program: socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) r0 = socket$key(0xf, 0x3, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async, rerun: 32) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (rerun: 32) r2 = openat$cgroup_procs(r1, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000000c0), 0x12) (async, rerun: 64) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) (rerun: 64) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000480)='cgroup.threads\x00', 0x2, 0x0) sendfile(r4, r4, 0x0, 0x4) (async, rerun: 64) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) (async, rerun: 64) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000480)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f00000001c0), 0x12) (async, rerun: 32) readv(r2, &(0x7f0000000340)=[{&(0x7f0000001740)=""/153, 0x99}], 0x1) (async, rerun: 32) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x2, 0x3, 0x0, 0x3, 0xe, 0x0, 0x0, 0xfffffffd, [@sadb_address={0x5, 0x6, 0x0, 0xb0, 0x0, @in6={0xa, 0x0, 0x0, @loopback, 0x1}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xc, 0x60000002}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e22, 0x0, @loopback}}]}, 0x70}, 0x1, 0x7}, 0x0) (async, rerun: 32) socket$inet6_sctp(0xa, 0x801, 0x84) (async, rerun: 32) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_route(0x10, 0x3, 0x0) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000180), 0xfea7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0x0) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) socket$nl_xfrm(0x10, 0x3, 0x6) r9 = socket$rxrpc(0x21, 0x2, 0xa) recvmsg(r9, &(0x7f0000000700)={&(0x7f00000000c0)=@llc, 0x80, &(0x7f0000000580)=[{&(0x7f0000000840)=""/67, 0x43}, {&(0x7f0000000200)=""/95, 0x5f}, {&(0x7f0000000280)=""/157, 0x9d}, {&(0x7f00000004c0)=""/137, 0x89}, {&(0x7f00000003c0)=""/181, 0xb5}, {&(0x7f0000000740)=""/198, 0xc6}], 0x6, &(0x7f0000000600)=""/210, 0xd2}, 0x40000000) [ 87.072912][ T4675] Bluetooth: hci0: command tx timeout [ 87.345228][ T5321] BUG: unable to handle page fault for address: ffffed1011a4a401 [ 87.348519][ T5321] #PF: supervisor read access in kernel mode [ 87.351231][ T5321] #PF: error_code(0x0000) - not-present page [ 87.354262][ T5321] PGD 5ffcd067 P4D 5ffcd067 PUD 2fff7067 PMD 0 [ 87.357164][ T5321] Oops: Oops: 0000 [#1] SMP KASAN NOPTI [ 87.359473][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: kworker/0:4 Not tainted 6.16.0-rc1-syzkaller #0 PREEMPT(full) [ 87.363748][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 87.368930][ T5321] Workqueue: cgroup_destroy css_free_rwork_fn [ 87.371934][ T5321] RIP: 0010:css_rstat_flush+0x5ff/0x1fa0 [ 87.374468][ T5321] Code: bb b7 d1 0d 01 0f 85 e6 14 00 00 e8 bb 1e 07 00 4c 03 6c 24 20 4d 8d 7d 08 4c 89 fb 48 c1 eb 03 48 b8 00 00 00 00 00 fc ff df <80> 3c 03 00 74 08 4c 89 ff e8 03 96 6a 00 49 83 3f 00 0f 84 5d 01 [ 87.383602][ T5321] RSP: 0018:ffffc9000d547780 EFLAGS: 00010802 [ 87.386205][ T5321] RAX: dffffc0000000000 RBX: 1ffff11011a4a401 RCX: ffff8880006aa440 [ 87.389852][ T5321] RDX: 0000000000000000 RSI: ffffffff8be282a0 RDI: ffffffff8be28260 [ 87.393985][ T5321] RBP: ffffc9000d5479b8 R08: ffffffff8fa108f7 R09: 1ffffffff1f4211e [ 87.397656][ T5321] R10: dffffc0000000000 R11: fffffbfff1f4211f R12: ffff88801fc42730 [ 87.401233][ T5321] R13: ffff88808d252000 R14: 0000000000000000 R15: ffff88808d252008 [ 87.404900][ T5321] FS: 0000000000000000(0000) GS:ffff88808d252000(0000) knlGS:0000000000000000 [ 87.410014][ T5321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.412846][ T5321] CR2: ffffed1011a4a401 CR3: 0000000051eba000 CR4: 0000000000352ef0 [ 87.416472][ T5321] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 87.420097][ T5321] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 87.424159][ T5321] Call Trace: [ 87.426244][ T5321] [ 87.427880][ T5321] ? check_path+0x21/0x40 [ 87.429959][ T5321] ? __pfx_css_rstat_flush+0x10/0x10 [ 87.432296][ T5321] ? __lock_acquire+0xab9/0xd20 [ 87.434693][ T5321] css_rstat_exit+0xa9/0x320 [ 87.436845][ T5321] ? process_scheduled_works+0x9ef/0x17b0 [ 87.439851][ T5321] ? percpu_ref_exit+0xc5/0x1c0 [ 87.442485][ T5321] css_free_rwork_fn+0x8b/0xc50 [ 87.444794][ T5321] ? process_scheduled_works+0x9ef/0x17b0 [ 87.447305][ T5321] ? process_scheduled_works+0x9ef/0x17b0 [ 87.449890][ T5321] process_scheduled_works+0xae1/0x17b0 [ 87.452385][ T5321] ? __pfx_process_scheduled_works+0x10/0x10 [ 87.455621][ T5321] worker_thread+0x8a0/0xda0 [ 87.458207][ T5321] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 87.461469][ T5321] ? __kthread_parkme+0x7b/0x200 [ 87.464131][ T5321] kthread+0x70e/0x8a0 [ 87.466400][ T5321] ? __pfx_worker_thread+0x10/0x10 [ 87.469518][ T5321] ? __pfx_kthread+0x10/0x10 [ 87.472848][ T5321] ? _raw_spin_unlock_irq+0x23/0x50 [ 87.475657][ T5321] ? lockdep_hardirqs_on+0x9c/0x150 [ 87.477814][ T5321] ? __pfx_kthread+0x10/0x10 [ 87.480003][ T5321] ret_from_fork+0x3fc/0x770 [ 87.482112][ T5321] ? __pfx_ret_from_fork+0x10/0x10 [ 87.484387][ T5321] ? __pfx_kthread+0x10/0x10 [ 87.486898][ T5321] ret_from_fork_asm+0x1a/0x30 [ 87.489427][ T5321] [ 87.490918][ T5321] Modules linked in: [ 87.492717][ T5321] CR2: ffffed1011a4a401 [ 87.494655][ T5321] ---[ end trace 0000000000000000 ]--- [ 87.497160][ T5321] RIP: 0010:css_rstat_flush+0x5ff/0x1fa0 [ 87.500118][ T5321] Code: bb b7 d1 0d 01 0f 85 e6 14 00 00 e8 bb 1e 07 00 4c 03 6c 24 20 4d 8d 7d 08 4c 89 fb 48 c1 eb 03 48 b8 00 00 00 00 00 fc ff df <80> 3c 03 00 74 08 4c 89 ff e8 03 96 6a 00 49 83 3f 00 0f 84 5d 01 [ 87.508982][ T5321] RSP: 0018:ffffc9000d547780 EFLAGS: 00010802 [ 87.511905][ T5321] RAX: dffffc0000000000 RBX: 1ffff11011a4a401 RCX: ffff8880006aa440 [ 87.516234][ T5321] RDX: 0000000000000000 RSI: ffffffff8be282a0 RDI: ffffffff8be28260 [ 87.520017][ T5321] RBP: ffffc9000d5479b8 R08: ffffffff8fa108f7 R09: 1ffffffff1f4211e [ 87.523693][ T5321] R10: dffffc0000000000 R11: fffffbfff1f4211f R12: ffff88801fc42730 [ 87.527042][ T5321] R13: ffff88808d252000 R14: 0000000000000000 R15: ffff88808d252008 [ 87.530910][ T5321] FS: 0000000000000000(0000) GS:ffff88808d252000(0000) knlGS:0000000000000000 [ 87.535322][ T5321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 87.538484][ T5321] CR2: ffffed1011a4a401 CR3: 0000000051eba000 CR4: 0000000000352ef0 [ 87.542141][ T5321] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 87.546308][ T5321] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 87.550010][ T5321] Kernel panic - not syncing: Fatal exception [ 87.552977][ T5321] Kernel Offset: disabled [ 87.555157][ T5321] Rebooting in 86400 seconds..