program: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x10) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000001480)="2eec116d8cb4d8eb000786c758837b78288493633f6f666b", 0x18}], 0x1, &(0x7f0000000340)=[@assoc={0x18, 0x117, 0x4, 0x8}], 0x18}, 0x0) io_setup(0x20000000001005, &(0x7f0000000880)=0x0) io_submit(r2, 0x1, &(0x7f0000000580)=[&(0x7f00000000c0)={0x5000000, 0x0, 0xd, 0x0, 0x0, r1, &(0x7f0000000080)='[', 0x1}]) [ 84.881017][ T45] Bluetooth: hci0: command tx timeout [ 84.964315][ T5319] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI [ 84.969611][ T5319] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 84.973618][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 84.979330][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 84.984624][ T5319] RIP: 0010:memcpy_sglist+0x420/0x730 [ 84.987152][ T5319] Code: e8 b5 2a 51 fd f6 c3 01 0f 85 0a 01 00 00 e8 c7 25 51 fd 4c 89 f3 eb 07 e8 bd 25 51 fd 31 db 4c 8d 7b 08 4c 89 f8 48 c1 e8 03 <0f> b6 04 28 84 c0 0f 85 1d 02 00 00 41 8b 07 89 44 24 04 49 8d 7d [ 84.996685][ T5319] RSP: 0018:ffffc9000ef7f6d8 EFLAGS: 00010202 [ 85.000079][ T5319] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000100000 [ 85.003882][ T5319] RDX: ffffc9000f681000 RSI: 000000000000068e RDI: 000000000000068f [ 85.007293][ T5319] RBP: dffffc0000000000 R08: ffff888050ac7080 R09: 1ffff1100a158e10 [ 85.011010][ T5319] R10: dffffc0000000000 R11: ffffed100a158e11 R12: 0000000000000007 [ 85.015265][ T5319] R13: ffff888038527180 R14: ffff88801f0c8020 R15: 0000000000000008 [ 85.019245][ T5319] FS: 00007f55b4b7f6c0(0000) GS:ffff88808ca4c000(0000) knlGS:0000000000000000 [ 85.023422][ T5319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.026445][ T5319] CR2: 00007f55b0194000 CR3: 0000000038a50000 CR4: 0000000000352ef0 [ 85.030011][ T5319] Call Trace: [ 85.031542][ T5319] [ 85.032744][ T5319] aead_recvmsg+0x719/0x1030 [ 85.034450][ T5319] ? __pfx_aead_recvmsg+0x10/0x10 [ 85.036997][ T5319] ? aa_sock_msg_perm+0xf1/0x1b0 [ 85.039293][ T5319] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 85.041389][ T5319] ? security_socket_recvmsg+0x7e/0x2c0 [ 85.043863][ T5319] ? __pfx_aead_recvmsg+0x10/0x10 [ 85.046095][ T5319] sock_recvmsg+0x172/0x1b0 [ 85.048217][ T5319] sock_read_iter+0x251/0x320 [ 85.050564][ T5319] ? __pfx_sock_read_iter+0x10/0x10 [ 85.053724][ T5319] ? bpf_lsm_file_permission+0x9/0x20 [ 85.056672][ T5319] ? security_file_permission+0x75/0x260 [ 85.059766][ T5319] ? rw_verify_area+0x2a6/0x4d0 [ 85.061971][ T5319] ? import_ubuf+0xfb/0x1d0 [ 85.063811][ T5319] aio_read+0x33a/0x4d0 [ 85.065626][ T5319] ? __pfx_aio_read+0x10/0x10 [ 85.067711][ T5319] io_submit_one+0x79d/0x14c0 [ 85.070053][ T5319] ? irqentry_exit+0x59e/0x620 [ 85.072749][ T5319] ? trace_irq_disable+0x3b/0x150 [ 85.075107][ T5319] ? __pfx_io_submit_one+0x10/0x10 [ 85.077279][ T5319] ? __might_fault+0xaf/0x130 [ 85.079328][ T5319] __se_sys_io_submit+0x195/0x340 [ 85.081560][ T5319] ? __pfx___se_sys_io_submit+0x10/0x10 [ 85.084269][ T5319] do_syscall_64+0x14d/0xf80 [ 85.086812][ T5319] ? trace_irq_disable+0x3b/0x150 [ 85.089575][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.092399][ T5319] ? clear_bhb_loop+0x40/0x90 [ 85.094477][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.097191][ T5319] RIP: 0033:0x7f55b3d9c819 [ 85.099756][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.110119][ T5319] RSP: 002b:00007f55b4b7efe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 85.114030][ T5319] RAX: ffffffffffffffda RBX: 00007f55b4015fa0 RCX: 00007f55b3d9c819 [ 85.118094][ T5319] RDX: 0000200000000580 RSI: 0000000000000001 RDI: 00007f55b0194000 [ 85.122171][ T5319] RBP: 00007f55b3e32c91 R08: 0000000000000000 R09: 0000000000000000 [ 85.125695][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.129747][ T5319] R13: 00007f55b4016038 R14: 00007f55b4015fa0 R15: 00007ffd2c24eb58 [ 85.133434][ T5319] [ 85.134939][ T5319] Modules linked in: [ 85.137414][ T5319] ---[ end trace 0000000000000000 ]--- [ 85.166800][ T5319] RIP: 0010:memcpy_sglist+0x420/0x730 [ 85.169399][ T5319] Code: e8 b5 2a 51 fd f6 c3 01 0f 85 0a 01 00 00 e8 c7 25 51 fd 4c 89 f3 eb 07 e8 bd 25 51 fd 31 db 4c 8d 7b 08 4c 89 f8 48 c1 e8 03 <0f> b6 04 28 84 c0 0f 85 1d 02 00 00 41 8b 07 89 44 24 04 49 8d 7d [ 85.179338][ T5319] RSP: 0018:ffffc9000ef7f6d8 EFLAGS: 00010202 [ 85.182809][ T5319] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000100000 [ 85.187600][ T5319] RDX: ffffc9000f681000 RSI: 000000000000068e RDI: 000000000000068f [ 85.191529][ T5319] RBP: dffffc0000000000 R08: ffff888050ac7080 R09: 1ffff1100a158e10 [ 85.196150][ T5319] R10: dffffc0000000000 R11: ffffed100a158e11 R12: 0000000000000007 [ 85.200343][ T5319] R13: ffff888038527180 R14: ffff88801f0c8020 R15: 0000000000000008 [ 85.204263][ T5319] FS: 00007f55b4b7f6c0(0000) GS:ffff88808ca4c000(0000) knlGS:0000000000000000 [ 85.209217][ T5319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.212734][ T5319] CR2: 00007f55b3fed6b8 CR3: 0000000038a50000 CR4: 0000000000352ef0 [ 85.217137][ T5319] Kernel panic - not syncing: Fatal exception [ 85.220114][ T5319] Kernel Offset: disabled [ 85.222087][ T5319] Rebooting in 86400 seconds..