffffff, 0xf, r0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, 0xffffffffffffffff, 0x0) read(r0, &(0x7f00000002c0)=""/192, 0xc0) r1 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r1, 0x80286722, &(0x7f0000000180)={&(0x7f0000000100)=""/89, 0x59, 0x9, 0x288}) 21:53:08 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 58) 21:53:08 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x10) 21:53:08 executing program 6: prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f0000000000)) perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f0000000040)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:53:08 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) r2 = openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x8a84e17770dd9bc, 0x13, 0xffffffffffffffff, 0x0) r3 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r6, 0x0, 0x0}, 0x0) r7 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r3, 0x0) syz_io_uring_submit(r7, r5, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r8 = mmap$IORING_OFF_SQES(&(0x7f00007e1000/0x400000)=nil, 0x400000, 0x8, 0x40010, r2, 0x10000000) r9 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r2, 0x81f8943c, &(0x7f0000000340)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000280)={0x0}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000055c80)={0x0, r11, "459a3042fda1fae35111b4ad7d63c5f4d12bc4aa401bcda318a39ed288de378c964062ac673554681e6e04956b28862a33a547e42893b1c528dbe1e647943de90e531da443da0b77d6da899bf5d2fe79592cdad9a7178c28970dcb3d848a470d4b7304c26a3cf0a29085457089b774e0a800952b03baf71448e2ecfeb0f84ec3ddc7bdd1b9f2d1f7085fd652d37eb90848e18331d06fda19b41226da393338fed48288f694dcb09e72fac3e1434858a7d420f0ceb4e51d075b2a7c9bd23859c341ddd370c887b548555d89efa5ed355dc5a838f277f8586cfacd60e7e9408a61576e9eecf3f348e148eedd3c808e5b4c7c1eb64be35ab2f29616986fa5a7d770", "53eff67e965dcde3dcc2524e3f46ef25de5c85df1f0787c1013861ab094b20795120fa95d9182f51d6bf16555487b518dff323e6d1ff326dfb41f05eab0d584ff26c926505f8bb350d24ac50bac3646b15ca6d4d290bba1e762be18dd1d228cd3fab17c93cc35f1c1811fe9a88efb6f94ed589b4ac0c282c98610976a71a1f57267879e4059285e2c039abe29722c209fe3b4a7c66fb7ded3fa186856d68a21ee33e4cdf08e15fee4769369fa392e17c33ed2da64874105f1aaabd56e4627c6c55b4de4937c37bae6e4cf88aeb662dc100745db31c82e600bf8ca555c26be2daa2548a4b6856241775a165bbb78ce18c450d6bafde29700401a1e3effc623998be1d51eda4f128999a1f8a22f15964435e1cbd09f14f471937e6aa8ae6bcb0f9e58f3fb38afc76fdba22242bac5651474af9a9fc35a32741e30403a938fe7c617b8dee96886198cb240e7e964c0dcf4353a3aa32a51788acc768c86d9655f4a768b7c5519f3ac0689cdaf0d55efd97d30e5b78bbe2e06231a4f6498b30c8526360832af1d21a10bd97c1e833a94c610380ba2a3e0de1736c29547794f1ea40674cd847c152418419e311a0ffde99427bc5faca757716ad9d73d1b043eb1696a4e770ded037cdb981e9d21e9efee4f7a86f10abf39219af795e679abb68b324fe7af24655bb7b5838d43d46ae9da3ee13ab122ea3ff7a7cff51a9d9648f3914d82122be0a21d9ed514749fa8ac31d52084ca43b5948ce6ec46bd2794d64ce2dd40ce5d1065e4ed937be241c08508ef4a370dee7acae575c5ee6fbad86831bf43e3a3d428a45248063c1715f502656b5c844d63fe02c9efa0771cbe5eeac250423324921418f73fa646f1ab608b4857ad203ee96e45926fcc2a0fe85fa207f76e8f308f052d4113138f1bb4c9d12e6e13256836afbf005880bfe871f9440029b5470121f2f37c8178191d6a5325755555632ba2670cd0d60fb45c49e72d206678226ddc40738d632c5ae716b3933a10fe57a70248adc5ff952e2f248c5b81e3c1d21e8f4b18517fc6fb3094a32dd2abc223ac46ead50396998da5ac3b31640c1d252f8f137855f69c36887497df671b647c64fc9067e323907fb05a0deec3f89a8bc2bee721cc47ddc10635c64b491902d496a98ee88444f98c46479de73336996f7fa2a4f02d36fd2004bb7641264a83a4ca5ed21b4b5288104a4605cb260ee73e596c3e3d254379427fbeed7481069623ff0531291d78c314b19a59dc4647e606243a121e1cf23b6e5c529325072c6c1e29d0526f5fb52143cf565849b8f475dc04419f25d89d0ac197c1e6ba11045eff71b44c547c075dfe95a443b884bfcbe0df70cc6ab8e75fdd5369afd7069da75de9f98a6e79a07d7bcf7fd9c0186057069a462f7a5ed1c9113ca26f2121a22bcd74c270292f98325c32a9e3b1c1e9209fb8186c1efd5534ca97b5aa14c59bb86cc1d6d684e32fddc9419cb34948d169db8a42000d437b422d91aa39fc3e3e8f9b8681e808bcc3ddc44ab1fc517d8900b208fbf546ae17d23d60a121782624715a8269e29ca7ed2c07bdaaf469d273dc95c0aaf0efaa1066fcbfe2e237905683b1820ef0cb24019a267a14952a575e5754811f6b1616b0e4b566721f52cb908ef3e49ef50783d2e0ab1924cac4d44b001ff24284b4b755e13869c468bda51588c33ff25469157904278ff6bca91a6337739195cd4384224e4f9a062f8c1021e00aca4dc65eca75016fb5b30ba7ce751cd7ecff26cb719d3f99308941082e3b95cf4d4a053fc2df81b18325f67f4ad6e92cef77c5fcbaa7a15fc685df5917274c4c322f254cf4fd0981148ed2ca8b3dbe2639024a53f81f8ab4e0052ffd6a472910edc2efd5fce8a961522e05cbdff0009e1ad19a497873bf0e68eddfcefd4fbcacf8e3c0f8dd379587e99bd28584435990d9a5e238934413a48c558a5b8546f031925112e4134a902756bdd1b6303ae256606920cd0301d2906c405fde336a32edfe1ff7ff6b004d2afd04695299650ffe96899f123e8102f5669f65f11f57ffca7ec45dc0073f763b8e6f8f8ebc9c53d22f7e3f79bc9ecb83d66d6b3dbfa0872688c2ceeabc5746ffd9e3e275d3f6380434ec5bd35105e35dc258d812d43a8336b84f6e767092e10eef88d30a0ca4079a10ec7fedccdda1298379e00773a9d65ae13bcc31f4089646f40a4e5418e3082bbd0e89de2444da6ceab455d958229b982fc360b404658b5a34b9d5385db15dc3571d4d3ea7c5f9d613b15f276dfbcd75509afac9d1badff1b84cafa1b82ddf64c56502ce4e02022d3d83a0a8113cb01b67a03ac568710d65313f9ec32cff127a73926e566f556821c180aa1fe4bfc668d85861ed80e0c61d425891dd67341c3be9e356a6074d3dadcc1e7c8f870abf92687926470f5a98c0905b094864ebfdb0757fb407d07e3c362e70a72fe5404dd5e12039637b46b535986b87c28c06f50835f3e8d59b910cad71f946be1652ea1ca339e3efa631b10c728d2dbc5dd44a85893cf415dc61db4ac34846782f8567378c65458556d0f521203022fa6aab2d67e0be7f50544258204d23865e8608edd279735d544335b4902ff66c244e74fa8897468ee25133fecbd385c20373e3809b0d6c4d001e39778d0c0a2099fe4728acfd1687b561831a968787a5b6c8f46a1183eaa1f7cb579316ac105e2be5df62f92da20422d4e335fd7a613cf91a5600004d63786b4f08c6ca5fc75c8a1ff55de14a6291da514fff2f0b22279f1d13e1052fbaec33edacc52749ae93f0c2d09b89484ab1c98b230f15161ab68e8f552d80118853d742609582e3f026d75ac796be3f01ed4c654dd72185e849cb2ccef4f3183de343d5d8cbf9a1db4bd013165180a6425c1270b937179be88e4d044d9ec959e6fcfb45529d69ba52d70304735786a5cbdf02142254db8e8b7dd29af1c1a63aaf993bb79b4222143f996a54be1d22bed546ae5a269376e90809305ed1bbb2c7f5cd0f853232ee44a69fcea77b7d91777d4a19edbf62faf6ec119443d49209e8c9588bbdf7ca0e90c5dbcea9d12017100db8d64c95c48dcb01e9b65e817792bc9e660898603d6ab74f998aba6819671d8aa2102138deea7baeeeba85dd7aae7c352c63952131a76baac3dfbcec78a67a22792a45efda02aafa56b53d72ec033973101a3a98984054a4ede38da1cf91227feeb33cba9267039e101b9721307f06a0ff7e3d3b6b298a17c5a10f38faeed67ed3fa91138698082e5ac2ead2b8c9f9cc895b7d0979d7729530e339020e14390deedd797188bbda5182cc43525948b6ef3f5a48d967ed47165e09e99009f7aa137524dcb448b42b6aedafcd3ecac05ca2b4fce00b33060416c46704a95734efcc0b9961507d06369b2ebf440eb309f6ccf2a0fae2d0833b29e68c3f614c82b85819acce06281722272451c787a3999a6d520c0bf125f4842726382b490a0ed94b70c74c973c10f079431d7e3af326d36a9ab049a8b5eaf4ac48ecf1ae8a67c503ea8de6afc7c93f11619cd426fe0c812c2a3481d8f68612f9264c84a06c19b53d95f50d608602a181adf8498da21d04aaeb2dbbf374f22e60182000e5027ad1988b40be2c5a665ba1b6d2c4e04e1a99c2a2b1a7563ac046ac2f2da3866bf104bb86148e7c1e8ff22923c04856922f9c8ce5214e0ef47cbc0138dd83ea00985aa43ba4a82ffaedd580d17ac8de8322358d675b0d98adea9f674b00c61ecf6102b8b535a61722cefe8253d8b4a362b11becc750fbfeca37690d9e3332ab8558d5d5cf16d34fbe6f1ea8fc717e011777325193c14800383c46cb81791fe4ba626ee10bbc32af681efc8d677519d6fbd1f4a64af5f97f7570c78037ea88fbcc7a942d74787faca3bcc706408cc193b863211d9fa885b0be689f1ad00b6df44e0e1a4a0266da4656c187fcaf74ce0c3328a81b462e653adb3d423b1c585062f4bf97a6bb1c569aedf0911d1aae0d8b938eb00dfc1071ffc3c6112f8163cf4d96b84d12fce8a17158e5ba9d516ca08f89a56424c5c0ad16bc6324d01ca16217f7b4af7b4011ebe066081acc1cdffec45907394a1268e0035975059b31d0b3b3bd69910987f87e8420b618ea3a25e37ed8c93d9c04223f1ffe95543f658cdab2b79bbf0aca30c274ba9498ebc9e1858be44c48153017e03b3cf5756ca2e6018808b18ab786608580b463a7246b4ea7daa5070523ddebc765b56c25b0f47c2e611bebae003fac567685ac1be63f7be93c05c34796ce6f5b403fdee6bd928ffe0e2670cb4aca5dbeadc7e08fb36c9793119dd87b7c461e67f04adaf8ae34dacdd80b1c6418d282c5915bcba695589a935389c81a226704b51c75d29cda0a1c4c87e35892aa9be2c049b902e782bc559abd4a27e477577ec1a7f76beee0d9e60d1c993ed30a19c33123195df4d2d8563f0424fc5f8a98fc0550d2946832fc2db5013f3a9fb48ad0954a79a526bc7e06b0f1de572c43cb2f5ea95467523817ddbc4f7fed74c3a092ae4d9fe0ce77ffbdd36cd25428a43c084fc6e166a5c1c95dcb96143ee073c9e837eb19028646e76bb484aa3e4ef20283f9237b43cae235316d774ba7bfca598402ea24a3fe8989a91f812237c865512bab20adeeb9aa2972177e94eba906ada1bf09af4e87e32f1081157558c25f1c025df6ea1eac112c7c7c4d73fcb9772878bdd01f376850234eb1c9aa0fb2bf1edc023b12135bee7fd1866fce1de59eaad6b168d94cd8dd66cba004fb1466224311937ea2481db78e2a59d8cb6461e6ee21c528697f689e55a7e24035415a29387f0e0c606b99013b38b923c3bc931a96ff96e34173b182d0f9b9588fef389bd50cc069008ac4a8203d4457ba2b7a193c6ca0a79f1f04b3a4b86d35f4e4024a845da95ab0c4c0db2951c5db2181cf68b617f8a5defc32c2a1c812249d5d7902eca9fb81601e9dc8279b2f71ee3b47d6ea711829e9843e051818a046307943c3fc8893f17f88d35416646bd72cd13282a623a055b536ca838bbefdfbcaecf0d91e9ddcec0f24ab2ac9309889d7000048bf9193125a8133176fd457215489209762ffee634c34f85ccc41bfcda5480ff25b754287e72e099b5a691d9c2315b4b40df626e147bffa7b5d64c9d675b65f207001bf6b5f320b8a5f214be7a136d0b7f546220003622dad69137ffd5ca96a3cabfe1059d806f0e19bce9c42fbedef0a2f5c1c0cc5de5dbb9f1d81aca11299c47e9546896be80d810dbafa9e7faea2c187fe1498137dffee99b1c50664c7ee1c0db580b2a8b5a7a9315865eac7710c6864cb68cb4a472f3ef066c9515f3d0203d381e4652696db1bced89cfdc91a8f1306392a7c913bcc55e2c4682023a54cf4569ad633e23e00c301f9c14e2b4"}) [ 1710.972336] FAULT_INJECTION: forcing a failure. [ 1710.972336] name failslab, interval 1, probability 0, space 0, times 0 [ 1710.973641] FAULT_INJECTION: forcing a failure. [ 1710.973641] name failslab, interval 1, probability 0, space 0, times 0 [ 1710.975060] CPU: 1 PID: 10366 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1710.977759] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1710.979641] Call Trace: [ 1710.980255] dump_stack+0x107/0x167 [ 1710.981081] should_fail.cold+0x5/0xa [ 1710.981950] ? create_object.isra.0+0x3a/0xa30 [ 1710.982985] should_failslab+0x5/0x20 [ 1710.983862] kmem_cache_alloc+0x5b/0x310 [ 1710.984810] create_object.isra.0+0x3a/0xa30 [ 1710.985809] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1710.986967] kmem_cache_alloc_trace+0x151/0x320 [ 1710.988033] find_get_context+0x18d/0x9a0 [ 1710.988990] ? security_perf_event_alloc+0x79/0xa0 [ 1710.990105] ? ctx_sched_out+0xa00/0xa00 [ 1710.991027] __do_sys_perf_event_open+0xed1/0x2e60 [ 1710.992158] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1710.993251] ? perf_event_set_output+0x5b0/0x5b0 [ 1710.994328] ? wait_for_completion_io+0x270/0x270 [ 1710.995443] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1710.996638] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1710.997806] do_syscall_64+0x33/0x40 [ 1710.998650] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1710.999811] RIP: 0033:0x7fc2d1848b19 [ 1711.000661] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1711.004834] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1711.006564] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1711.008182] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1711.009801] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1711.011413] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1711.013030] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 [ 1711.014663] CPU: 0 PID: 10369 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1711.015421] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1711.016313] Call Trace: [ 1711.016603] dump_stack+0x107/0x167 [ 1711.016996] should_fail.cold+0x5/0xa ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0xd000943e, &(0x7f0000000540)={r10, r11, "5711159ca0a153c623c98bef35c6cb245d3602800f6375f36223dd54af357dad3fe69e9e6215c46a214fd644c04bf9098640e7bb1689c848cf48d7fdbc962a3a11411a35f2f544c1b7389e32349beeefbc75739b38223a260ce2a34183df7f4927f513ed0b924a0b1974de1ff521f72591a735f4fc9764cc6e329d6f803813321c4e41a9f09f1ddb78f73bacb82da4b2eba4c0ef49d15037a6c7320b3fafb5c42c35c9befa718fda12741b9e84e5b121de0e739d89a7b4cd5b2cc26b73387f8ccaf2cc52743175fb8480be33b6a5b431a5245eedb73c9e33a3b277afff14df69e70b1c9d87b961a990a393a5788c4de12e44d3919b948ec6fb6938779679592f", "bc819a03cec2a102c3257bcbfba1c2921a0fc52ea2d40e67378b2c5f66ae3c6e14d5f906dfa9c574354ccc16bd398699308beb6947d24513616b21f595cc13e0b7c2607abe19d69eec698b417b6fc0163c584d916882ee956401b3a407425f935e117ef584c86537eb916b12719ad52da6808cbe0cead97da7e4ed57e5b1804c0b0920a88e15ccfbd0dea874800f2f0262c318661625cab0867cfa3ab780664240d44501d983a284609bcf023d47b365cb9590a9935eaa58db88e4d716cce350fe9158a0105cd1172df12fe69567c61963be0c8701675ad6b3acb9700e6bbde8357698a469fb1cde433000c410c747a851c5b2c8a3532ddcad0b15a2f969c7166b3f3071b642fe211684f83028b70e50d519d4149324ee566c17fc49395b089f706710b69002dc9cb8f9abd83e40372baf93f85009f81f285b3e285037b1d9be4ac94807e3d0ed8456a719bc69208d4b8cf28cd68f575328f8887d27988c845cb6deab14b5310ddecb2acdd7013e45e0a2c1867258a7a6b9e7200e19525739748fbb45f7e05cc01e3df2def7de26993c6394d26877d6edc9b76708e385c22a65f55708d91d4fc3fde5216be9f72cf3027a620e6b0dbb27e408401b182a325aa1715edf9cc2073dca4efd7f0a68be01d84c96f5240e43f9419865056203e3a8700903dce700f9a2078ee0506c5bb22cad3206c7d04a302d271ef3e5c5f0469005a2c2548cda186fcb6092bc378007dc659f12f4fdcde2046a954e0384fb1a8461c4078ed09913e2220c12cb2dee5db9f557ad05445a437a8b9bccd815c0495dd5b269f4a2e0ad8cc5a0e88b0a7e7b856a59df570e034d08651ad001481416d44acd26f65b983059174d735379c95a1e9f6b7c0d4ee8c3984569f78a33853dad59b59cc7661b1e1bdb05b337cb52d8f069ff7a248cca257022895ee873c3f10751ffc30f90824d74d93343a8835245d967bd42e9705b0be427ff99c5732c56bf5213f958923472f3127573528cb3005f0121fd1cec869b84e4ae3c5565bce90b0ce16d3e843ada3eca1f40d9857232e60a342169f20dcaaa2984881a07ecc1f56c817707a154edb48ec3edf5220ca4ab5c9a336ce7eb85704b53456ad3036458dbf7f8b205599ffa325bc43498ecc233e71fd18e9037f4ea96cec682d999ac46ee6cf0516f3f7621bdbc9c91e9dc07f1ae9a653198f50e8a39d0b68b85734691f0aa89510d50016e1ee9130029ff2366aa64a23b897f8786c62e4abc8dd4d1fa8e067c339e50c55f503e15cfc974bd685decaeecd15f3b4677192d036e7d2c963b324782085cb7aac7c9a21a5194513d93438c999ee8d6756c62b16b4110d7a2904569579ea169eab052cc71c7b1713662139a6bb03ada2cda33838da4e3ec74eebd66f4fd4947b9c2d78d33338c55266ea1b3d5b55a27a4f63128245f479c97db623cfa8641d0c8904bef721134e0c36fcf90e3145d7bd2bdcede05205567451dba7acf2eef284fbf48d34fd391043ca471ed1dc14853e092976127377c94323cebfbb98f89dafc79761f32de8cc55978f534c09c9f6c9e3fb0a161822f6d0d9471eff20cb065daeacc8ded0b8d50ab31029e871ef0556c036cec98fc4383842bb1f372d59d62a993d9f977aaea8ec7513b0cc08de1cb51fa1d172a8f12d1931bc6e150cd7eeb00e760a53882ea0296f01a8a568556651cc597caea2f67689b0bb939e732cf42edc3e0b62a349c2e760d0c52b73f613aae54a7dd00f7045ecbebfeda0087ce56b6328d6a4fdf7dd4567369e1f2bf23b9694321bf00f62593a62631b1445803cf01d73adaac77a42103551e4cac569226f8c72911629e67f332d76927231787508d4730216bb920b469671ad76655ca730dfefc9d390bbd9d101e11b071579c861dffd371e7996a639e665e54eec6593403800291271fa08132dbf0fcd5148a54fa622ca6c46e27dbc9a7c7ddd7dd9121b02e303660f170e52ba329b5a3e0bdeb87c7c8a18584be776ba3fc4083aac988f878595cd21156317c33418d7c000402880d96af00079704802e80f87a46dc0824d09deb2babc87bf3417a6c98a687c48306d998f4ea52cd1200adf4c267ba55081b0d9c43fe0696bd7d8a3ff00805c18aed6977a675b56cbbb89aebac5fc214ced06091d9cc0b141089bbebea4f76cd8033e53c1094486326eab2cb502c2e793c6388a51bbc4e46b149bf75ea4ebf7cd74b939ad814109e564671d5d85df2b42ac1cbbec54ea594a326ce0fd4af9c8436e48b2fd1c561e30bb2d1e766cc7e407d4e27f8d02e36023e01a358db309621c44f7075a35b0064f1016bd31132905c12c94032c619d66df88322960bc606e0e1f9017f0af2f5ad8a9d904676ec339d7e1f29efd90218f0b4569fb5cf0d84c6016f988c3a5ed6b0aa716802291c6da24239aff8312f75a498f11d72042aabb6f3f05d8bf7b9fb73adf6e0018a88fbf3c8f0f27194376ed7f8c4f320c960c963e9e11485472e8ccee8f88a4accd2d356bca8049407b94748878299eab92a4ac2fb2e759813c3cfa2052b13117040b4939317fdd06b78fde36edf239afd1f6e1b3c1c1ab2dab8eac554bd9c76b54c886ed17e289392dc72db8a5420725ca6b4a8e6b82b1a9e4323fc080c08c1cef76905c757a38c26f658080a3d631540699b8017b728d36f754f3a585d4d50ae6d578fe8ed60d2140b4f333b5a288feb99831da343eaabebe7ce3fd4135b88ebd63a13dfdd973a8bc88f06cb9c4d019e1273509d529010894465b75712ab8e7c294188460400c0acdbe0088c9a6e3d17b37067046fe07366580b3e4c5fcef54f954c5ce42427be7c689f2716d7ab83e2487483bb909278f652afd97af50577ca93e8c1dc423de7969e6009012985064bd0d55c645357049c9ebec776087a133095336f93991aa143db3fc2e37f97acb8f80538996daff2babe4510e31bd4e601b77477364ab95eb1e14ea742defc8d7fba0d135b3af6cf0847492e932440cdd11fbb8378464905e7a9573385c3f8f21045c5ea38ac93b4206e5a7ef2bc08b3426ee2d8e4a05c4490bebb018317d3379e6eea2eda7c8838e624a9a579ad3000eddd4daedf6e01b0fa917b7165a2232f38875a70f86a0d6800ecac9bb89c84b4cd1d52f09fc44a613fc046a4b9fb6a86be134b05d8b679a31bac3fd109f76e8070a710823145a1a78d3dc504c26ef6d9bb56762e56e6a432b1721529c4a71e227015e5f2a2e4806b7a0e43632f1aabd5854f59ea3175cf78466c4e0a7b6a2caf22b8731796134b8934114356b8947a7f3edc4b275ff125115a3f4fecb9c3812234b4ebcd288cde442928953ed5d73b9e46ca1b5d594bd0008c3eaf37a0cd29c95f5211c9bc5fcffd884f8fd0b12d0ef9f81ce2b7b2eede5cc8b64c5c5e99d56933c5d95901367dff2c1d52c85e155606d2b1891ff4fe5337fc7b8310be208d888426dcbbad020f1a15590033fa9a208ca7a18534660a899ff41e8d837e6d63f227a18d21c79bf7335f58f5b6d81cb2c41d699d6aa7c898bad68ffa9e01064b19f416a234f338898dae6be07b2c32875a19f3c5b3c51cf18d8e5b7c99171df7e1b0f669550bed202ffa4078e1c612a8bc34e366834433f40ab0e0c69b75daa827ffc6d8a0ee31357b532675dba4e9a74363932078867787b2e1404f90b6878aca158b392f4b87b0a279f96666c46447636aa937a65ebb04d496d9021034da4e06322f8cf8a09733669eec47b16126d3749a34af751d13646c9c461706d82c413f8e2b8b7551cc8f2238087930dcf6458e6138fd73c6b12838be722e36e433fb58be4728c069ae5c04184b23c6eebbad0d43923a37f6a3d218615e8893573a67f2ac6324fe7ab01070494b521347765f7338ed8cc6ce5b4f17a2b9d7e773e0d0f432ff41810a040c287992907eb6d53eea87de447cb07c7170b1581159295c33743767a1a422c7ccec1e0acde13c3b4c30690a6661c01855211ca6db317d4ac676da87d306478f9433caf6847f96df61673a4accb05767d5512893f87fd2136a17ea731651bd281f14efa74411ffac6146208bb99015efb961148f232a0de286b879509bda8bde267fe3d93c312bdfb0d3568b19bd6d701079d3edf7c21b8dd6f62c0d4c4589689c997de09dcf9b53ab801cda53eb6776dee96187f532f45d187a424d0625ffa5f6526154b1030d20d14222d9a5820c39aee942c782c39317840c5f555cf697c6a15b68f12e39c166345f0e8e1ad6ec590cd92795a8b1ad1de0933811468efc4c5a7c35f48236fdc9e6a2a6bc1f36805d3b09a3fda24e9e445ec210639af17fc09686cab18b0cf449e9db15bd9b08afab66c00aac8d4c4e9f2d74d2f72c2efdb74cb57a115cb34d300fe3df77f17bcee04a6ac2c5958686e2f9557ddd7fc0e9e0f584bc080e25b15a6d830baf27dc6dafb5ad706b415b2ff68e113c8ae1c57d361fb3a28c70e93db69fbb9be0d3e00d7fe9d75faa75b10cd307af9a2e2c07efa2eb64a048c89cacc2d039894c85d3bd101b7ed9cd705456251ec00b560a9f72171857e3c8edb9973cc1822379f364e104798c2b6364e5dd5c270371afd2461940a04dd68a78e3ea678c1e400fcb790afc323ea27ff8076602a6c28b9a046ba37b7b45e1a1c685a7f2ab41cb36840d3f258419ee642a6769f822a4eace7d88e4dd625454c7c390094b51a1554b9a919551d9f8e45345e3475b3b953e3abb15b8bf1caf0c5dc0d5c3ae1366615ebdfb894dcfee6e52f9cf941d2542e321f9fc80da09c3fd52444c5bc4cc8034c159303c5b51a6dcce623882e5cea5ebad5349a33a9bd4b83e4d7d977c27f81ba3eca1ddd3583c597dbeee34032c79426fe61b6fa1b2b4cee42a0b916d3a42fa67df836fc4f314f799c89baf16dabaad9f9e43fbdc240a251ddf6f01b76b3f4cc5e6208f2b792ce706f3fa9c1ef43ad2bf537f4307835d6668958fc58d307d8f8a6c40b629b9743bcd4c9370c05db82c8d5454e2a695b01e3f4f935b1182c29dde856be28165ddccd6d3bae2bf6ded8fd25c84b23678e56d9f6738873b3b447e90518ac293c7a41bd78a57a88e58b1f7b241325836ac41ea138d06497bbb4a245811a86fc5984345b50e6df2a3414c77a8ecba47e4c905e2f188f6997ac0cbff02577a5abce4adc09fa1e390b987dde3cfb3d8f1d3e21c5868da56816bc1e36286b502f509faa681468a9c1dc5f0f9ef47d1ea592988d24eb6310c1e43e70cf134eab4fbba0c7579636bb0ed8ac3b81f7a27c9646449b01c06bf7af51d9ae669d47b0bf2b18a957667790e6690c9a8ca2d8a6357aede1bb957f030b03bd98f1aa69f61fe2cdfe307db1aa163cc3dcaabbb925ce2a28d5abd046af95641f9e705b2601264fd256e7d8f94a6b979"}) ioctl$SG_IO(r9, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) syz_io_uring_submit(r7, r8, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x3, 0x2004, @fd=r9, 0x80000001, 0x0, 0x0, 0x0, 0x1}, 0x5) [ 1711.017406] ? create_object.isra.0+0x3a/0xa30 [ 1711.018118] should_failslab+0x5/0x20 [ 1711.018528] kmem_cache_alloc+0x5b/0x310 [ 1711.018962] ? mark_held_locks+0x9e/0xe0 [ 1711.019397] create_object.isra.0+0x3a/0xa30 [ 1711.019864] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1711.020417] kmem_cache_alloc+0x159/0x310 [ 1711.020862] xas_alloc+0x336/0x440 [ 1711.021249] xas_create+0x34a/0x10d0 [ 1711.021651] ? kernel_text_address+0xf2/0x120 [ 1711.022155] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1711.022727] xas_store+0x8c/0x1c40 [ 1711.023117] __xa_store+0x164/0x2d0 [ 1711.023510] ? xa_delete_node+0x280/0x280 [ 1711.023957] ? trace_hardirqs_on+0x5b/0x180 [ 1711.024433] xa_store+0x31/0x50 [ 1711.024788] __io_uring_add_tctx_node+0x1cf/0x520 [ 1711.025311] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1711.025868] ? alloc_fd+0x2e7/0x670 [ 1711.026263] io_uring_setup+0x1fbb/0x2980 [ 1711.026711] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1711.027283] ? wait_for_completion_io+0x270/0x270 [ 1711.027847] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1711.028419] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1711.028975] do_syscall_64+0x33/0x40 [ 1711.029372] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1711.029918] RIP: 0033:0x7f43c90c3b19 [ 1711.030316] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1711.032284] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1711.033095] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1711.033857] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1711.034617] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1711.035376] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1711.036144] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:53:08 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 57) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:53:08 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:53:08 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x60) 21:53:08 executing program 0: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) perf_event_open(&(0x7f0000000000)={0x5, 0x80, 0x7f, 0x0, 0x7, 0x7, 0x0, 0x9c, 0x80, 0x9, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0xff, 0x3, @perf_config_ext={0x3f, 0x800}, 0x4088, 0x7f, 0x5, 0x6, 0x4, 0xf5, 0x7, 0x0, 0x20, 0x0, 0x6}, 0xffffffffffffffff, 0xe, r0, 0x1) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) r3 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r6, 0x0, 0x0}, 0x0) r7 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r3, 0x0) syz_io_uring_submit(r7, r5, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_submit(r2, r5, &(0x7f00000000c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x3938700}, 0x1, 0x1}, 0x3) 21:53:08 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x300) [ 1711.098505] FAULT_INJECTION: forcing a failure. [ 1711.098505] name failslab, interval 1, probability 0, space 0, times 0 [ 1711.100012] CPU: 0 PID: 10380 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1711.100764] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1711.101654] Call Trace: [ 1711.101942] dump_stack+0x107/0x167 [ 1711.102341] should_fail.cold+0x5/0xa [ 1711.102752] ? xas_alloc+0x336/0x440 [ 1711.103158] should_failslab+0x5/0x20 [ 1711.103569] kmem_cache_alloc+0x5b/0x310 [ 1711.104012] xas_alloc+0x336/0x440 [ 1711.104401] xas_create+0x34a/0x10d0 [ 1711.104810] ? kernel_text_address+0xf2/0x120 [ 1711.105293] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1711.105855] xas_store+0x8c/0x1c40 [ 1711.106246] __xa_store+0x164/0x2d0 [ 1711.106638] ? xa_delete_node+0x280/0x280 [ 1711.107089] ? trace_hardirqs_on+0x5b/0x180 [ 1711.107555] xa_store+0x31/0x50 [ 1711.107912] __io_uring_add_tctx_node+0x1cf/0x520 [ 1711.108441] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1711.109003] ? alloc_fd+0x2e7/0x670 [ 1711.109426] io_uring_setup+0x1fbb/0x2980 [ 1711.109881] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1711.110426] ? wait_for_completion_io+0x270/0x270 [ 1711.110955] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1711.111519] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1711.112080] do_syscall_64+0x33/0x40 [ 1711.112482] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1711.113034] RIP: 0033:0x7f741addcb19 [ 1711.113433] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1711.115403] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1711.116230] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1711.116994] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1711.117763] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1711.118527] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1711.119299] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:53:08 executing program 6: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000000)=0x5) 21:53:08 executing program 2: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x7, 0x2, &(0x7f0000000140)=[{&(0x7f0000000080)="4594ae3eacf450d76aca63e19d2e93bb74bf35ad99c0c22b4b2e8a744ec0e21bf309ef3e46e428c4b524ea0a7ae40b3ab5609de50d82fcb52cdfcbfdb8690d58f2efbb1fab9a7d8b3c57bc1038748430aa2fe15bdc287e60482acacbc66f9e4b22b1bd01ff1e1e9c6dc211b80703421b4d4a302b5257ac425b382817f7244786c62a4486cb", 0x85, 0x37ae}, {&(0x7f0000000340)="c774b90bf77a78aa6324b60b257f7e3e415fc4c28593bd1d1f458e8642d3c3e4108a8d88e44bb6cf6737afeb389978452434ddb41cfe00c10f02b1e0adc831e7ab0f9e0e37318b3f0120d6b685f485a0190f30fba687a3f55bee89084b8c5cff955e24b91f54ffc70d23fc27c04f98b42c89eade144fbb027a450b88290cdd624ad3c42cce3761908d9484d71c6b7b272c351dedda2615160df2c33b938e0f7577058cb2db256994a63689c8d651b8c5", 0xb0, 0x2}], 0x4000, &(0x7f0000000400)={[{@sbsector={'sbsector', 0x3d, 0xfffffffffffffffe}}, {@mode={'mode', 0x3d, 0xd922}}, {@check_strict}, {@map_normal}, {@unhide}, {@mode={'mode', 0x3d, 0x62d10531}}, {@cruft}, {@dmode={'dmode', 0x3d, 0x1}}], [{@uid_gt={'uid>', 0xee01}}, {@fowner_lt}, {@fowner_lt={'fowner<', 0xee01}}, {@measure}, {@appraise_type}, {@context={'context', 0x3d, 'staff_u'}}]}) dup2(r0, r1) r2 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) syz_io_uring_submit(r3, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:53:08 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x500) [ 1711.198692] loop2: detected capacity change from 0 to 28160 21:53:08 executing program 0: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) dup3(r0, r1, 0x80000) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') writev(r2, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') writev(r3, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000000)={0x1}) perf_event_open(&(0x7f00000002c0)={0x0, 0x80, 0xec, 0x7, 0xff, 0x3, 0x0, 0xffffffff00000001, 0x194, 0x8, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x8, 0x1, @perf_config_ext={0x9, 0xfff}, 0x42, 0x100000000, 0x7, 0x9, 0x4283, 0x2, 0x6, 0x0, 0x7, 0x0, 0x8}, 0x0, 0xd, r2, 0x0) r4 = syz_io_uring_setup(0x561d, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x66, 0x0, r2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r4, 0x0) 21:53:08 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x600) 21:53:08 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 10) [ 1711.369677] FAULT_INJECTION: forcing a failure. [ 1711.369677] name failslab, interval 1, probability 0, space 0, times 0 [ 1711.371026] CPU: 0 PID: 10411 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1711.371816] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1711.372730] Call Trace: [ 1711.373018] dump_stack+0x107/0x167 [ 1711.373408] should_fail.cold+0x5/0xa [ 1711.373816] ? __d_alloc+0x2a/0x990 [ 1711.374206] should_failslab+0x5/0x20 [ 1711.374613] kmem_cache_alloc+0x5b/0x310 [ 1711.375054] __d_alloc+0x2a/0x990 [ 1711.375428] d_alloc_pseudo+0x19/0x70 [ 1711.375834] alloc_file_pseudo+0xce/0x250 [ 1711.376305] ? alloc_file+0x5a0/0x5a0 [ 1711.376738] ? ctx_sched_out+0xa00/0xa00 [ 1711.377199] anon_inode_getfile+0xc8/0x1f0 [ 1711.377678] __do_sys_perf_event_open+0xf59/0x2e60 [ 1711.378232] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1711.378777] ? perf_event_set_output+0x5b0/0x5b0 [ 1711.379289] ? wait_for_completion_io+0x270/0x270 [ 1711.379843] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1711.380441] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1711.381001] do_syscall_64+0x33/0x40 [ 1711.381424] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1711.382003] RIP: 0033:0x7fc2d1848b19 [ 1711.382414] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1711.384498] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1711.385322] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1711.386083] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1711.386845] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1711.387604] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000002 [ 1711.388370] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 21:53:21 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 58) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:53:21 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 11) 21:53:21 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) io_uring_enter(r0, 0x364f, 0x265, 0x0, &(0x7f0000000000)={[0xffffffff]}, 0x8) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:53:21 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x732b, 0x0, 0x2, 0xfffffffc}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) io_uring_enter(r0, 0x5d9f, 0x1e9c, 0x2, &(0x7f0000000000)={[0x9]}, 0x8) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:53:21 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 59) 21:53:21 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x700) [ 1724.441997] FAULT_INJECTION: forcing a failure. [ 1724.441997] name failslab, interval 1, probability 0, space 0, times 0 21:53:21 executing program 6: r0 = perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4307, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000180)={0x0, 0x0}) r2 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x6, 0x1, 0x20, 0x3, 0x0, 0xfffffffffffffff7, 0x10, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x39, 0x4, @perf_bp={&(0x7f00000000c0), 0xa}, 0x0, 0x895, 0x1, 0x2, 0x5, 0x7fff, 0x7, 0x0, 0x0, 0x0, 0x1}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x10) perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x22002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r3, 0x0) perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x25, 0x78, 0x80, 0x1, 0x0, 0x2, 0x2, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x3, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x7fff, 0x2, @perf_bp={&(0x7f00000001c0), 0x1}, 0x1, 0x0, 0x8, 0x6, 0x0, 0x3, 0xfff, 0x0, 0x8000, 0x0, 0xb94}, r1, 0x2, r2, 0x9) r4 = syz_open_dev$mouse(&(0x7f0000000000), 0x2, 0x400003) pread64(r4, &(0x7f0000000040)=""/189, 0xbd, 0x1) 21:53:21 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1724.445307] CPU: 1 PID: 10421 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1724.447352] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1724.449499] Call Trace: [ 1724.450177] dump_stack+0x107/0x167 [ 1724.451109] should_fail.cold+0x5/0xa [ 1724.452082] ? create_object.isra.0+0x3a/0xa30 [ 1724.453259] should_failslab+0x5/0x20 [ 1724.454232] kmem_cache_alloc+0x5b/0x310 [ 1724.455268] ? mark_held_locks+0x9e/0xe0 [ 1724.456326] create_object.isra.0+0x3a/0xa30 [ 1724.457453] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1724.458757] kmem_cache_alloc+0x159/0x310 [ 1724.459234] FAULT_INJECTION: forcing a failure. [ 1724.459234] name failslab, interval 1, probability 0, space 0, times 0 [ 1724.459827] xas_alloc+0x336/0x440 [ 1724.462118] xas_create+0x34a/0x10d0 [ 1724.463083] ? kernel_text_address+0xf2/0x120 [ 1724.464239] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1724.465583] xas_store+0x8c/0x1c40 [ 1724.466509] __xa_store+0x164/0x2d0 [ 1724.467442] ? xa_delete_node+0x280/0x280 [ 1724.468518] ? trace_hardirqs_on+0x5b/0x180 [ 1724.469628] xa_store+0x31/0x50 [ 1724.470474] __io_uring_add_tctx_node+0x1cf/0x520 [ 1724.471710] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1724.473052] ? alloc_fd+0x2e7/0x670 [ 1724.473995] io_uring_setup+0x1fbb/0x2980 [ 1724.475061] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1724.476371] ? wait_for_completion_io+0x270/0x270 [ 1724.477629] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1724.478973] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1724.480304] do_syscall_64+0x33/0x40 [ 1724.481257] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1724.482563] RIP: 0033:0x7f741addcb19 [ 1724.483516] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1724.488262] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1724.490212] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1724.492044] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1724.493890] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1724.495721] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1724.497354] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1724.498890] CPU: 0 PID: 10427 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1724.499779] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1724.500800] Call Trace: [ 1724.501135] dump_stack+0x107/0x167 [ 1724.501579] should_fail.cold+0x5/0xa [ 1724.502039] ? create_object.isra.0+0x3a/0xa30 [ 1724.502589] should_failslab+0x5/0x20 [ 1724.503053] kmem_cache_alloc+0x5b/0x310 [ 1724.503549] create_object.isra.0+0x3a/0xa30 [ 1724.504087] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1724.504706] kmem_cache_alloc+0x159/0x310 [ 1724.505205] __d_alloc+0x2a/0x990 [ 1724.505631] d_alloc_pseudo+0x19/0x70 [ 1724.506089] alloc_file_pseudo+0xce/0x250 [ 1724.506587] ? alloc_file+0x5a0/0x5a0 [ 1724.507053] ? ctx_sched_out+0xa00/0xa00 [ 1724.507547] anon_inode_getfile+0xc8/0x1f0 [ 1724.508059] __do_sys_perf_event_open+0xf59/0x2e60 [ 1724.508663] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1724.509251] ? perf_event_set_output+0x5b0/0x5b0 [ 1724.509830] ? wait_for_completion_io+0x270/0x270 [ 1724.510422] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1724.511054] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1724.511683] do_syscall_64+0x33/0x40 [ 1724.512137] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1724.512766] RIP: 0033:0x7fc2d1848b19 [ 1724.513218] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1724.515439] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1724.516368] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1724.517225] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1724.518091] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1724.518942] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000002 [ 1724.519800] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 [ 1724.531857] FAULT_INJECTION: forcing a failure. [ 1724.531857] name failslab, interval 1, probability 0, space 0, times 0 [ 1724.533359] CPU: 0 PID: 10436 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1724.534194] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1724.535206] Call Trace: [ 1724.535531] dump_stack+0x107/0x167 [ 1724.535978] should_fail.cold+0x5/0xa [ 1724.536470] ? xas_alloc+0x336/0x440 [ 1724.536918] should_failslab+0x5/0x20 [ 1724.537384] kmem_cache_alloc+0x5b/0x310 [ 1724.537868] xas_alloc+0x336/0x440 [ 1724.538296] xas_create+0x34a/0x10d0 [ 1724.538748] ? queued_spin_lock_slowpath+0xcc/0x8c0 [ 1724.539346] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1724.539984] xas_store+0x8c/0x1c40 [ 1724.540429] __xa_store+0x164/0x2d0 [ 1724.540874] ? xa_delete_node+0x280/0x280 [ 1724.541381] ? trace_hardirqs_on+0x5b/0x180 [ 1724.541904] xa_store+0x31/0x50 [ 1724.542307] __io_uring_add_tctx_node+0x1cf/0x520 [ 1724.542882] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1724.543507] ? alloc_fd+0x2e7/0x670 [ 1724.543946] io_uring_setup+0x1fbb/0x2980 [ 1724.544452] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1724.545060] ? wait_for_completion_io+0x270/0x270 [ 1724.545657] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1724.546290] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1724.546921] do_syscall_64+0x33/0x40 [ 1724.547370] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1724.547992] RIP: 0033:0x7f43c90c3b19 [ 1724.548450] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1724.550655] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1724.551572] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1724.552431] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1724.553291] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1724.554155] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1724.555021] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1738.053244] FAULT_INJECTION: forcing a failure. [ 1738.053244] name failslab, interval 1, probability 0, space 0, times 0 [ 1738.054862] CPU: 1 PID: 10456 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1738.055713] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1738.056746] Call Trace: [ 1738.057073] dump_stack+0x107/0x167 [ 1738.057535] should_fail.cold+0x5/0xa [ 1738.058001] ? create_object.isra.0+0x3a/0xa30 21:53:35 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 59) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:53:35 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x4000) 21:53:35 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:53:35 executing program 6: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x1}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000000)) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') writev(r2, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') r4 = creat(&(0x7f0000000080)='./file0\x00', 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') r6 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x8010, r1, 0x0) r7 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000, 0x30, r4, 0x10000000) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_WRITE={0x17, 0x5, 0x2000, @fd_index=0x4, 0x9, &(0x7f0000000140)="d49527a01c57dbcefa156ed551efdff140a5bcb63faa3a395f09ebdf7e2ccb90672ab1a60c28d36df5c44cda341abe581eebda7c4a1ed64af593aec3c9442bdaef17414a5e57bea30f7b431a562bdae6adf4206bc0884a9713bcee3de1a7055f7d7ba28cfd174befcb827fd4abc72740f64725f62a590e5a2c4d980a692a68233382ba0f7c", 0x85, 0x10, 0x1, {0x0, r8}}, 0x6) writev(r5, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) r9 = syz_mount_image$msdos(&(0x7f0000000340), &(0x7f0000000380)='./file0\x00', 0x9, 0x7, &(0x7f00000008c0)=[{&(0x7f00000003c0)="aedf40564105a8f81ae522f6481b2b4ae761b1dcd7de94728246437dd55cf2bdf7c843", 0x23, 0x9}, {&(0x7f0000000400)="4628b60e6363ddaabbed417dde3825394e94d32c03e2e73902b1edca02ec242fe3ae4ea5dd9f85979f803911179eaff72b61eaa32adc0a099d408f957026efdf871d5d1564faeecfb9ffceb734ea69c151ebff227f8df6d27d285d2a3addb7955e849ee3b21699f53d8361d80156e24975248e5649edbdf8e846fa391c5a0c0f352ee52206482f044711a1346d6cf6cb6e", 0x91, 0x3}, {&(0x7f00000004c0)="6c3642e45114b0bdbea5a4785cf323068cdcc3deeb72659af655aabf4ed1ff34c362e13204e71ac29bec8971214833cb577a658c73d8a0a587b6ae0eb9a2cc0e1ca48e105f54431d6e1cba47db0f05", 0x4f, 0x8}, {&(0x7f0000000540)="404e33d6a65ae2b3a3898ad35f70c1ea686f8dbc3c38ceeff892000ff61a9a8c84292c137b0d7c780a3818263c40aee6709f067e2f21e2b8d5202b7c49b345e2280d098d375a6bbe0e0a6c34a7da2d6e797ef141d0bff41abbfc4942fc45d41a60283f91093c9490c57f37e3b174c35cbdd6b71538da56994c4ff16902d97458b3018af23362adf74173e455c5ab3659158659", 0x93, 0x9}, {&(0x7f0000000600)="a5dd6665f9a5a5a422f21c2303ad4d8e82c3b32e3184b7e696f0e2bcd25aff8646b35b380eaa230bea0b3eafe2875c463a0e97d35a46ee64c66c28aa12274c265932a4e4314167ef355fb72b470abc54aa092e7099598a31131d330ab5c0eeb4bc226383fd3a4b3e44d495e9090aae29345aa6f82186b629945dcb512da9e8b6ebf1467751e03238e787b108c5eaf8176e5c01d18bbb8ac0f158a68d3e5e578af83716", 0xa3, 0x2}, {&(0x7f00000006c0)="24bb44919815776c81f2ab5fc84b0351a963a45220bfe743133c4cafb5bdfbc79ec37dece2ffff808ebef8c9aca750f59f6ca0713b816c786190ace8950c6b8b423bbc3ed34f00de3304c6998797b0d8981002328fe0f31d66dd49e65141e843949284b87e65e43572d68ce8852cc18007811df27d068e507ae7189b4509d19613614ac92c7cafa4de9615c53f818f88eff1c57b7c99ca9be799293d90638955c37297cf20356c536bc13e3e519c1e1b82bd73760e04654c3d9bdd9024f893fc43c6e2fc105aebff06b5", 0xca, 0xfffffffffffffff9}, {&(0x7f00000007c0)="dd2c113b05f738926a8620ac7e3e1d1a222dddac19cc244b5e6ba2ce2471f9d351f9b64f92d3e975a92b601177a0675f300b6d742e86477618507f60ccf711ffcb4abd9d4962d3ea85ecaefc21aaac8c1747dcab9246b3d526b41f427937ff6cb2757fe30ef59b294b7df2d9bacc031ce5abaa53a7a8b90f771d889b8b9aac24f4915effcb4a9178e7efa69125e83303cf103cfb159bf7934bc3644282b90389ad40b4c7a7e07a47f1ec11c5bdcabd9b11e371b5ea40c53e43d672fd1f0a7069fb97181ee6b17d53eec9c7ca74c3eb9ce807ee60ee8f471ef23fc3e954f1fd71e75f73c612d2b96566e3e2748f3a3e866bc1", 0xf2, 0x81}], 0x1, &(0x7f0000000980)={[{@fat=@discard}, {@dots}, {@fat=@quiet}], [{@fsname={'fsname', 0x3d, '\x00'}}, {@fsmagic={'fsmagic', 0x3d, 0x3}}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@fowner_gt={'fowner>', 0xffffffffffffffff}}, {@dont_measure}]}) r10 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r10, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) syz_io_uring_submit(r6, r7, &(0x7f0000000a40)=@IORING_OP_FILES_UPDATE={0x14, 0x5, 0x0, 0x0, 0xd15, &(0x7f0000000a00)=[r0, r9, r1, r5, r10, r3], 0x6, 0x0, 0x1, {0x0, r8}}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000007, 0x4000010, r5, 0x0) 21:53:35 executing program 2: perf_event_open(&(0x7f0000000240)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) 21:53:35 executing program 0: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x4}, 0x0, 0x7, 0x0, 0x1, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x30, r2, 0x10000000) 21:53:35 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 60) [ 1738.058565] should_failslab+0x5/0x20 21:53:35 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 12) [ 1738.059185] kmem_cache_alloc+0x5b/0x310 [ 1738.059792] ? mark_held_locks+0x9e/0xe0 [ 1738.060295] create_object.isra.0+0x3a/0xa30 [ 1738.060838] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1738.061460] kmem_cache_alloc+0x159/0x310 [ 1738.061974] xas_alloc+0x336/0x440 [ 1738.062411] xas_create+0x34a/0x10d0 [ 1738.062872] ? kernel_text_address+0xf2/0x120 [ 1738.063426] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1738.064078] xas_store+0x8c/0x1c40 [ 1738.064526] __xa_store+0x164/0x2d0 [ 1738.064968] ? xa_delete_node+0x280/0x280 [ 1738.065482] xa_store+0x31/0x50 [ 1738.065885] __io_uring_add_tctx_node+0x1cf/0x520 [ 1738.066472] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1738.067116] ? alloc_fd+0x2e7/0x670 [ 1738.067566] io_uring_setup+0x1fbb/0x2980 [ 1738.068075] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1738.068703] ? wait_for_completion_io+0x270/0x270 [ 1738.069311] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1738.069945] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1738.070575] do_syscall_64+0x33/0x40 [ 1738.071027] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1738.071181] FAULT_INJECTION: forcing a failure. [ 1738.071181] name failslab, interval 1, probability 0, space 0, times 0 [ 1738.071645] RIP: 0033:0x7f43c90c3b19 [ 1738.071666] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1738.076871] RSP: 002b:00007f43c6639108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1738.077804] RAX: ffffffffffffffda RBX: 00007f43c91d6f60 RCX: 00007f43c90c3b19 [ 1738.078676] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1738.079544] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1738.080416] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1738.081282] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1738.082173] CPU: 0 PID: 10461 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1738.083762] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1738.085665] Call Trace: [ 1738.086273] dump_stack+0x107/0x167 [ 1738.087108] should_fail.cold+0x5/0xa [ 1738.087978] ? __alloc_file+0x21/0x320 [ 1738.088872] should_failslab+0x5/0x20 [ 1738.089741] kmem_cache_alloc+0x5b/0x310 [ 1738.090669] __alloc_file+0x21/0x320 [ 1738.091515] alloc_empty_file+0x6d/0x170 [ 1738.092441] alloc_file+0x5e/0x5a0 [ 1738.093258] alloc_file_pseudo+0x16a/0x250 [ 1738.094216] ? alloc_file+0x5a0/0x5a0 [ 1738.095087] ? ctx_sched_out+0xa00/0xa00 [ 1738.096015] anon_inode_getfile+0xc8/0x1f0 [ 1738.096994] __do_sys_perf_event_open+0xf59/0x2e60 [ 1738.098113] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1738.099202] ? perf_event_set_output+0x5b0/0x5b0 [ 1738.100273] ? wait_for_completion_io+0x270/0x270 [ 1738.101409] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1738.102612] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1738.103796] do_syscall_64+0x33/0x40 [ 1738.104659] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1738.105824] RIP: 0033:0x7fc2d1848b19 [ 1738.106682] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1738.110894] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1738.112645] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1738.114285] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1738.115908] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1738.117538] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000002 [ 1738.119153] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 [ 1738.124208] FAULT_INJECTION: forcing a failure. [ 1738.124208] name failslab, interval 1, probability 0, space 0, times 0 [ 1738.125789] CPU: 1 PID: 10462 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1738.126626] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1738.127625] Call Trace: [ 1738.127951] dump_stack+0x107/0x167 [ 1738.128413] should_fail.cold+0x5/0xa [ 1738.128872] ? xas_alloc+0x336/0x440 [ 1738.129325] should_failslab+0x5/0x20 [ 1738.129782] kmem_cache_alloc+0x5b/0x310 [ 1738.130278] xas_alloc+0x336/0x440 [ 1738.130718] xas_create+0x34a/0x10d0 [ 1738.131174] ? kernel_text_address+0xf2/0x120 [ 1738.131718] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 21:53:35 executing program 2: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) copy_file_range(r0, 0x0, r2, &(0x7f0000000000)=0x3, 0x8001, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) syz_io_uring_submit(r3, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 1738.132352] xas_store+0x8c/0x1c40 [ 1738.132946] __xa_store+0x164/0x2d0 [ 1738.133383] ? xa_delete_node+0x280/0x280 [ 1738.133882] ? trace_hardirqs_on+0x5b/0x180 [ 1738.134402] xa_store+0x31/0x50 [ 1738.134471] loop6: detected capacity change from 0 to 8388096 [ 1738.134810] __io_uring_add_tctx_node+0x1cf/0x520 [ 1738.136722] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1738.137348] ? alloc_fd+0x2e7/0x670 [ 1738.137797] io_uring_setup+0x1fbb/0x2980 [ 1738.138295] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1738.138903] ? wait_for_completion_io+0x270/0x270 [ 1738.139507] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1738.140136] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1738.140773] do_syscall_64+0x33/0x40 [ 1738.141218] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1738.141826] RIP: 0033:0x7f741addcb19 [ 1738.142270] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1738.144484] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1738.144755] FAT-fs (loop6): Unrecognized mount option "fsname=" or missing value [ 1738.145388] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1738.145394] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1738.145400] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1738.145407] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1738.145413] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1738.172240] loop6: detected capacity change from 0 to 8388096 21:53:35 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x6000) 21:53:35 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 13) 21:53:35 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r5, 0x0, 0x0}, 0x0) r6 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) syz_io_uring_submit(r6, r4, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_TIMEOUT={0xb, 0x3, 0x0, 0x0, 0x2, &(0x7f0000000040)={r7, r8+10000000}}, 0x9) [ 1738.198605] FAT-fs (loop6): Unrecognized mount option "fsname=" or missing value [ 1738.218751] FAULT_INJECTION: forcing a failure. [ 1738.218751] name failslab, interval 1, probability 0, space 0, times 0 [ 1738.220132] CPU: 1 PID: 10478 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1738.220952] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1738.221905] Call Trace: [ 1738.222222] dump_stack+0x107/0x167 [ 1738.222645] should_fail.cold+0x5/0xa [ 1738.223090] ? __alloc_file+0x21/0x320 [ 1738.223552] should_failslab+0x5/0x20 [ 1738.224002] kmem_cache_alloc+0x5b/0x310 [ 1738.224480] __alloc_file+0x21/0x320 [ 1738.224909] alloc_empty_file+0x6d/0x170 [ 1738.225380] alloc_file+0x5e/0x5a0 [ 1738.225792] alloc_file_pseudo+0x16a/0x250 [ 1738.226289] ? alloc_file+0x5a0/0x5a0 [ 1738.226734] ? ctx_sched_out+0xa00/0xa00 [ 1738.227202] anon_inode_getfile+0xc8/0x1f0 [ 1738.227691] __do_sys_perf_event_open+0xf59/0x2e60 [ 1738.228255] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1738.228818] ? perf_event_set_output+0x5b0/0x5b0 [ 1738.229364] ? wait_for_completion_io+0x270/0x270 [ 1738.229934] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1738.230545] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1738.231140] do_syscall_64+0x33/0x40 [ 1738.231565] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1738.232157] RIP: 0033:0x7fc2d1848b19 [ 1738.232592] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1738.234707] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1738.235586] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1738.236412] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1738.237231] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1738.238049] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000002 [ 1738.238869] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 21:53:35 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 61) 21:53:35 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1738.319558] FAULT_INJECTION: forcing a failure. [ 1738.319558] name failslab, interval 1, probability 0, space 0, times 0 [ 1738.320962] CPU: 1 PID: 10490 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1738.321764] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1738.322724] Call Trace: [ 1738.323031] dump_stack+0x107/0x167 [ 1738.323449] should_fail.cold+0x5/0xa [ 1738.323886] ? vm_area_dup+0x78/0x290 [ 1738.324326] should_failslab+0x5/0x20 [ 1738.324773] kmem_cache_alloc+0x5b/0x310 [ 1738.325245] vm_area_dup+0x78/0x290 [ 1738.325667] ? lock_release+0x680/0x680 [ 1738.326127] ? mark_lock+0xf5/0x2df0 [ 1738.326557] ? lock_chain_count+0x20/0x20 [ 1738.327032] ? mark_lock+0xf5/0x2df0 [ 1738.327459] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1738.328061] ? lock_chain_count+0x20/0x20 [ 1738.328547] ? mark_lock+0xf5/0x2df0 [ 1738.328981] ? vm_area_alloc+0x110/0x110 [ 1738.329447] ? __lock_acquire+0x1657/0x5b00 [ 1738.329957] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1738.330567] ? vmacache_find+0x55/0x2a0 [ 1738.331024] __split_vma+0xa8/0x4e0 [ 1738.331442] __do_munmap+0x365/0x1260 [ 1738.331881] ? arch_get_unmapped_area+0x450/0x450 [ 1738.332442] ? lock_release+0x680/0x680 [ 1738.332896] mmap_region+0x7cc/0x1500 [ 1738.333338] do_mmap+0x868/0x1370 [ 1738.333741] vm_mmap_pgoff+0x198/0x1f0 [ 1738.334187] ? randomize_page+0xb0/0xb0 [ 1738.334649] ksys_mmap_pgoff+0x41c/0x560 [ 1738.335114] ? find_mergeable_anon_vma+0x250/0x250 [ 1738.335682] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1738.336284] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1738.336889] do_syscall_64+0x33/0x40 [ 1738.337319] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1738.337906] RIP: 0033:0x7f43c90c3b62 [ 1738.338329] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1738.340461] RSP: 002b:00007f43c66390f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1738.341333] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f43c90c3b62 [ 1738.342161] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1738.342976] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1738.343797] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1738.344618] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:53:48 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 62) 21:53:48 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:53:48 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000005c0)=ANY=[@ANYBLOB="000000000000000004000000000000000000edffffff00000000000000000000000000000000000000003449c419290000000000000000000000000000000000000000000005000000000000000000000000000000ffffff7f00000000af249e0900000000ff0000000000000000000000000000000000000000000000000000000000000040000000fffeffff08000000000000000000000000000000aa270000000000001f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe323e81bfe8b3fc542ccf71108bbfd3cdf7a2a6b9d602f5ac0b962daf02d6e502406ed53d09feca46cd2c4c23bb098607e11af2d5ed16b3a213d5769674e0f1f516ff0659db43c0e9d3409f3babf760c790933c5117b36e78fc35bf27001e32d3cc753a1a1ef4748b92e6fe44a0d68470898e60fd9b354a523954b15f326727d34ca563a5938f375bb950c53666"]) io_uring_enter(r0, 0x3388, 0x2260, 0x3, &(0x7f0000000000)={[0x7fffffff]}, 0x8) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') writev(r2, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) r3 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000040)='devices.allow\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000080)={0x80000008}) 21:53:48 executing program 2: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x3, 0x80, 0x40, 0x1, 0x8f, 0x1f, 0x0, 0x96e, 0x2002, 0x8, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0xffff, 0x2, @perf_bp={&(0x7f0000000000), 0x9}, 0x4000, 0x52, 0x1, 0x4, 0x3, 0x4eee, 0x82, 0x0, 0x9}, 0x0, 0x2, r0, 0x0) perf_event_open(&(0x7f00000000c0)={0x0, 0x80, 0x3, 0x7, 0x4, 0x7f, 0x0, 0xfffffffffffffffe, 0xb0000, 0x9, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, @perf_config_ext={0x4, 0x8}, 0x55c80, 0x3, 0x4, 0x2, 0x8, 0x5, 0x9, 0x0, 0x0, 0x0, 0x2}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0x2) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) syz_io_uring_submit(r2, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:53:48 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 14) 21:53:48 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 60) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:53:48 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0xa}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:53:48 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x400000) [ 1751.610205] FAULT_INJECTION: forcing a failure. [ 1751.610205] name failslab, interval 1, probability 0, space 0, times 0 [ 1751.613207] CPU: 0 PID: 10508 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1751.614988] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1751.617151] Call Trace: [ 1751.617860] dump_stack+0x107/0x167 [ 1751.618851] should_fail.cold+0x5/0xa [ 1751.619870] ? security_file_alloc+0x34/0x170 [ 1751.621055] should_failslab+0x5/0x20 [ 1751.622051] kmem_cache_alloc+0x5b/0x310 [ 1751.623111] security_file_alloc+0x34/0x170 [ 1751.624235] __alloc_file+0xb7/0x320 [ 1751.625235] alloc_empty_file+0x6d/0x170 [ 1751.626279] alloc_file+0x5e/0x5a0 [ 1751.627203] alloc_file_pseudo+0x16a/0x250 [ 1751.628293] ? alloc_file+0x5a0/0x5a0 [ 1751.628785] FAULT_INJECTION: forcing a failure. [ 1751.628785] name failslab, interval 1, probability 0, space 0, times 0 [ 1751.629314] ? ctx_sched_out+0xa00/0xa00 [ 1751.629344] anon_inode_getfile+0xc8/0x1f0 [ 1751.629371] __do_sys_perf_event_open+0xf59/0x2e60 [ 1751.629399] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1751.629437] ? perf_event_set_output+0x5b0/0x5b0 [ 1751.637838] ? wait_for_completion_io+0x270/0x270 [ 1751.638970] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1751.640181] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1751.641402] do_syscall_64+0x33/0x40 [ 1751.642268] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1751.643448] RIP: 0033:0x7fc2d1848b19 [ 1751.644327] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1751.648626] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1751.650409] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1751.652060] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1751.653678] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1751.655294] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000002 [ 1751.656930] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 [ 1751.658583] CPU: 1 PID: 10511 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1751.660168] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1751.661992] Call Trace: [ 1751.662593] dump_stack+0x107/0x167 [ 1751.663390] should_fail.cold+0x5/0xa [ 1751.664385] ? xas_alloc+0x336/0x440 [ 1751.665213] should_failslab+0x5/0x20 [ 1751.666201] kmem_cache_alloc+0x5b/0x310 [ 1751.667082] xas_alloc+0x336/0x440 [ 1751.667899] xas_create+0x34a/0x10d0 [ 1751.668835] ? kernel_text_address+0xf2/0x120 [ 1751.669798] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1751.670927] xas_store+0x8c/0x1c40 [ 1751.671700] __xa_store+0x164/0x2d0 [ 1751.672496] ? xa_delete_node+0x280/0x280 [ 1751.673570] ? trace_hardirqs_on+0x5b/0x180 [ 1751.674463] FAULT_INJECTION: forcing a failure. [ 1751.674463] name failslab, interval 1, probability 0, space 0, times 0 [ 1751.674557] xa_store+0x31/0x50 [ 1751.677838] __io_uring_add_tctx_node+0x1cf/0x520 [ 1751.678919] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1751.680140] ? alloc_fd+0x2e7/0x670 [ 1751.681036] io_uring_setup+0x1fbb/0x2980 [ 1751.682015] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1751.683151] ? wait_for_completion_io+0x270/0x270 [ 1751.684184] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1751.685329] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1751.686407] do_syscall_64+0x33/0x40 [ 1751.687195] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1751.688272] RIP: 0033:0x7f741addcb19 [ 1751.689061] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1751.692858] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1751.694463] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1751.695927] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1751.697396] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1751.698895] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1751.700511] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1751.702172] CPU: 0 PID: 10507 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1751.703802] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1751.705699] Call Trace: [ 1751.706309] dump_stack+0x107/0x167 [ 1751.707183] should_fail.cold+0x5/0xa [ 1751.708077] ? create_object.isra.0+0x3a/0xa30 [ 1751.709156] should_failslab+0x5/0x20 [ 1751.710041] kmem_cache_alloc+0x5b/0x310 [ 1751.710988] create_object.isra.0+0x3a/0xa30 [ 1751.711994] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1751.713192] kmem_cache_alloc+0x159/0x310 [ 1751.714161] vm_area_dup+0x78/0x290 [ 1751.715013] ? mark_lock+0xf5/0x2df0 [ 1751.715868] ? mark_lock+0xf5/0x2df0 [ 1751.716750] ? lock_chain_count+0x20/0x20 [ 1751.717729] ? lock_chain_count+0x20/0x20 [ 1751.718685] ? mark_lock+0xf5/0x2df0 [ 1751.719551] ? find_held_lock+0x2c/0x110 [ 1751.720507] ? mark_lock+0xf5/0x2df0 [ 1751.721378] ? vm_area_alloc+0x110/0x110 [ 1751.722300] ? __lock_acquire+0x1657/0x5b00 [ 1751.723295] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1751.724496] ? __lock_acquire+0x1657/0x5b00 [ 1751.725505] ? vmacache_find+0x55/0x2a0 [ 1751.726428] __split_vma+0xa8/0x4e0 [ 1751.727279] __do_munmap+0x365/0x1260 [ 1751.728174] ? arch_get_unmapped_area+0x450/0x450 [ 1751.729315] ? lock_release+0x680/0x680 [ 1751.730232] mmap_region+0x7cc/0x1500 [ 1751.731132] do_mmap+0x868/0x1370 [ 1751.731944] vm_mmap_pgoff+0x198/0x1f0 [ 1751.732888] ? randomize_page+0xb0/0xb0 [ 1751.733822] ksys_mmap_pgoff+0x41c/0x560 [ 1751.734761] ? find_mergeable_anon_vma+0x250/0x250 [ 1751.735909] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1751.737126] do_syscall_64+0x33/0x40 [ 1751.737992] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1751.739168] RIP: 0033:0x7f43c90c3b62 [ 1751.740013] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1751.744220] RSP: 002b:00007f43c66390f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1751.745992] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f43c90c3b62 [ 1751.747615] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1751.749295] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1751.750939] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1751.752581] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:53:48 executing program 6: recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000940)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000000)=""/125, 0x7d}, {&(0x7f0000000080)=""/9, 0x9}, {&(0x7f0000000740)=""/94, 0x5e}, {&(0x7f0000000340)=""/219, 0xdb}, {&(0x7f0000000440)=""/76, 0x4c}, {&(0x7f00000004c0)=""/71, 0x47}], 0x6, &(0x7f00000005c0)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x80}}, {{&(0x7f0000000640), 0x6e, &(0x7f0000000140)=[{&(0x7f00000006c0)=""/85, 0x55}, {&(0x7f00000009c0)=""/265, 0x109}], 0x2, &(0x7f0000000840)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0}}}], 0xd0}}], 0x2, 0x1a061, &(0x7f00000001c0)) perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) 21:53:48 executing program 0: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x4003862, &(0x7f00000002c0)={0x0, 0xdc97}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) sendfile(r0, r1, 0x0, 0x9) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) 21:53:48 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x5966}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000000)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:53:48 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x600000) 21:53:48 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 61) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:53:49 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 15) 21:53:49 executing program 6: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r0) r1 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x3ff, 0x3, &(0x7f0000000400)=[{&(0x7f0000000340)="baeec3182db78b2557dbcd6c3e2a841e600a325fb2820ff65d7f389bbd2ecfb9ba36f00a80d33fc6236b35d0c5872c0744a45e16139da6cd8a9a4e99d9e79d7fdbf689c7a3d7d476892762f4777e8899510ecbed8bb10d0a0c657a707384fd01cc33a824781d0d616e4ec1ae057c5bbed154606cb7f75e4b30582e51f115280e24bc9cf222cb6f5303834ecd618f787bfb5979e071f2dc2beb4ccc94f7ff5776dcfec361f281e754659f44f4896b608d162f94cb3ca3f47b19c5e1b04a0d5ec3", 0xc0, 0x536}, {&(0x7f0000000100)="776f25c901c0fc30e6272eaa6b5f78a4eb99b8fb9b781fae432b65029579b29b6e34e097391944d841881da57ca39815554ca5716cb699388c7bc8de97b1724dc5400a8c5aac8b05bd23da9a6348db418340d4dfc5bb01e0993b8e863f4141d5686767ba1bdb319a", 0x68, 0x3}, {&(0x7f00000001c0)="5dc4560b4e82b492f5a31cc5bb93d6521b3328b84c7074e3d57d18035d980ded6d4e3c2079db2955cad7929ead5903884c6b83ca50e2eac3a8808d7040565543d7f41fcb0821510efb708f8ed05b4b498cb7af4c1649724a1eabe81930df67dc57849afe804236c3b2aed4ab50c9", 0x6e, 0x2}], 0x401, &(0x7f0000000480)={[{@shortname_lower}, {@uni_xlate}, {@numtail}, {@utf8no}], [{@defcontext={'defcontext', 0x3d, 'user_u'}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@smackfstransmute={'smackfstransmute', 0x3d, '^/]--'}}, {@smackfshat={'smackfshat', 0x3d, '-'}}, {@fowner_gt={'fowner>', 0xee01}}, {@audit}, {@fsuuid={'fsuuid', 0x3d, {[0x62, 0x63, 0x63, 0x30, 0x32, 0x66, 0x30, 0x30], 0x2d, [0x64, 0x35, 0x37, 0x32], 0x2d, [0x64, 0x66, 0xe3e77e0ff9a3f99a], 0x2d, [0x34, 0x63, 0x31, 0x65], 0x2d, [0x33, 0x34, 0x63, 0x0, 0x30, 0x39, 0x36, 0x2]}}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}]}) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000580), 0x60042, 0x0) sendfile(r1, r2, &(0x7f00000005c0)=0x200, 0xad7) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r2, 0xc0189373, &(0x7f0000000600)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) ioctl$PERF_EVENT_IOC_REFRESH(r3, 0x2402, 0x98c) r4 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2, 0x0, 0x0, r2}, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000180)=0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r4, 0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000000)=@IORING_OP_NOP={0x0, 0x2}, 0x1000) 21:53:49 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x800000) [ 1751.965601] FAULT_INJECTION: forcing a failure. [ 1751.965601] name failslab, interval 1, probability 0, space 0, times 0 [ 1751.968783] CPU: 1 PID: 10533 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1751.970603] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1751.972696] Call Trace: [ 1751.973375] dump_stack+0x107/0x167 [ 1751.974338] should_fail.cold+0x5/0xa [ 1751.975331] ? create_object.isra.0+0x3a/0xa30 [ 1751.976486] should_failslab+0x5/0x20 [ 1751.977453] kmem_cache_alloc+0x5b/0x310 [ 1751.978448] ? mark_held_locks+0x9e/0xe0 [ 1751.979458] create_object.isra.0+0x3a/0xa30 [ 1751.980562] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1751.981872] kmem_cache_alloc+0x159/0x310 [ 1751.982933] xas_alloc+0x336/0x440 [ 1751.983831] xas_create+0x34a/0x10d0 [ 1751.984794] ? kernel_text_address+0xf2/0x120 [ 1751.985951] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1751.987297] xas_store+0x8c/0x1c40 [ 1751.988202] __xa_store+0x164/0x2d0 [ 1751.989101] ? xa_delete_node+0x280/0x280 [ 1751.990150] ? trace_hardirqs_on+0x5b/0x180 [ 1751.991287] xa_store+0x31/0x50 [ 1751.992109] __io_uring_add_tctx_node+0x1cf/0x520 [ 1751.993130] ? io_uring_alloc_task_context+0x6a0/0x6a0 [ 1751.994220] ? alloc_fd+0x2e7/0x670 [ 1751.995078] io_uring_setup+0x1fbb/0x2980 [ 1751.995976] ? __do_sys_io_uring_enter+0x1890/0x1890 [ 1751.997305] ? wait_for_completion_io+0x270/0x270 [ 1751.998369] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1751.999750] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1752.000875] do_syscall_64+0x33/0x40 [ 1752.001852] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1752.002939] RIP: 0033:0x7f741addcb19 [ 1752.003912] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1752.005154] FAULT_INJECTION: forcing a failure. [ 1752.005154] name failslab, interval 1, probability 0, space 0, times 0 [ 1752.007808] RSP: 002b:00007f7418352108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 1752.007829] RAX: ffffffffffffffda RBX: 00007f741aeeff60 RCX: 00007f741addcb19 [ 1752.007852] RDX: 0000000020ffc000 RSI: 00000000200002c0 RDI: 0000000000003862 [ 1752.014938] RBP: 00000000200002c0 R08: 0000000020000180 R09: 0000000020000180 [ 1752.016387] R10: 0000000020000200 R11: 0000000000000202 R12: 0000000020000180 [ 1752.017873] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1752.019371] CPU: 0 PID: 10535 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1752.020984] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1752.022918] Call Trace: [ 1752.023536] dump_stack+0x107/0x167 [ 1752.024370] should_fail.cold+0x5/0xa [ 1752.025262] ? create_object.isra.0+0x3a/0xa30 [ 1752.026305] should_failslab+0x5/0x20 [ 1752.027181] kmem_cache_alloc+0x5b/0x310 [ 1752.028112] ? percpu_ref_put_many.constprop.0+0x4e/0x110 [ 1752.029394] create_object.isra.0+0x3a/0xa30 [ 1752.030389] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1752.031549] kmem_cache_alloc+0x159/0x310 [ 1752.032503] security_file_alloc+0x34/0x170 [ 1752.033491] __alloc_file+0xb7/0x320 [ 1752.034357] alloc_empty_file+0x6d/0x170 [ 1752.035282] alloc_file+0x5e/0x5a0 [ 1752.036090] alloc_file_pseudo+0x16a/0x250 [ 1752.037059] ? alloc_file+0x5a0/0x5a0 [ 1752.037932] ? ctx_sched_out+0xa00/0xa00 [ 1752.038862] anon_inode_getfile+0xc8/0x1f0 [ 1752.039838] __do_sys_perf_event_open+0xf59/0x2e60 [ 1752.040982] ? __mutex_unlock_slowpath+0xe1/0x600 [ 1752.042080] ? perf_event_set_output+0x5b0/0x5b0 [ 1752.043143] ? wait_for_completion_io+0x270/0x270 [ 1752.044251] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1752.045443] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1752.046618] do_syscall_64+0x33/0x40 [ 1752.047456] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1752.048630] RIP: 0033:0x7fc2d1848b19 [ 1752.049475] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1752.053671] RSP: 002b:00007fc2cedbe188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1752.055389] RAX: ffffffffffffffda RBX: 00007fc2d195bf60 RCX: 00007fc2d1848b19 [ 1752.057020] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 [ 1752.058641] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1752.060263] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000002 [ 1752.061904] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 [ 1752.077513] loop6: detected capacity change from 0 to 2560 [ 1752.082910] FAT-fs (loop6): Unrecognized mount option "fsmagic=0x0000000000000007" or missing value 21:53:49 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 63) 21:53:49 executing program 2: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) io_uring_enter(r1, 0x132c, 0x24e5, 0x3, &(0x7f00000000c0)={[0x200]}, 0x8) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) syz_io_uring_submit(r2, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$BTRFS_IOC_SEND(r0, 0x40489426, &(0x7f0000000040)={{r3}, 0x7, &(0x7f0000000000)=[0x2, 0x6, 0x7, 0x8, 0x2, 0xf7, 0x10001], 0x6, 0x2, [0x5, 0x4, 0x0, 0x4]}) r4 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) write$binfmt_aout(r4, &(0x7f0000000340)={{0xc, 0x93, 0xaa, 0x135, 0x1cf, 0x3bda, 0x8c, 0x6}, "4a3f324254ee1b82e24710341a0d0fa0c9d14cffd6dc139660ef73e24a9f485c427d9c9b36e4b4e9b2727d643871a48aa68bba4394829c7af147954ba3c0bbe66031c2f160d3d60aeffa7e4c392464f37e65a92fe20577849eee7360470c02f46b4c9938ac45be5cccf1e6064671a4c77bc03787232252f2d7a6e10574d6e2606ea3c84d2cd13652f2d3c9cfa0a5c87d88576ea304e021290efc1d8486bd6e602e2c6547a569447f724e104e702aa7177e6ba2308fd9e879957961e16dd5da4b854280e4f4b836ac3de5f895439dd15ea0a80273b3f2f34717dfcd3abbf4690690d6db578de223f6ea506a7ecb2b3a17c81d6ed3298ba1dacfda9f35b684ab", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x81f) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:53:49 executing program 0: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x2ac}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) pread64(r2, &(0x7f0000000000)=""/43, 0x2b, 0x5af8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x5) 21:53:49 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1752.126826] loop6: detected capacity change from 0 to 2560 [ 1752.131117] FAT-fs (loop6): Unrecognized mount option "fsmagic=0x0000000000000007" or missing value 21:53:49 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 62) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) [ 1752.173764] FAULT_INJECTION: forcing a failure. [ 1752.173764] name failslab, interval 1, probability 0, space 0, times 0 [ 1752.176276] CPU: 1 PID: 10553 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1752.177716] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1752.179439] Call Trace: [ 1752.179989] dump_stack+0x107/0x167 [ 1752.180752] should_fail.cold+0x5/0xa [ 1752.181542] ? create_object.isra.0+0x3a/0xa30 [ 1752.182489] should_failslab+0x5/0x20 [ 1752.183275] kmem_cache_alloc+0x5b/0x310 [ 1752.184119] create_object.isra.0+0x3a/0xa30 [ 1752.185030] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1752.186105] kmem_cache_alloc+0x159/0x310 [ 1752.186964] vm_area_dup+0x78/0x290 [ 1752.187724] ? mark_lock+0xf5/0x2df0 [ 1752.188509] ? mark_lock+0xf5/0x2df0 [ 1752.189280] ? lock_chain_count+0x20/0x20 [ 1752.190141] ? lock_chain_count+0x20/0x20 [ 1752.191003] ? mark_lock+0xf5/0x2df0 [ 1752.191774] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 1752.192865] ? lock_chain_count+0x20/0x20 [ 1752.193708] ? mark_lock+0xf5/0x2df0 [ 1752.194483] ? vm_area_alloc+0x110/0x110 [ 1752.195326] ? mark_held_locks+0x9e/0xe0 [ 1752.196171] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1752.197275] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1752.198364] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1752.199467] ? trace_hardirqs_on+0x5b/0x180 [ 1752.200358] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1752.201467] __split_vma+0xa8/0x4e0 [ 1752.202223] __do_munmap+0x365/0x1260 [ 1752.202999] ? arch_get_unmapped_area+0x450/0x450 [ 1752.203989] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1752.205066] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 1752.206189] mmap_region+0x7cc/0x1500 [ 1752.206984] do_mmap+0x868/0x1370 [ 1752.207713] vm_mmap_pgoff+0x198/0x1f0 [ 1752.208526] ? randomize_page+0xb0/0xb0 [ 1752.209350] ksys_mmap_pgoff+0x41c/0x560 [ 1752.210192] ? find_mergeable_anon_vma+0x250/0x250 [ 1752.211200] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1752.212274] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1752.213336] do_syscall_64+0x33/0x40 [ 1752.214106] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1752.215156] RIP: 0033:0x7f741addcb62 [ 1752.215925] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1752.219671] RSP: 002b:00007f74183520f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1752.221243] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f741addcb62 [ 1752.222705] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1752.224168] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1752.225632] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1752.227103] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1752.231751] FAULT_INJECTION: forcing a failure. [ 1752.231751] name failslab, interval 1, probability 0, space 0, times 0 [ 1752.234561] CPU: 0 PID: 10557 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1752.236124] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1752.237998] Call Trace: [ 1752.238598] dump_stack+0x107/0x167 [ 1752.239434] should_fail.cold+0x5/0xa [ 1752.240293] ? anon_vma_clone+0xdc/0x590 [ 1752.241216] should_failslab+0x5/0x20 [ 1752.242076] kmem_cache_alloc+0x5b/0x310 [ 1752.243020] anon_vma_clone+0xdc/0x590 [ 1752.243905] __split_vma+0x17c/0x4e0 [ 1752.244753] __do_munmap+0x365/0x1260 [ 1752.245614] ? arch_get_unmapped_area+0x450/0x450 [ 1752.246710] ? lock_release+0x680/0x680 [ 1752.247607] mmap_region+0x7cc/0x1500 [ 1752.248494] do_mmap+0x868/0x1370 [ 1752.249287] vm_mmap_pgoff+0x198/0x1f0 [ 1752.250174] ? randomize_page+0xb0/0xb0 [ 1752.251086] ksys_mmap_pgoff+0x41c/0x560 [ 1752.252015] ? find_mergeable_anon_vma+0x250/0x250 [ 1752.253137] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1752.254321] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1752.255488] do_syscall_64+0x33/0x40 [ 1752.256332] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1752.257496] RIP: 0033:0x7f43c90c3b62 [ 1752.258339] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1752.262484] RSP: 002b:00007f43c66180f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1752.264200] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f43c90c3b62 [ 1752.265819] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1752.267426] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1752.269040] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1752.270644] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:53:49 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') writev(r1, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) mmap$perf(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4, 0x110, r1, 0x6) 21:54:03 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 63) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:54:03 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x80ffff) 21:54:03 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 64) 21:54:03 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (fail_nth: 16) 21:54:03 executing program 6: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') writev(r0, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) ioctl$PIO_SCRNMAP(r0, 0x4b41, &(0x7f0000000340)="0b716a07110265a7d9824637872eac7878522b647c6d6ad1b4c240ed972ce08d5778b022e121449d25f6216efb6fde2d06ceeafc98c04f29c32f2a783d85ad2ae74a6a") perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r2 = syz_io_uring_setup(0x132, &(0x7f00000003c0), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) r5 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4, 0x810, r1, 0x8000000) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) syz_io_uring_submit(r5, r4, &(0x7f0000000480)=@IORING_OP_TIMEOUT={0xb, 0x5, 0x0, 0x0, 0x1, &(0x7f0000000440)={r6, r7+10000000}, 0x1, 0x1, 0x1}, 0xc4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r8, 0x0, 0x0}, 0x0) r9 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x0) syz_io_uring_submit(r9, r4, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_io_uring_setup(0x7c51, &(0x7f0000000000)={0x0, 0x935, 0x12, 0x1, 0x22e, 0x0, r1}, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)=0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000100)=@IORING_OP_NOP={0x0, 0x1}, 0x3ee879b5) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) 21:54:03 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r2, 0x0, 0x0, 0x0) r3 = getpgid(0xffffffffffffffff) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') writev(r4, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) perf_event_open(&(0x7f0000000000)={0x5, 0x80, 0x5, 0x44, 0x9b, 0x7f, 0x0, 0x77f4, 0x40a30, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x4, @perf_config_ext={0x9, 0x7}, 0xc09, 0x8, 0x4, 0x7, 0xfffffffffffffffa, 0x5, 0x101, 0x0, 0x80000001, 0x0, 0x9}, r3, 0x0, r4, 0x5) r5 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r6, r7, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r8, 0x0, 0x0}, 0x0) r9 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r5, 0x0) syz_io_uring_submit(r9, r7, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r10 = signalfd(r4, &(0x7f0000000080)={[0xd581]}, 0x8) r11 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/fib_trie\x00') r12 = io_uring_register$IORING_REGISTER_PERSONALITY(r11, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_CONNECT={0x10, 0x1, 0x0, 0xffffffffffffffff, 0x80, &(0x7f0000000340)=@un=@abs={0x0, 0x0, 0x8}, 0x0, 0x0, 0x1, {0x0, r12}}, 0x4) syz_io_uring_submit(r1, r7, &(0x7f0000000140)=@IORING_OP_ACCEPT={0xd, 0x5, 0x0, r10, &(0x7f00000000c0)=0x80, &(0x7f0000000340)=@hci, 0x0, 0x80800, 0x1, {0x0, r12}}, 0xffff) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:54:03 executing program 0: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x81, 0x70, 0x80, 0x65, 0x0, 0x1f, 0x28a0c, 0xa, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7, 0x4, @perf_bp={&(0x7f0000000000), 0x4}, 0x8000, 0x5, 0xff, 0x6, 0x800, 0x7f, 0xe000, 0x0, 0x3ff, 0x0, 0x7}, 0xffffffffffffffff, 0x6, r0, 0x1) 21:54:03 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1766.260578] FAULT_INJECTION: forcing a failure. [ 1766.260578] name failslab, interval 1, probability 0, space 0, times 0 [ 1766.262134] CPU: 0 PID: 10579 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1766.262942] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1766.263917] Call Trace: [ 1766.264237] dump_stack+0x107/0x167 [ 1766.264673] should_fail.cold+0x5/0xa [ 1766.265122] ? anon_vma_clone+0xdc/0x590 [ 1766.265593] should_failslab+0x5/0x20 [ 1766.266038] kmem_cache_alloc+0x5b/0x310 [ 1766.266515] anon_vma_clone+0xdc/0x590 [ 1766.266974] __split_vma+0x17c/0x4e0 [ 1766.267409] __do_munmap+0x365/0x1260 [ 1766.267855] ? arch_get_unmapped_area+0x450/0x450 [ 1766.268420] ? lock_release+0x680/0x680 [ 1766.268892] mmap_region+0x7cc/0x1500 [ 1766.269350] do_mmap+0x868/0x1370 [ 1766.269761] vm_mmap_pgoff+0x198/0x1f0 [ 1766.270218] ? randomize_page+0xb0/0xb0 [ 1766.270690] ksys_mmap_pgoff+0x41c/0x560 [ 1766.271166] ? find_mergeable_anon_vma+0x250/0x250 [ 1766.271739] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1766.272352] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1766.272961] do_syscall_64+0x33/0x40 [ 1766.273395] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1766.273992] RIP: 0033:0x7f741addcb62 [ 1766.274427] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1766.276562] RSP: 002b:00007f74183520f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1766.277456] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f741addcb62 [ 1766.278109] FAULT_INJECTION: forcing a failure. [ 1766.278109] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1766.278290] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1766.278297] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1766.278303] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1766.278310] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1766.287041] CPU: 1 PID: 10587 Comm: syz-executor.1 Not tainted 5.10.262 #1 [ 1766.288486] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1766.290227] Call Trace: [ 1766.290787] dump_stack+0x107/0x167 [ 1766.291562] should_fail.cold+0x5/0xa [ 1766.292366] _copy_to_user+0x2e/0x180 [ 1766.293178] simple_read_from_buffer+0xcc/0x160 [ 1766.294156] proc_fail_nth_read+0x198/0x230 [ 1766.295068] ? proc_sessionid_read+0x230/0x230 [ 1766.296027] ? security_file_permission+0xb1/0xe0 [ 1766.297065] ? proc_sessionid_read+0x230/0x230 [ 1766.298016] vfs_read+0x228/0x620 [ 1766.298751] ksys_read+0x12d/0x260 [ 1766.299497] ? vfs_write+0xb10/0xb10 [ 1766.300301] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1766.301413] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1766.302507] do_syscall_64+0x33/0x40 [ 1766.303289] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1766.304362] RIP: 0033:0x7fc2d17fb69c 21:54:03 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) [ 1766.305154] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1766.309226] RSP: 002b:00007fc2cedbe170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1766.310886] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fc2d17fb69c [ 1766.312456] RDX: 000000000000000f RSI: 00007fc2cedbe1e0 RDI: 0000000000000003 [ 1766.314023] RBP: 00007fc2cedbe1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1766.315574] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000002 [ 1766.317135] R13: 00007ffd5047197f R14: 00007fc2cedbe300 R15: 0000000000022000 [ 1766.327781] FAULT_INJECTION: forcing a failure. [ 1766.327781] name failslab, interval 1, probability 0, space 0, times 0 [ 1766.329516] CPU: 0 PID: 10589 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1766.330537] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1766.331768] Call Trace: [ 1766.332169] dump_stack+0x107/0x167 [ 1766.332739] should_fail.cold+0x5/0xa [ 1766.333309] ? create_object.isra.0+0x3a/0xa30 [ 1766.333990] should_failslab+0x5/0x20 [ 1766.334572] kmem_cache_alloc+0x5b/0x310 [ 1766.335186] create_object.isra.0+0x3a/0xa30 [ 1766.335830] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1766.336590] kmem_cache_alloc+0x159/0x310 [ 1766.337211] anon_vma_clone+0xdc/0x590 [ 1766.337797] __split_vma+0x17c/0x4e0 [ 1766.338355] __do_munmap+0x365/0x1260 [ 1766.338921] ? arch_get_unmapped_area+0x450/0x450 [ 1766.339629] ? lock_release+0x680/0x680 [ 1766.340225] mmap_region+0x7cc/0x1500 [ 1766.340803] do_mmap+0x868/0x1370 [ 1766.341330] vm_mmap_pgoff+0x198/0x1f0 [ 1766.341907] ? randomize_page+0xb0/0xb0 [ 1766.342509] ksys_mmap_pgoff+0x41c/0x560 [ 1766.343112] ? find_mergeable_anon_vma+0x250/0x250 [ 1766.343847] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1766.344631] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1766.345397] do_syscall_64+0x33/0x40 [ 1766.345944] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1766.346711] RIP: 0033:0x7f43c90c3b62 [ 1766.347263] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1766.349967] RSP: 002b:00007f43c66180f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1766.351084] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f43c90c3b62 [ 1766.352140] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1766.353203] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1766.354258] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1766.355319] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:54:03 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x1000000) 21:54:03 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r3, 0x0, 0x0}, 0x0) syz_io_uring_setup(0x2358, &(0x7f0000000080)={0x0, 0xa284, 0x20, 0x0, 0x1c9, 0x0, r0}, &(0x7f0000833000/0x1000)=nil, &(0x7f0000b04000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r4, &(0x7f00000001c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x4, 0x0, 0x4, 0x1, &(0x7f0000000340)="2e7fe5c2d2eb8773aa049fa93bf5cccfdbead0200fda72c347367619f7e518a5e73e5c8d62ca5920ff7c85c80c684ed518364b2c8def4f04e6c87d2515d3f00809ef83dd56b669333f3c5740742860627b7f91bf3fb9451847e8b9200b3fba857d30e67b631cf4be9ce61595c3d75140e8a325ed9ba3335c64dcbc63c9b3a026e4e191a4c97eb2158540744c8d", 0x1, 0x0, 0x0, {0x1}}, 0x9) r5 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r5, 0x0, 0x0, 0x0) r6 = openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) perf_event_open$cgroup(&(0x7f0000000000)={0x5, 0x80, 0x7, 0x81, 0x1e, 0x6, 0x0, 0xfff, 0xa0005, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x5, 0x2, @perf_config_ext={0x6, 0x3}, 0x32, 0x0, 0x4, 0x4, 0x3, 0xe62a, 0x0, 0x0, 0x1, 0x0, 0x9}, r6, 0x6, r6, 0x7) 21:54:15 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x2000000) 21:54:15 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 65) 21:54:15 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) r2 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3000008, 0x8010, r0, 0x10000000) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) recvmsg(r3, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001980)={'vlan1\x00', 0x0}) syz_io_uring_submit(r1, r2, &(0x7f0000001a40)=@IORING_OP_CONNECT={0x10, 0x7, 0x0, r3, 0x80, &(0x7f00000019c0)=@ll={0x11, 0xc, r4, 0x1, 0x6, 0x6, @local}}, 0x101) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) [ 1778.105848] FAULT_INJECTION: forcing a failure. [ 1778.105848] name failslab, interval 1, probability 0, space 0, times 0 [ 1778.107317] CPU: 1 PID: 10617 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1778.108104] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1778.109062] Call Trace: [ 1778.109371] dump_stack+0x107/0x167 [ 1778.109797] should_fail.cold+0x5/0xa [ 1778.110235] ? create_object.isra.0+0x3a/0xa30 [ 1778.110756] should_failslab+0x5/0x20 [ 1778.111187] kmem_cache_alloc+0x5b/0x310 [ 1778.111656] create_object.isra.0+0x3a/0xa30 [ 1778.112154] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1778.112745] kmem_cache_alloc+0x159/0x310 [ 1778.113221] anon_vma_clone+0xdc/0x590 [ 1778.113668] __split_vma+0x17c/0x4e0 [ 1778.114092] __do_munmap+0x365/0x1260 [ 1778.114528] ? arch_get_unmapped_area+0x450/0x450 [ 1778.115077] ? lock_release+0x680/0x680 [ 1778.115533] mmap_region+0x7cc/0x1500 [ 1778.115973] do_mmap+0x868/0x1370 [ 1778.116374] vm_mmap_pgoff+0x198/0x1f0 [ 1778.116831] ? randomize_page+0xb0/0xb0 [ 1778.117291] ksys_mmap_pgoff+0x41c/0x560 [ 1778.117753] ? find_mergeable_anon_vma+0x250/0x250 [ 1778.118311] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1778.118916] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1778.119503] do_syscall_64+0x33/0x40 [ 1778.119928] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1778.120521] RIP: 0033:0x7f741addcb62 [ 1778.120949] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1778.123072] RSP: 002b:00007f74183520f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1778.123938] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f741addcb62 [ 1778.124752] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1778.125561] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1778.126390] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1778.126504] FAULT_INJECTION: forcing a failure. [ 1778.126504] name failslab, interval 1, probability 0, space 0, times 0 [ 1778.127200] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1778.132612] CPU: 0 PID: 10612 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1778.134568] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1778.136677] Call Trace: [ 1778.137366] dump_stack+0x107/0x167 [ 1778.138297] should_fail.cold+0x5/0xa [ 1778.139273] ? anon_vma_clone+0xdc/0x590 [ 1778.140305] should_failslab+0x5/0x20 [ 1778.141283] kmem_cache_alloc+0x5b/0x310 [ 1778.142321] anon_vma_clone+0xdc/0x590 [ 1778.143313] __split_vma+0x17c/0x4e0 [ 1778.144265] __do_munmap+0x365/0x1260 [ 1778.145237] ? arch_get_unmapped_area+0x450/0x450 [ 1778.146459] ? lock_release+0x680/0x680 [ 1778.147477] mmap_region+0x7cc/0x1500 [ 1778.148469] do_mmap+0x868/0x1370 [ 1778.149371] vm_mmap_pgoff+0x198/0x1f0 [ 1778.150375] ? randomize_page+0xb0/0xb0 [ 1778.151407] ksys_mmap_pgoff+0x41c/0x560 [ 1778.152435] ? find_mergeable_anon_vma+0x250/0x250 [ 1778.153666] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1778.154767] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1778.155858] do_syscall_64+0x33/0x40 [ 1778.156640] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1778.157734] RIP: 0033:0x7f43c90c3b62 [ 1778.158522] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1778.162425] RSP: 002b:00007f43c66390f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1778.164039] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f43c90c3b62 [ 1778.165557] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1778.167063] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1778.168576] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1778.170099] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:54:15 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_STATX={0x15, 0x3, 0x0, 0xffffffffffffff9c, &(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x4, 0x400, 0x1}, 0x634) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:54:15 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:54:15 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 64) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:54:15 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 21:54:15 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x16001, 0x18) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') writev(r3, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) ioctl$PERF_EVENT_IOC_ID(r3, 0x80082407, &(0x7f0000000000)) 21:54:15 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 65) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:54:15 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x3000000) 21:54:15 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYBLOB="eb9794313d42ca010000020000020000000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1778.216271] FAULT_INJECTION: forcing a failure. [ 1778.216271] name failslab, interval 1, probability 0, space 0, times 0 [ 1778.217657] CPU: 1 PID: 10630 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1778.218458] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1778.219411] Call Trace: [ 1778.219719] dump_stack+0x107/0x167 [ 1778.220142] should_fail.cold+0x5/0xa [ 1778.220583] ? vm_area_alloc+0x1c/0x110 [ 1778.221054] should_failslab+0x5/0x20 [ 1778.221493] kmem_cache_alloc+0x5b/0x310 [ 1778.221963] vm_area_alloc+0x1c/0x110 [ 1778.222401] mmap_region+0x982/0x1500 [ 1778.222846] do_mmap+0x868/0x1370 [ 1778.223256] vm_mmap_pgoff+0x198/0x1f0 [ 1778.223706] ? randomize_page+0xb0/0xb0 [ 1778.224168] ksys_mmap_pgoff+0x41c/0x560 [ 1778.224633] ? find_mergeable_anon_vma+0x250/0x250 [ 1778.225210] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1778.225815] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1778.226408] do_syscall_64+0x33/0x40 [ 1778.226840] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1778.227429] RIP: 0033:0x7f741addcb62 [ 1778.227860] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1778.229983] RSP: 002b:00007f74183520f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1778.230862] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f741addcb62 [ 1778.231679] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1778.232495] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1778.233324] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1778.234146] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:54:15 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 21:54:15 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x810, r0, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000000), 0x2, 0xb0400) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3, 0x10010, r1, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:54:15 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000040), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:54:15 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0xf0e, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) syz_io_uring_submit(r1, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:54:15 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 21:54:15 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) 21:54:29 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 66) 21:54:29 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={r0, 0xfffffffffffffffc, 0xa0, 0xe8a7}) perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) [ 1792.872360] FAULT_INJECTION: forcing a failure. [ 1792.872360] name failslab, interval 1, probability 0, space 0, times 0 [ 1792.875463] CPU: 0 PID: 10667 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1792.877241] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1792.879257] Call Trace: [ 1792.879934] dump_stack+0x107/0x167 [ 1792.880869] should_fail.cold+0x5/0xa [ 1792.881717] ? create_object.isra.0+0x3a/0xa30 [ 1792.882834] should_failslab+0x5/0x20 [ 1792.883656] kmem_cache_alloc+0x5b/0x310 [ 1792.884526] create_object.isra.0+0x3a/0xa30 [ 1792.885467] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1792.886552] kmem_cache_alloc+0x159/0x310 [ 1792.887449] vm_area_alloc+0x1c/0x110 [ 1792.888253] mmap_region+0x982/0x1500 [ 1792.889090] do_mmap+0x868/0x1370 [ 1792.889837] vm_mmap_pgoff+0x198/0x1f0 [ 1792.890674] ? randomize_page+0xb0/0xb0 [ 1792.891544] ksys_mmap_pgoff+0x41c/0x560 [ 1792.892383] ? find_mergeable_anon_vma+0x250/0x250 [ 1792.893440] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1792.894535] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1792.895635] do_syscall_64+0x33/0x40 [ 1792.896403] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1792.896481] FAULT_INJECTION: forcing a failure. [ 1792.896481] name failslab, interval 1, probability 0, space 0, times 0 [ 1792.897466] RIP: 0033:0x7f43c90c3b62 [ 1792.897483] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1792.897494] RSP: 002b:00007f43c66390f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1792.897514] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f43c90c3b62 [ 1792.897534] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1792.908932] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1792.910410] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1792.911920] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:54:29 executing program 0: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3865, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)=0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, r0, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r4 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8, 0x4000010, r3, 0x10000000) syz_io_uring_submit(r1, r4, &(0x7f00000001c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x2, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x0, 0x1}, 0xf5) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/fib_trie\x00') r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_CONNECT={0x10, 0x1, 0x0, 0xffffffffffffffff, 0x80, &(0x7f0000000340)=@un=@abs={0x0, 0x0, 0x8}, 0x0, 0x0, 0x1, {0x0, r6}}, 0x4) r7 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x200000a, 0x1010, 0xffffffffffffffff, 0x8000000) syz_io_uring_submit(r7, r2, &(0x7f0000000140)=@IORING_OP_RECVMSG={0xa, 0x2, 0x0, r3, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@l2tp={0x2, 0x0, @dev}, 0x80, &(0x7f00000000c0)}, 0x0, 0x40000002, 0x0, {0xfffe, r6}}, 0xe9) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) 21:54:29 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x4000000) 21:54:29 executing program 1: perf_event_open(&(0x7f0000000140)={0x3, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 21:54:29 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 66) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) 21:54:29 executing program 2: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)=0x0) syz_io_uring_setup(0x3eb0, &(0x7f0000000000)={0x0, 0x7689, 0x20, 0x3, 0xe7, 0x0, r0}, &(0x7f0000854000/0x2000)=nil, &(0x7f000054b000/0x3000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) r3 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r1, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r6, 0x0, 0x0}, 0x0) r7 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r3, 0x0) syz_io_uring_submit(r7, r5, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/fib_trie\x00') r8 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x5, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, {0x3}}, 0x4) syz_io_uring_submit(r2, r5, &(0x7f00000001c0)=@IORING_OP_STATX={0x15, 0x2, 0x0, 0xffffffffffffff9c, &(0x7f0000000340), &(0x7f0000000140)='./file0\x00', 0x20, 0x1000, 0x0, {0x0, r8}}, 0x80000000) r9 = mmap$IORING_OFF_SQES(&(0x7f00000ab000/0x3000)=nil, 0x3000, 0x100000a, 0x100010, r0, 0x10000000) syz_io_uring_submit(r2, r9, &(0x7f0000000100)=@IORING_OP_NOP={0x0, 0x4}, 0x5) openat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x80, 0x100) r10 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x1010, r0, 0x0) syz_io_uring_submit(r10, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 21:54:29 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1792.913449] CPU: 1 PID: 10674 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1792.915284] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1792.917029] Call Trace: [ 1792.917595] dump_stack+0x107/0x167 [ 1792.918370] should_fail.cold+0x5/0xa [ 1792.919182] ? create_object.isra.0+0x3a/0xa30 [ 1792.920142] should_failslab+0x5/0x20 [ 1792.920950] kmem_cache_alloc+0x5b/0x310 [ 1792.921804] create_object.isra.0+0x3a/0xa30 [ 1792.922727] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1792.923821] kmem_cache_alloc+0x159/0x310 [ 1792.924713] vm_area_alloc+0x1c/0x110 [ 1792.925525] mmap_region+0x982/0x1500 [ 1792.926356] do_mmap+0x868/0x1370 [ 1792.927099] vm_mmap_pgoff+0x198/0x1f0 [ 1792.927927] ? randomize_page+0xb0/0xb0 [ 1792.928778] ksys_mmap_pgoff+0x41c/0x560 [ 1792.929654] ? find_mergeable_anon_vma+0x250/0x250 [ 1792.930712] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1792.931826] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1792.932924] do_syscall_64+0x33/0x40 [ 1792.933712] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1792.934798] RIP: 0033:0x7f741addcb62 [ 1792.935586] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1792.939496] RSP: 002b:00007f74183520f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1792.941116] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f741addcb62 [ 1792.942631] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1792.944161] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1792.945681] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1792.947207] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:54:30 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x5000000) 21:54:30 executing program 1: perf_event_open(&(0x7f0000000140)={0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 21:54:30 executing program 7: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) (fail_nth: 67) 21:54:30 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x6000000) 21:54:30 executing program 1: perf_event_open(&(0x7f0000000140)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1793.139500] FAULT_INJECTION: forcing a failure. [ 1793.139500] name failslab, interval 1, probability 0, space 0, times 0 [ 1793.142104] CPU: 1 PID: 10693 Comm: syz-executor.7 Not tainted 5.10.262 #1 [ 1793.143614] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1793.145398] Call Trace: [ 1793.145973] dump_stack+0x107/0x167 [ 1793.146773] should_fail.cold+0x5/0xa [ 1793.147615] ? create_object.isra.0+0x3a/0xa30 [ 1793.148590] should_failslab+0x5/0x20 [ 1793.149409] kmem_cache_alloc+0x5b/0x310 [ 1793.150268] create_object.isra.0+0x3a/0xa30 21:54:30 executing program 6: perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f0000000000)={0x3, 0x80, 0x2, 0x2, 0x3, 0x3, 0x0, 0x100000000, 0x100, 0x9, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x8167, 0x0, @perf_config_ext={0xe13, 0xffff}, 0x80c1, 0xfa78, 0x1c, 0x3, 0x4, 0x7, 0x86, 0x0, 0x6, 0x0, 0xfffffffffffffffa}, r0, 0xf, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd, 0x0, 0x0}, 0x0) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r2, 0x0, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r3 = syz_io_uring_setup(0x132, &(0x7f0000000180)={0x0, 0x8274, 0x0, 0x0, 0x4}, &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r6, 0x0, 0x0}, 0x0) r7 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r3, 0x0) syz_io_uring_submit(r7, r5, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x8001) r8 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r8, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) syz_io_uring_submit(r2, r5, &(0x7f0000000140)=@IORING_OP_CLOSE={0x13, 0x3, 0x0, r8, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x5) r9 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') ioctl$BTRFS_IOC_SCRUB_CANCEL(r1, 0x941c, 0x0) writev(r9, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) perf_event_open(&(0x7f00000000c0)={0x4, 0x80, 0x9, 0xfb, 0x7f, 0x6, 0x0, 0x0, 0xa220, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x3f, 0x4, @perf_bp={&(0x7f0000000340), 0x4}, 0x44892, 0x2000000000, 0x77, 0xd, 0x7, 0x400, 0x400, 0x0, 0xffffff67, 0x0, 0x7ff}, 0x0, 0x8, r9, 0x3) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x100000e, 0x13, r1, 0x0) [ 1793.151205] ? __kasan_kmalloc.constprop.0+0xc9/0xd0 [ 1793.152650] kmem_cache_alloc+0x159/0x310 [ 1793.153560] vm_area_alloc+0x1c/0x110 [ 1793.154381] mmap_region+0x982/0x1500 [ 1793.155211] do_mmap+0x868/0x1370 [ 1793.155956] vm_mmap_pgoff+0x198/0x1f0 [ 1793.156786] ? randomize_page+0xb0/0xb0 [ 1793.157643] ksys_mmap_pgoff+0x41c/0x560 [ 1793.158498] ? find_mergeable_anon_vma+0x250/0x250 [ 1793.159554] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1793.160660] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1793.161771] do_syscall_64+0x33/0x40 21:54:30 executing program 5: perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4317, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$IPC_RMID(0x0, 0x0, 0xb) syz_io_uring_setup(0x3862, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000180)) (fail_nth: 67) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_io_uring_submit(r0, 0x0, 0x0, 0x0) [ 1793.162568] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1793.163842] RIP: 0033:0x7f43c90c3b62 [ 1793.164632] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1793.168570] RSP: 002b:00007f43c66390f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1793.170199] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f43c90c3b62 [ 1793.171725] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1793.173264] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1793.174782] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1793.176290] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:54:30 executing program 2: r0 = perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3862, &(0x7f00000002c0), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000180)) r2 = signalfd(r0, &(0x7f0000000000)={[0x7]}, 0x8) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='attr/prev\x00') writev(r3, &(0x7f0000000100)=[{&(0x7f0000000c80)="d0", 0x1}], 0x1) perf_event_open$cgroup(&(0x7f0000000340)={0x4, 0x80, 0x89, 0x8, 0xe1, 0x0, 0x0, 0x401, 0x4000, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, @perf_bp={&(0x7f0000000080), 0x1}, 0x1000, 0x5, 0x2, 0x8, 0x1000, 0x3, 0xff7a, 0x0, 0x2, 0x0, 0x81}, r3, 0x2, r2, 0xc) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r1, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000240)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0}) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r5, 0x8008f513, &(0x7f0000000040)) syz_io_uring_submit(r4, 0x0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) 21:54:30 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') write(r0, 0x0, 0x7ffffffff000) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYBLOB="00b46784b9badd08bd7000fedbdf25060000000800030002000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x0, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000540)={0xa, 0x0, 0x8, @dev={0xfe, 0x80, '\x00', 0x3e}, 0x2}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'sit0\x00', 0x0}) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@empty, r2}, 0x14) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4ea0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000014c0)=ANY=[@ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/igmp\x00') readv(r3, &(0x7f0000000280)=[{&(0x7f00000004c0)=""/4089, 0xff9}], 0x1) openat$cgroup_freezer_state(r3, &(0x7f0000000080), 0x2, 0x0) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/114, 0x72}, {&(0x7f0000000380)=""/200, 0xc8}, {&(0x7f0000000480)=""/80, 0x50}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x10102) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) syz_io_uring_setup(0x591e, &(0x7f0000000000)={0x0, 0x0, 0x22}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) dup(r4) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x102, 0x4) perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x5, 0x1, 0x80, 0xfffffffc, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg$inet6(r1, &(0x7f0000004d00), 0x2f, 0x0) [ 1793.231651] FAULT_INJECTION: forcing a failure. [ 1793.231651] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1793.234376] CPU: 0 PID: 10702 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1793.235799] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1793.237552] Call Trace: [ 1793.238132] dump_stack+0x107/0x167 [ 1793.238907] should_fail.cold+0x5/0xa [ 1793.239732] __alloc_pages_nodemask+0x182/0x600 [ 1793.240719] ? __alloc_pages_slowpath.constprop.0+0x2320/0x2320 [ 1793.242015] ? walk_mem_res+0x170/0x170 [ 1793.242873] alloc_pages_current+0x187/0x280 [ 1793.243817] pte_alloc_one+0x16/0x1a0 [ 1793.244605] __pte_alloc+0x1d/0x330 [ 1793.245396] remap_pfn_range_internal+0x9a3/0xf60 [ 1793.246418] ? lookup_memtype+0x5b/0x200 [ 1793.247267] ? apply_to_existing_page_range+0x40/0x40 [ 1793.248375] remap_pfn_range+0xcd/0x160 [ 1793.249220] ? remap_pfn_range_notrack+0x70/0x70 [ 1793.250196] ? memcg_slab_post_alloc_hook+0x17a/0x430 [ 1793.251266] io_uring_mmap+0x398/0x530 [ 1793.252066] mmap_file+0x5e/0xe0 [ 1793.252779] mmap_region+0xc4d/0x1500 [ 1793.253610] do_mmap+0x868/0x1370 [ 1793.254335] vm_mmap_pgoff+0x198/0x1f0 [ 1793.255135] ? randomize_page+0xb0/0xb0 [ 1793.255971] ksys_mmap_pgoff+0x41c/0x560 [ 1793.256827] ? find_mergeable_anon_vma+0x250/0x250 [ 1793.257851] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1793.258918] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1793.259976] do_syscall_64+0x33/0x40 [ 1793.260733] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1793.261776] RIP: 0033:0x7f741addcb62 [ 1793.262533] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1793.266386] RSP: 002b:00007f74183520f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1793.267937] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f741addcb62 [ 1793.269395] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1793.270848] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1793.272303] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1793.273821] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 21:54:30 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) dup2(r1, r0) r2 = syz_io_uring_setup(0x132, &(0x7f0000000180), &(0x7f00000a0000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000140)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x100000e, 0x13, r2, 0x7000000) [ 1793.297181] ------------[ cut here ]------------ [ 1793.298409] WARNING: CPU: 1 PID: 10702 at arch/x86/mm/pat/memtype.c:1019 get_pat_info+0x216/0x270 [ 1793.300786] Modules linked in: [ 1793.301609] CPU: 1 PID: 10702 Comm: syz-executor.5 Not tainted 5.10.262 #1 [ 1793.303174] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1793.305006] RIP: 0010:get_pat_info+0x216/0x270 [ 1793.306156] Code: c1 ea 03 80 3c 02 00 75 71 49 89 1e eb 8e e8 61 8f 2e 00 0f 0b e9 97 fe ff ff 41 bc ea ff ff ff e9 77 ff ff ff e8 4a 8f 2e 00 <0f> 0b 41 bc ea ff ff ff e9 65 ff ff ff 4c 89 ff e8 15 b2 5a 00 e9 [ 1793.315796] RSP: 0018:ffff8880462bf890 EFLAGS: 00010216 [ 1793.317130] RAX: 0000000000013923 RBX: ffff888017fc3800 RCX: ffffc90003801000 [ 1793.318795] RDX: 0000000000040000 RSI: ffffffff811255f6 RDI: 0000000000000007 [ 1793.320426] RBP: ffff8880462bf948 R08: 0000000000000000 R09: ffff8880462bf818 [ 1793.322037] R10: 0000000000000020 R11: 0000000000000001 R12: 0000000000000028 [ 1793.323655] R13: 1ffff11008c57f12 R14: 0000000000000000 R15: ffff888017fc3850 [ 1793.325271] FS: 00007f7418352700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 [ 1793.327074] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1793.328413] CR2: 00007feae350c2f0 CR3: 0000000047834000 CR4: 0000000000350ee0 [ 1793.330037] Call Trace: [ 1793.330690] ? pgprot_writethrough+0xc0/0xc0 [ 1793.331668] ? finish_task_switch+0x1a4/0x5d0 [ 1793.332865] untrack_pfn+0xdc/0x240 [ 1793.333759] ? track_pfn_insert+0x150/0x150 [ 1793.334854] ? lock_downgrade+0x6d0/0x6d0 [ 1793.335921] ? uprobe_munmap+0x1c/0x670 [ 1793.337012] unmap_single_vma+0x1bc/0x300 [ 1793.338109] zap_page_range_single+0x2ce/0x450 [ 1793.339203] ? unmap_single_vma+0x300/0x300 [ 1793.340295] ? remap_pfn_range_internal+0xc56/0xf60 [ 1793.341601] ? lookup_memtype+0x5b/0x200 [ 1793.342646] ? apply_to_existing_page_range+0x40/0x40 [ 1793.343925] remap_pfn_range+0x139/0x160 [ 1793.344994] ? remap_pfn_range_notrack+0x70/0x70 [ 1793.346229] ? memcg_slab_post_alloc_hook+0x17a/0x430 [ 1793.347501] io_uring_mmap+0x398/0x530 [ 1793.348507] mmap_file+0x5e/0xe0 [ 1793.349407] mmap_region+0xc4d/0x1500 [ 1793.350405] do_mmap+0x868/0x1370 [ 1793.351320] vm_mmap_pgoff+0x198/0x1f0 [ 1793.352316] ? randomize_page+0xb0/0xb0 [ 1793.353345] ksys_mmap_pgoff+0x41c/0x560 [ 1793.354385] ? find_mergeable_anon_vma+0x250/0x250 [ 1793.355596] ? lockdep_hardirqs_on_prepare+0x277/0x3e0 [ 1793.356779] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1793.358139] do_syscall_64+0x33/0x40 [ 1793.358932] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ 1793.360135] RIP: 0033:0x7f741addcb62 [ 1793.361050] Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 bc ff ff ff 64 [ 1793.365049] RSP: 002b:00007f74183520f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 1793.366838] RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007f741addcb62 [ 1793.368486] RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffd000 [ 1793.370101] RBP: 0000000020ffd000 R08: 0000000000000005 R09: 0000000000000000 [ 1793.371694] R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000180 [ 1793.373294] R13: 0000000020ffc000 R14: 0000000020000200 R15: 0000000020ffd000 [ 1793.375105] irq event stamp: 1957 [ 1793.375868] hardirqs last enabled at (1965): [] console_unlock+0x92d/0xb40 [ 1793.378131] hardirqs last disabled at (1984): [] sysvec_apic_timer_interrupt+0xb/0xa0 [ 1793.380251] softirqs last enabled at (836): [] asm_call_irq_on_stack+0x12/0x20 [ 1793.382271] softirqs last disabled at (703): [] asm_call_irq_on_stack+0x12/0x20 [ 1793.384268] ---[ end trace 15381daab6fda2e4 ]--- VM DIAGNOSIS: 21:54:30 Registers: info registers vcpu 0 RAX=ffff888044d26010 RBX=ffff88800e373800 RCX=0000000000000001 RDX=1ffff110089a4c03 RSI=ffff88806ce3b3b0 RDI=ffff888044d26018 RBP=ffff88806ce3b380 RSP=ffff88803ec1fad0 R8 =ffff88806ce3b380 R9 =ffff88800e373950 R10=ffffed1002efd068 R11=0000000000000001 R12=ffffffff8567dcbc R13=ffff88800e373810 R14=ffff88806ce3b4f0 R15=ffff88806ce3b3b8 RIP=ffffffff81219c12 RFL=00000082 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 000055558415d400 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000001b2bc21000 CR3=000000003ec5e000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=ffffffffffffffffffffffffffffffff XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=0000000000000000000000524f525245 XMM07=00000000000000000000000000000000 XMM08=000000000000000000524f5252450040 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000031 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff822ea771 RDI=ffffffff879fc240 RBP=ffffffff879fc200 RSP=ffff8880462bf228 R8 =0000000000000001 R9 =0000000000000003 R10=0000000000000000 R11=0000000000000001 R12=0000000000000031 R13=0000000000000031 R14=ffffffff879fc200 R15=dffffc0000000000 RIP=ffffffff822ea7c8 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f7418352700 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007feae350c2f0 CR3=0000000047834000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=ffffffffffffffffffffffffffffffff XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=0000000000000000000000524f525245 XMM07=00000000000000000000000000000000 XMM08=000000000000000000524f5252450040 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000