program: socket$nl_sock_diag(0x10, 0x3, 0x4) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r1) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000000)=0x1, 0x4) sendmmsg$inet(r0, &(0x7f0000001cc0)=[{{&(0x7f0000000300)={0x2, 0x4e23, @empty}, 0x10, &(0x7f0000001fc0)=[{&(0x7f0000004100)="89", 0x1}], 0x1}}], 0x1001, 0x2400c040) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000000c0)={'wpan4\x00', 0x0}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000380)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_DEV(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)={0x2c, r6, 0x1, 0xfffffffe, 0x0, {}, [@NL802154_ATTR_SEC_DEVICE={0x10, 0x2e, 0x0, 0x1, {0xb}}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008851}, 0x0) sendmsg$NL802154_CMD_GET_SEC_KEY(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x48, r3, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x0) [ 85.004831][ T5288] Bluetooth: hci0: command tx timeout [ 85.127602][ T5323] netlink: 12 bytes leftover after parsing attributes in process `syz.0.0'. [ 85.238459][ T5323] ------------[ cut here ]------------ [ 85.241515][ T5323] !sock_allow_reclassification(sk) [ 85.241534][ T5323] WARNING: drivers/block/nbd.c:1249 at nbd_add_socket+0xf35/0x12c0, CPU#0: syz.0.0/5323 [ 85.273002][ T5323] Modules linked in: [ 85.275565][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.284292][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.291595][ T5323] RIP: 0010:nbd_add_socket+0xf35/0x12c0 [ 85.295628][ T5323] Code: f7 e8 2f 54 1d fc bf e0 01 00 00 49 03 3e 48 c7 c6 a0 6c 55 8c e8 9b 33 14 fb b8 f0 ff ff ff e9 b2 fd ff ff e8 ec 3b ae fb 90 <0f> 0b 90 e9 16 f8 ff ff e8 ce 4a 98 05 44 89 e9 80 e1 07 fe c1 38 [ 85.334626][ T5323] RSP: 0018:ffffc900078a7140 EFLAGS: 00010283 [ 85.342516][ T5323] RAX: ffffffff86180914 RBX: 1ffff11007d5b039 RCX: 0000000000100000 [ 85.351660][ T5323] RDX: ffffc90020001000 RSI: 000000000000060f RDI: 0000000000000610 [ 85.372902][ T5323] RBP: ffffc900078a7230 R08: ffff88803fbb031f R09: 1ffff11007f76063 [ 85.387530][ T5323] R10: dffffc0000000000 R11: ffffed1007f76064 R12: ffff88803ead8000 [ 85.400849][ T5323] R13: 1ffff92000f14e34 R14: dffffc0000000000 R15: 0000000000000001 [ 85.419638][ T5323] FS: 00007fd8ac82e6c0(0000) GS:ffff88808c848000(0000) knlGS:0000000000000000 [ 85.431546][ T5323] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.443665][ T5323] CR2: 00007fd8ac7eaf68 CR3: 0000000043fea000 CR4: 0000000000352ef0 [ 85.455779][ T5323] Call Trace: [ 85.458136][ T5323] [ 85.465255][ T5323] ? __pfx_nbd_add_socket+0x10/0x10 [ 85.467837][ T5323] ? __nla_parse+0x40/0x60 [ 85.476316][ T5323] nbd_genl_connect+0x133d/0x1c10 [ 85.481054][ T5323] ? __pfx_nbd_genl_connect+0x10/0x10 [ 85.492510][ T5323] ? rcu_is_watching+0x15/0xb0 [ 85.503691][ T5323] ? trace_kmalloc+0x2a/0xf0 [ 85.513277][ T5323] ? __nla_parse+0x40/0x60 [ 85.519865][ T5323] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 85.531032][ T5323] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 85.534782][ T5323] genl_family_rcv_msg_doit+0x233/0x340 [ 85.537936][ T5323] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 85.540835][ T5323] ? __pfx_stack_trace_save+0x10/0x10 [ 85.543815][ T5323] genl_rcv_msg+0x614/0x7a0 [ 85.559899][ T5323] ? __pfx_genl_rcv_msg+0x10/0x10 [ 85.562575][ T5323] ? __pfx_nbd_genl_connect+0x10/0x10 [ 85.573995][ T5323] ? __netlink_lookup+0xc6/0x8b0 [ 85.576699][ T5323] ? rcu_is_watching+0x15/0xb0 [ 85.579229][ T5323] netlink_rcv_skb+0x226/0x4a0 [ 85.581798][ T5323] ? __pfx_genl_rcv_msg+0x10/0x10 [ 85.585536][ T5323] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 85.588289][ T5323] ? down_read+0x2be/0x330 [ 85.590298][ T5323] genl_rcv+0x28/0x40 [ 85.592283][ T5323] netlink_unicast+0x7bb/0x940 [ 85.596023][ T5323] netlink_sendmsg+0x813/0xb40 [ 85.598563][ T5323] ? __pfx_netlink_sendmsg+0x10/0x10 [ 85.602104][ T5323] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 85.622288][ T5323] ? __pfx_netlink_sendmsg+0x10/0x10 [ 85.642208][ T5323] sock_sendmsg_nosec+0x13a/0x180 [ 85.644975][ T5323] ____sys_sendmsg+0x54e/0x850 [ 85.659434][ T5323] ? __pfx_____sys_sendmsg+0x10/0x10 [ 85.661941][ T5323] ? lock_release+0x4b/0x3c0 [ 85.664288][ T5323] ? import_iovec+0x73/0xa0 [ 85.683954][ T5323] ___sys_sendmsg+0x2a5/0x360 [ 85.686505][ T5323] ? __pfx____sys_sendmsg+0x10/0x10 [ 85.689415][ T5323] ? futex_wake+0x51b/0x5f0 [ 85.692592][ T5323] ? __fget_files+0x2a/0x420 [ 85.699524][ T5323] ? __fget_files+0x3a2/0x420 [ 85.708106][ T5323] __x64_sys_sendmsg+0x1b1/0x290 [ 85.711425][ T5323] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 85.714219][ T5323] ? rcu_is_watching+0x15/0xb0 [ 85.733176][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.737089][ T5323] do_syscall_64+0x174/0x580 [ 85.740673][ T5323] ? trace_irq_disable+0x3b/0x140 [ 85.743914][ T5323] ? clear_bhb_loop+0x40/0x90 [ 85.761029][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.764270][ T5323] RIP: 0033:0x7fd8ab99ce59 [ 85.766980][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.790781][ T5323] RSP: 002b:00007fd8ac82dfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 85.806681][ T5323] RAX: ffffffffffffffda RBX: 00007fd8abc15fa0 RCX: 00007fd8ab99ce59 [ 85.810880][ T5323] RDX: 0000000000004000 RSI: 00002000000027c0 RDI: 0000000000000006 [ 85.815395][ T5323] RBP: 00007fd8aba32e6f R08: 0000000000000000 R09: 0000000000000000 [ 85.843000][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.849086][ T5323] R13: 00007fd8abc16038 R14: 00007fd8abc15fa0 R15: 00007ffe00640578 [ 85.853175][ T5323] [ 85.861629][ T5323] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 85.885000][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.894695][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.903100][ T5323] Call Trace: [ 85.904607][ T5323] [ 85.930501][ T5323] vpanic+0x56c/0xa60 [ 85.932267][ T5323] ? __pfx__printk+0x10/0x10 [ 85.934344][ T5323] ? __pfx_vpanic+0x10/0x10 [ 85.941192][ T5323] ? is_bpf_text_address+0x292/0x2b0 [ 85.944303][ T5323] ? is_bpf_text_address+0x26/0x2b0 [ 85.951660][ T5323] panic+0xc5/0xd0 [ 85.953430][ T5323] ? __pfx_panic+0x10/0x10 [ 85.955420][ T5323] __warn+0x315/0x4c0 [ 85.957244][ T5323] ? nbd_add_socket+0xf35/0x12c0 [ 85.959639][ T5323] ? nbd_add_socket+0xf35/0x12c0 [ 85.962000][ T5323] __report_bug+0x331/0x530 [ 85.964140][ T5323] ? irqentry_exit+0x218/0x8f0 [ 85.966238][ T5323] ? trace_irq_disable+0x3b/0x140 [ 85.969663][ T5323] ? nbd_add_socket+0xf35/0x12c0 [ 85.973475][ T5323] ? __pfx___report_bug+0x10/0x10 [ 85.977153][ T5323] ? __fget_files+0x2a/0x420 [ 85.980288][ T5323] ? check_preemption_disabled+0x1d/0xe0 [ 85.986450][ T5323] ? __fget_files+0x2a/0x420 [ 85.989660][ T5323] ? nbd_add_socket+0xf35/0x12c0 [ 86.008767][ T5323] report_bug+0x16a/0x220 [ 86.012422][ T5323] ? nbd_add_socket+0xf35/0x12c0 [ 86.040542][ T5323] ? nbd_add_socket+0xf37/0x12c0 [ 86.050813][ T5323] handle_bug+0x9c/0x200 [ 86.053217][ T5323] exc_invalid_op+0x1a/0x50 [ 86.056098][ T5323] asm_exc_invalid_op+0x1a/0x20 [ 86.062663][ T5323] RIP: 0010:nbd_add_socket+0xf35/0x12c0 [ 86.071482][ T5323] Code: f7 e8 2f 54 1d fc bf e0 01 00 00 49 03 3e 48 c7 c6 a0 6c 55 8c e8 9b 33 14 fb b8 f0 ff ff ff e9 b2 fd ff ff e8 ec 3b ae fb 90 <0f> 0b 90 e9 16 f8 ff ff e8 ce 4a 98 05 44 89 e9 80 e1 07 fe c1 38 [ 86.086114][ T5323] RSP: 0018:ffffc900078a7140 EFLAGS: 00010283 [ 86.088974][ T5323] RAX: ffffffff86180914 RBX: 1ffff11007d5b039 RCX: 0000000000100000 [ 86.095131][ T5323] RDX: ffffc90020001000 RSI: 000000000000060f RDI: 0000000000000610 [ 86.099739][ T5323] RBP: ffffc900078a7230 R08: ffff88803fbb031f R09: 1ffff11007f76063 [ 86.104788][ T5323] R10: dffffc0000000000 R11: ffffed1007f76064 R12: ffff88803ead8000 [ 86.108575][ T5323] R13: 1ffff92000f14e34 R14: dffffc0000000000 R15: 0000000000000001 [ 86.114400][ T5323] ? nbd_add_socket+0xf34/0x12c0 [ 86.117217][ T5323] ? __pfx_nbd_add_socket+0x10/0x10 [ 86.120012][ T5323] ? __nla_parse+0x40/0x60 [ 86.140788][ T5323] nbd_genl_connect+0x133d/0x1c10 [ 86.156793][ T5323] ? __pfx_nbd_genl_connect+0x10/0x10 [ 86.159180][ T5323] ? rcu_is_watching+0x15/0xb0 [ 86.169744][ T5323] ? trace_kmalloc+0x2a/0xf0 [ 86.199953][ T5323] ? __nla_parse+0x40/0x60 [ 86.207548][ T5323] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 86.225318][ T5323] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 86.244101][ T5323] genl_family_rcv_msg_doit+0x233/0x340 [ 86.246817][ T5323] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 86.266897][ T5323] ? __pfx_stack_trace_save+0x10/0x10 [ 86.269367][ T5323] genl_rcv_msg+0x614/0x7a0 [ 86.272131][ T5323] ? __pfx_genl_rcv_msg+0x10/0x10 [ 86.276640][ T5323] ? __pfx_nbd_genl_connect+0x10/0x10 [ 86.281803][ T5323] ? __netlink_lookup+0xc6/0x8b0 [ 86.283844][ T5323] ? rcu_is_watching+0x15/0xb0 [ 86.288924][ T5323] netlink_rcv_skb+0x226/0x4a0 [ 86.304400][ T5323] ? __pfx_genl_rcv_msg+0x10/0x10 [ 86.307951][ T5323] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 86.316290][ T5323] ? down_read+0x2be/0x330 [ 86.319653][ T5323] genl_rcv+0x28/0x40 [ 86.322990][ T5323] netlink_unicast+0x7bb/0x940 [ 86.329367][ T5323] netlink_sendmsg+0x813/0xb40 [ 86.333180][ T5323] ? __pfx_netlink_sendmsg+0x10/0x10 [ 86.336483][ T5323] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 86.347138][ T5323] ? __pfx_netlink_sendmsg+0x10/0x10 [ 86.349729][ T5323] sock_sendmsg_nosec+0x13a/0x180 [ 86.352134][ T5323] ____sys_sendmsg+0x54e/0x850 [ 86.370702][ T5323] ? __pfx_____sys_sendmsg+0x10/0x10 [ 86.373530][ T5323] ? lock_release+0x4b/0x3c0 [ 86.376249][ T5323] ? import_iovec+0x73/0xa0 [ 86.380047][ T5323] ___sys_sendmsg+0x2a5/0x360 [ 86.383291][ T5323] ? __pfx____sys_sendmsg+0x10/0x10 [ 86.395671][ T5323] ? futex_wake+0x51b/0x5f0 [ 86.398274][ T5323] ? __fget_files+0x2a/0x420 [ 86.401369][ T5323] ? __fget_files+0x3a2/0x420 [ 86.404148][ T5323] __x64_sys_sendmsg+0x1b1/0x290 [ 86.417052][ T5323] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 86.420730][ T5323] ? rcu_is_watching+0x15/0xb0 [ 86.423927][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.427207][ T5323] do_syscall_64+0x174/0x580 [ 86.436372][ T5323] ? trace_irq_disable+0x3b/0x140 [ 86.442580][ T5323] ? clear_bhb_loop+0x40/0x90 [ 86.445030][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.453853][ T5323] RIP: 0033:0x7fd8ab99ce59 [ 86.467043][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.497542][ T5323] RSP: 002b:00007fd8ac82dfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 86.515552][ T5323] RAX: ffffffffffffffda RBX: 00007fd8abc15fa0 RCX: 00007fd8ab99ce59 [ 86.521275][ T5323] RDX: 0000000000004000 RSI: 00002000000027c0 RDI: 0000000000000006 [ 86.551050][ T5323] RBP: 00007fd8aba32e6f R08: 0000000000000000 R09: 0000000000000000 [ 86.565660][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.569928][ T5323] R13: 00007fd8abc16038 R14: 00007fd8abc15fa0 R15: 00007ffe00640578 [ 86.584012][ T5323] [ 86.594058][ T5323] Kernel Offset: disabled [ 86.605434][ T5323] Rebooting in 86400 seconds..