program: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a32000000001400048008000240326565a708000140000000000900010073797a300000000048000000060a010400000000000000000100000008000b40000000000900010073797a3000000000200004801c0001800b00010072656a65637400000c000280080001400000000114000000110001"], 0xd0}}, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000000)={0x10, 0x0, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x15}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_CT_DIRECTION={0x5, 0x3, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000002c0)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0000f5", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x50, r3, 0x2, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY={0x28, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee33908f8eef16f162471f4"}, @NL80211_KEY_IDX={0x5}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}]}]}, 0x50}}, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000c40)={0x40, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_FRAME={0x22, 0x33, @action={{{}, {}, @device_b}, @ext_ch_sw={0x4, 0x4, {{}, @void}}}}]}, 0x40}}, 0x0) r9 = syz_open_dev$dri(&(0x7f0000000200), 0xffff, 0x101000) (async) r10 = syz_open_dev$dri(&(0x7f0000000340), 0x2, 0xc8d03) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r10, 0xc00864bf, &(0x7f0000000000)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r10, 0xc01864cb, &(0x7f0000000140)={&(0x7f0000000180)=[r11], &(0x7f0000000100), 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r9, 0xc01064c1, &(0x7f0000000240)={r11}) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10, 0x8}, [@ldst={0x3, 0x0, 0x3, 0xa, 0x0, 0xff00}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) [ 166.775713][ T4677] Bluetooth: hci0: command tx timeout [ 166.857288][ T5351] capability: warning: `syz.0.0' uses deprecated v2 capabilities in a way that may be insecure [ 166.863115][ T5350] ------------[ cut here ]------------ [ 166.865585][ T5350] WARNING: CPU: 0 PID: 5350 at mm/page_alloc.c:4935 __alloc_frozen_pages_noprof+0x2c8/0x370 [ 166.870347][ T5350] Modules linked in: [ 166.873064][ T5350] CPU: 0 UID: 0 PID: 5350 Comm: syz.0.0 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(full) [ 166.878570][ T5350] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 166.883396][ T5350] RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 [ 166.886338][ T5350] Code: 74 10 4c 89 e7 89 54 24 0c e8 74 14 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 2a 36 74 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 166.895334][ T5350] RSP: 0018:ffffc90003e3f900 EFLAGS: 00010246 [ 166.897988][ T5350] RAX: ffffc90003e3f900 RBX: 0000000000000016 RCX: 0000000000000000 [ 166.901446][ T5350] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003e3f968 [ 166.905650][ T5350] RBP: ffffc90003e3f9f0 R08: ffffc90003e3f967 R09: 0000000000000000 [ 166.909346][ T5350] R10: ffffc90003e3f940 R11: fffff520007c7f2d R12: 0000000000000000 [ 166.912960][ T5350] R13: 1ffff920007c7f24 R14: 0000000000040cc0 R15: dffffc0000000000 [ 166.916109][ T5350] FS: 00007f05569f56c0(0000) GS:ffff88808d251000(0000) knlGS:0000000000000000 [ 166.920177][ T5350] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 166.923724][ T5350] CR2: 00007f05569d2fb8 CR3: 0000000043208000 CR4: 0000000000352ef0 [ 166.927053][ T5350] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 166.930341][ T5350] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 166.933996][ T5350] Call Trace: [ 166.935549][ T5350] [ 166.936926][ T5350] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 166.939796][ T5350] ? kfree+0x18e/0x440 [ 166.941593][ T5350] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 166.944398][ T5350] ? security_file_ioctl+0xcb/0x2d0 [ 166.946664][ T5350] ? __se_sys_ioctl+0x47/0x170 [ 166.948929][ T5350] ? do_syscall_64+0xfa/0x3b0 [ 166.951432][ T5350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 166.954511][ T5350] __alloc_pages_noprof+0xa/0x30 [ 166.956598][ T5350] ___kmalloc_large_node+0x85/0x210 [ 166.958754][ T5350] __kmalloc_large_node_noprof+0x18/0x90 [ 166.961069][ T5350] __kmalloc_noprof+0x36f/0x4f0 [ 166.963359][ T5350] ? drm_syncobj_array_find+0x3a/0x450 [ 166.965494][ T5350] drm_syncobj_array_find+0x3a/0x450 [ 166.967666][ T5350] drm_syncobj_query_ioctl+0x1c3/0x9d0 [ 166.969922][ T5350] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 166.972648][ T5350] drm_ioctl_kernel+0x2cc/0x390 [ 166.974598][ T5350] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 166.977141][ T5350] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 166.979383][ T5350] drm_ioctl+0x67f/0xb10 [ 166.981966][ T5350] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 166.985340][ T5350] ? __pfx_drm_ioctl+0x10/0x10 [ 166.987911][ T5350] ? __fget_files+0x2a/0x420 [ 166.989995][ T5350] ? bpf_lsm_file_ioctl+0x9/0x20 [ 166.992153][ T5350] ? __pfx_drm_ioctl+0x10/0x10 [ 166.994256][ T5350] __se_sys_ioctl+0xf9/0x170 [ 166.996181][ T5350] do_syscall_64+0xfa/0x3b0 [ 166.998081][ T5350] ? lockdep_hardirqs_on+0x9c/0x150 [ 167.000174][ T5350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.004040][ T5350] ? clear_bhb_loop+0x60/0xb0 [ 167.006732][ T5350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.009719][ T5350] RIP: 0033:0x7f055a58e929 [ 167.011709][ T5350] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 167.020152][ T5350] RSP: 002b:00007f05569f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 167.024421][ T5350] RAX: ffffffffffffffda RBX: 00007f055a7b5fa0 RCX: 00007f055a58e929 [ 167.027747][ T5350] RDX: 0000200000000140 RSI: 00000000c01864cb RDI: 0000000000000008 [ 167.030885][ T5350] RBP: 00007f055a610b39 R08: 0000000000000000 R09: 0000000000000000 [ 167.034449][ T5350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 167.038571][ T5350] R13: 0000000000000000 R14: 00007f055a7b5fa0 R15: 00007ffdc65b0688 [ 167.042143][ T5350] [ 167.043568][ T5350] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 167.046416][ T5350] CPU: 0 UID: 0 PID: 5350 Comm: syz.0.0 Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(full) [ 167.050487][ T5350] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 167.055292][ T5350] Call Trace: [ 167.056855][ T5350] [ 167.058155][ T5350] dump_stack_lvl+0x99/0x250 [ 167.060057][ T5350] ? __asan_memcpy+0x40/0x70 [ 167.062102][ T5350] ? __pfx_dump_stack_lvl+0x10/0x10 [ 167.064331][ T5350] ? __pfx__printk+0x10/0x10 [ 167.066465][ T5350] panic+0x2db/0x790 [ 167.068298][ T5350] ? __pfx_panic+0x10/0x10 [ 167.070790][ T5350] ? show_trace_log_lvl+0x4fb/0x550 [ 167.073682][ T5350] __warn+0x31b/0x4b0 [ 167.075512][ T5350] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 167.078185][ T5350] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 167.080802][ T5350] report_bug+0x2be/0x4f0 [ 167.082658][ T5350] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 167.085115][ T5350] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 167.087527][ T5350] ? __alloc_frozen_pages_noprof+0x2ca/0x370 [ 167.090659][ T5350] handle_bug+0x84/0x160 [ 167.092898][ T5350] exc_invalid_op+0x1a/0x50 [ 167.094951][ T5350] asm_exc_invalid_op+0x1a/0x20 [ 167.096938][ T5350] RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 [ 167.099631][ T5350] Code: 74 10 4c 89 e7 89 54 24 0c e8 74 14 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 2a 36 74 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 167.108841][ T5350] RSP: 0018:ffffc90003e3f900 EFLAGS: 00010246 [ 167.111879][ T5350] RAX: ffffc90003e3f900 RBX: 0000000000000016 RCX: 0000000000000000 [ 167.115345][ T5350] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003e3f968 [ 167.118705][ T5350] RBP: ffffc90003e3f9f0 R08: ffffc90003e3f967 R09: 0000000000000000 [ 167.122452][ T5350] R10: ffffc90003e3f940 R11: fffff520007c7f2d R12: 0000000000000000 [ 167.126924][ T5350] R13: 1ffff920007c7f24 R14: 0000000000040cc0 R15: dffffc0000000000 [ 167.130446][ T5350] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 167.133138][ T5350] ? kfree+0x18e/0x440 [ 167.134885][ T5350] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 167.137300][ T5350] ? security_file_ioctl+0xcb/0x2d0 [ 167.139380][ T5350] ? __se_sys_ioctl+0x47/0x170 [ 167.141495][ T5350] ? do_syscall_64+0xfa/0x3b0 [ 167.143802][ T5350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.147321][ T5350] __alloc_pages_noprof+0xa/0x30 [ 167.149925][ T5350] ___kmalloc_large_node+0x85/0x210 [ 167.152364][ T5350] __kmalloc_large_node_noprof+0x18/0x90 [ 167.154860][ T5350] __kmalloc_noprof+0x36f/0x4f0 [ 167.156991][ T5350] ? drm_syncobj_array_find+0x3a/0x450 [ 167.159480][ T5350] drm_syncobj_array_find+0x3a/0x450 [ 167.161916][ T5350] drm_syncobj_query_ioctl+0x1c3/0x9d0 [ 167.164991][ T5350] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 167.168336][ T5350] drm_ioctl_kernel+0x2cc/0x390 [ 167.170537][ T5350] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 167.172992][ T5350] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 167.175158][ T5350] drm_ioctl+0x67f/0xb10 [ 167.176910][ T5350] ? __pfx_drm_syncobj_query_ioctl+0x10/0x10 [ 167.179638][ T5350] ? __pfx_drm_ioctl+0x10/0x10 [ 167.181804][ T5350] ? __fget_files+0x2a/0x420 [ 167.184244][ T5350] ? bpf_lsm_file_ioctl+0x9/0x20 [ 167.186413][ T5350] ? __pfx_drm_ioctl+0x10/0x10 [ 167.188434][ T5350] __se_sys_ioctl+0xf9/0x170 [ 167.190514][ T5350] do_syscall_64+0xfa/0x3b0 [ 167.192551][ T5350] ? lockdep_hardirqs_on+0x9c/0x150 [ 167.194855][ T5350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.197885][ T5350] ? clear_bhb_loop+0x60/0xb0 [ 167.200028][ T5350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.202646][ T5350] RIP: 0033:0x7f055a58e929 [ 167.204646][ T5350] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 167.213297][ T5350] RSP: 002b:00007f05569f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 167.217446][ T5350] RAX: ffffffffffffffda RBX: 00007f055a7b5fa0 RCX: 00007f055a58e929 [ 167.220782][ T5350] RDX: 0000200000000140 RSI: 00000000c01864cb RDI: 0000000000000008 [ 167.224032][ T5350] RBP: 00007f055a610b39 R08: 0000000000000000 R09: 0000000000000000 [ 167.227227][ T5350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 167.230910][ T5350] R13: 0000000000000000 R14: 00007f055a7b5fa0 R15: 00007ffdc65b0688 [ 167.234850][ T5350] [ 167.236736][ T5350] Kernel Offset: disabled [ 167.238616][ T5350] Rebooting in 86400 seconds..