program: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}}, 0x0) (async) syz_emit_ethernet(0x32, &(0x7f0000000000)={@link_local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @private, @multicast1}, {0x4e24, 0x17c1, 0x10, 0x0, @gue={{0x2, 0x0, 0x3, 0xfc}}}}}}}, 0x0) (async) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000010401f0a08b2ba2386377f6c45e00000000000400000002"], 0x1c}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x20, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_MODE={0xa, 0x2, {0xffff, 0x1}}]}, 0x20}}, 0x0) (async) open(&(0x7f00000002c0)='./file0\x00', 0x80ff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./proc\x00', 0x180) (async, rerun: 64) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) (async, rerun: 64) fanotify_mark(0xffffffffffffffff, 0x20, 0x8000000, 0xffffffffffffffff, 0x0) (async, rerun: 64) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2002, 0x0) (async, rerun: 64) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="540000000206010200000000000000000500000005000100060000000d000300686173683a6e6574000000000900020073797a31000000000c00078008000640000000400500050002000000050004"], 0x54}}, 0x0) sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)={0x24, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {{}, {}, {0x8, 0x11, 0x4}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x8842}, 0x24000041) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r4, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r4, 0xc03064ca, &(0x7f0000000280)={&(0x7f0000000040)=[r5], 0x0, 0x1000000000000000, 0x1}) (async) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007800c009454b3ab0872c3018008000140ffffffff0c00028008"], 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) r6 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r6, 0x7a7, &(0x7f00000000c0)=0xb0000) write(r1, &(0x7f0000000000)='7', 0x1) (async) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010408000000000000000200000a0900010073797a300000000040000000030a010400000000000000000200000a0900010073797a30000000000900030073797a3000000000140004800800014000000003080002400000000048000000060a010400000000000000000200000a0900010073797a30000000000900020073797a30000000001c00048018000180080001006c6f67000c0002800600014000000000140000001100010000000000000000000200000a"], 0xd0}}, 0x0) (async) r7 = socket$inet_udp(0x2, 0x2, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELCHAIN={0x54, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_COUNTERS={0x34, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x100}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xffffffffffffcade}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x80000000}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x7c}, 0x1, 0x0, 0x0, 0x28000095}, 0x24000800) (async) sendto$inet(r7, &(0x7f0000000600)="00112233445566778899", 0xa, 0x0, &(0x7f0000000700)={0x2, 0x1234, @loopback}, 0x10) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) [ 385.688563][ T5329] Bluetooth: hci0: command tx timeout [ 385.782680][ T5373] netlink: 8 bytes leftover after parsing attributes in process `syz.0.0'. [ 385.863222][ T5372] ------------[ cut here ]------------ [ 385.863234][ T5372] 1 [ 385.863239][ T5372] WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x425/0x5a0, CPU#0: syz.0.0/5372 [ 385.871806][ T5372] Modules linked in: [ 385.874125][ T5372] CPU: 0 UID: 0 PID: 5372 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 385.877836][ T5372] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 385.881912][ T5372] RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0 [ 385.884853][ T5372] Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 6c a0 38 0e 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d 7c 12 54 0e 67 48 0f b9 3a e9 68 [ 385.893073][ T5372] RSP: 0018:ffffc9000db27880 EFLAGS: 00010246 [ 385.895787][ T5372] RAX: ffffc9000db27800 RBX: 1ffff92001b64f14 RCX: 0000000000000000 [ 385.899483][ T5372] RDX: 0000000000000000 RSI: 0000000000000014 RDI: ffffc9000db278e8 [ 385.902806][ T5372] RBP: ffffc9000db27978 R08: ffffc9000db278e7 R09: 0000000000000000 [ 385.906369][ T5372] R10: ffffc9000db278c0 R11: fffff52001b64f1d R12: 0000000000000000 [ 385.909835][ T5372] R13: 0000000000000000 R14: 0000000000040cc0 R15: 0000000000000000 [ 385.913404][ T5372] FS: 00007fa1839eb6c0(0000) GS:ffff88808c2c0000(0000) knlGS:0000000000000000 [ 385.917553][ T5372] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 385.920312][ T5372] CR2: 0000000000000000 CR3: 0000000043eb0000 CR4: 0000000000352ef0 [ 385.923686][ T5372] Call Trace: [ 385.925566][ T5372] [ 385.926915][ T5372] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 385.929693][ T5372] ? __pfx_policy_nodemask+0x10/0x10 [ 385.931623][ T5372] ? kasan_save_track+0x4f/0x80 [ 385.933698][ T5372] ? kasan_save_track+0x3e/0x80 [ 385.935881][ T5372] ? kasan_save_free_info+0x40/0x50 [ 385.938329][ T5372] ? __kasan_slab_free+0x5c/0x80 [ 385.940401][ T5372] ? kfree+0x1c5/0x650 [ 385.942214][ T5372] alloc_pages_mpol+0x21e/0x390 [ 385.944310][ T5372] ? drm_syncobj_array_find+0x3a/0x440 [ 385.946799][ T5372] ___kmalloc_large_node+0x4f/0x120 [ 385.949042][ T5372] __kmalloc_large_node_noprof+0x18/0x90 [ 385.951551][ T5372] __kmalloc_noprof+0x3fb/0x720 [ 385.953668][ T5372] ? drm_syncobj_array_find+0x3a/0x440 [ 385.956037][ T5372] drm_syncobj_array_find+0x3a/0x440 [ 385.958297][ T5372] drm_syncobj_timeline_wait_ioctl+0x199/0x690 [ 385.960844][ T5372] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 385.963780][ T5372] drm_ioctl_kernel+0x2df/0x3b0 [ 385.965944][ T5372] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 385.968630][ T5372] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 385.970884][ T5372] drm_ioctl+0x70e/0xba0 [ 385.972717][ T5372] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 385.975607][ T5372] ? __pfx_drm_ioctl+0x10/0x10 [ 385.978017][ T5372] ? __fget_files+0x2a/0x420 [ 385.979924][ T5372] ? bpf_lsm_file_ioctl+0x9/0x20 [ 385.982029][ T5372] ? __pfx_drm_ioctl+0x10/0x10 [ 385.984092][ T5372] __se_sys_ioctl+0xfc/0x170 [ 385.986447][ T5372] do_syscall_64+0x166/0x520 [ 385.990181][ T5372] ? trace_irq_disable+0x3b/0x140 [ 385.992454][ T5372] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 385.995123][ T5372] ? clear_bhb_loop+0x70/0xc0 [ 385.997083][ T5372] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 385.999542][ T5372] RIP: 0033:0x7fa182b9e159 [ 386.001475][ T5372] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 386.009913][ T5372] RSP: 002b:00007fa1839eafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 386.013480][ T5372] RAX: ffffffffffffffda RBX: 00007fa182e25fa0 RCX: 00007fa182b9e159 [ 386.017042][ T5372] RDX: 0000200000000280 RSI: 00000000c03064ca RDI: 00000000000000a6 [ 386.020890][ T5372] RBP: 00007fa182c3506b R08: 0000000000000000 R09: 0000000000000000 [ 386.024024][ T5372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 386.027527][ T5372] R13: 00007fa182e26038 R14: 00007fa182e25fa0 R15: 00007ffcced246e8 [ 386.030794][ T5372] [ 386.032123][ T5372] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 386.035241][ T5372] CPU: 0 UID: 0 PID: 5372 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 386.039100][ T5372] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 386.043429][ T5372] Call Trace: [ 386.044848][ T5372] [ 386.046097][ T5372] vpanic+0x56d/0xa60 [ 386.047971][ T5372] ? __pfx__printk+0x10/0x10 [ 386.049902][ T5372] ? __pfx_vpanic+0x10/0x10 [ 386.051840][ T5372] ? is_bpf_text_address+0x292/0x2b0 [ 386.054118][ T5372] ? is_bpf_text_address+0x26/0x2b0 [ 386.056335][ T5372] panic+0xc5/0xd0 [ 386.058020][ T5372] ? __pfx_panic+0x10/0x10 [ 386.059973][ T5372] __warn+0x315/0x4c0 [ 386.061763][ T5372] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 386.064385][ T5372] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 386.067021][ T5372] __report_bug+0x276/0x570 [ 386.068957][ T5372] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 386.071464][ T5372] ? __pfx___report_bug+0x10/0x10 [ 386.073730][ T5372] ? lock_acquire+0x115/0x350 [ 386.076120][ T5372] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 386.079248][ T5372] report_bug+0x16b/0x220 [ 386.081633][ T5372] ? __alloc_frozen_pages_noprof+0x425/0x5a0 [ 386.084835][ T5372] ? __alloc_frozen_pages_noprof+0x427/0x5a0 [ 386.087630][ T5372] handle_bug+0x9c/0x200 [ 386.089433][ T5372] exc_invalid_op+0x1a/0x50 [ 386.091334][ T5372] asm_exc_invalid_op+0x1a/0x20 [ 386.093344][ T5372] RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0 [ 386.096347][ T5372] Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 6c a0 38 0e 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d 7c 12 54 0e 67 48 0f b9 3a e9 68 [ 386.104867][ T5372] RSP: 0018:ffffc9000db27880 EFLAGS: 00010246 [ 386.107555][ T5372] RAX: ffffc9000db27800 RBX: 1ffff92001b64f14 RCX: 0000000000000000 [ 386.110786][ T5372] RDX: 0000000000000000 RSI: 0000000000000014 RDI: ffffc9000db278e8 [ 386.114072][ T5372] RBP: ffffc9000db27978 R08: ffffc9000db278e7 R09: 0000000000000000 [ 386.117350][ T5372] R10: ffffc9000db278c0 R11: fffff52001b64f1d R12: 0000000000000000 [ 386.120763][ T5372] R13: 0000000000000000 R14: 0000000000040cc0 R15: 0000000000000000 [ 386.124247][ T5372] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 386.127033][ T5372] ? __pfx_policy_nodemask+0x10/0x10 [ 386.129342][ T5372] ? kasan_save_track+0x4f/0x80 [ 386.131462][ T5372] ? kasan_save_track+0x3e/0x80 [ 386.133584][ T5372] ? kasan_save_free_info+0x40/0x50 [ 386.135777][ T5372] ? __kasan_slab_free+0x5c/0x80 [ 386.137890][ T5372] ? kfree+0x1c5/0x650 [ 386.139602][ T5372] alloc_pages_mpol+0x21e/0x390 [ 386.141735][ T5372] ? drm_syncobj_array_find+0x3a/0x440 [ 386.144249][ T5372] ___kmalloc_large_node+0x4f/0x120 [ 386.146468][ T5372] __kmalloc_large_node_noprof+0x18/0x90 [ 386.148993][ T5372] __kmalloc_noprof+0x3fb/0x720 [ 386.151164][ T5372] ? drm_syncobj_array_find+0x3a/0x440 [ 386.153500][ T5372] drm_syncobj_array_find+0x3a/0x440 [ 386.155652][ T5372] drm_syncobj_timeline_wait_ioctl+0x199/0x690 [ 386.158206][ T5372] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 386.160905][ T5372] drm_ioctl_kernel+0x2df/0x3b0 [ 386.162983][ T5372] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 386.165837][ T5372] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 386.168089][ T5372] drm_ioctl+0x70e/0xba0 [ 386.169824][ T5372] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 386.172705][ T5372] ? __pfx_drm_ioctl+0x10/0x10 [ 386.174849][ T5372] ? __fget_files+0x2a/0x420 [ 386.176868][ T5372] ? bpf_lsm_file_ioctl+0x9/0x20 [ 386.179019][ T5372] ? __pfx_drm_ioctl+0x10/0x10 [ 386.181063][ T5372] __se_sys_ioctl+0xfc/0x170 [ 386.183100][ T5372] do_syscall_64+0x166/0x520 [ 386.185011][ T5372] ? trace_irq_disable+0x3b/0x140 [ 386.187172][ T5372] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 386.189763][ T5372] ? clear_bhb_loop+0x70/0xc0 [ 386.191810][ T5372] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 386.194395][ T5372] RIP: 0033:0x7fa182b9e159 [ 386.196315][ T5372] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 386.204550][ T5372] RSP: 002b:00007fa1839eafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 386.208050][ T5372] RAX: ffffffffffffffda RBX: 00007fa182e25fa0 RCX: 00007fa182b9e159 [ 386.211340][ T5372] RDX: 0000200000000280 RSI: 00000000c03064ca RDI: 00000000000000a6 [ 386.214723][ T5372] RBP: 00007fa182c3506b R08: 0000000000000000 R09: 0000000000000000 [ 386.218196][ T5372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 386.221401][ T5372] R13: 00007fa182e26038 R14: 00007fa182e25fa0 R15: 00007ffcced246e8 [ 386.224668][ T5372] [ 386.226427][ T5372] Kernel Offset: disabled [ 386.228361][ T5372] Rebooting in 86400 seconds..