program: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000900), r0) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000900), r0) r2 = syz_open_dev$sg(&(0x7f0000000980), 0x0, 0x401) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000009c0)={'\x00', 0x7ff, 0x181, 0xd, 0x4009, 0x2}) ioctl$BLKTRACESTART(r2, 0x1274, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000a40), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000c00)={0x53, 0xfffffffffffffffb, 0x6, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000c80)="5a3508ffeb00", 0x0, 0x0, 0x10032, 0x2000, 0x0}) (async) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000c00)={0x53, 0xfffffffffffffffb, 0x6, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000c80)="5a3508ffeb00", 0x0, 0x0, 0x10032, 0x2000, 0x0}) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000940)={'syz_tun\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000680)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7000fcdbdf250500000014000380040004000400050008000200000000000c00018008000100", @ANYRES32=r5, @ANYBLOB="154bbbb820d730147fa40e5cff84dd9ae8fdfb4c16b5c2ce2d02ec24dcc96ead776cf3693b7456aa4c04f9f574d080358bbd638c0ae0450da6d612824d27152905e362220cc1f2d12071a5a761c9b66f38b0df0e663d94cf6daf0902d432a837494a85ec12505476202a3fed189941c5d1f74a9635dc614252b11d58ad93408b9af070236a"], 0x34}, 0x1, 0x0, 0x0, 0x2000c041}, 0x4044094) (async) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000680)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd7000fcdbdf250500000014000380040004000400050008000200000000000c00018008000100", @ANYRES32=r5, @ANYBLOB="154bbbb820d730147fa40e5cff84dd9ae8fdfb4c16b5c2ce2d02ec24dcc96ead776cf3693b7456aa4c04f9f574d080358bbd638c0ae0450da6d612824d27152905e362220cc1f2d12071a5a761c9b66f38b0df0e663d94cf6daf0902d432a837494a85ec12505476202a3fed189941c5d1f74a9635dc614252b11d58ad93408b9af070236a"], 0x34}, 0x1, 0x0, 0x0, 0x2000c041}, 0x4044094) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) r6 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) ioctl$DM_DEV_CREATE(r6, 0xc138fd03, &(0x7f0000000d40)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) (async) ioctl$DM_DEV_CREATE(r6, 0xc138fd03, &(0x7f0000000d40)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r6, 0xc138fd09, &(0x7f0000000e80)={0x4, 0x0, 0x0, 0x1a8, 0x138, 0x1, 0x0, 0x11, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@cache={0x0, 0x418, 0x0, 0x70, 'cache\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x0}, 0x20, @ram_num={'1:', 0x0}, 0x20, '512', 0x20, '0', 0x20, 'cleaner 0'}}]}) (async) ioctl$DM_TABLE_LOAD(r6, 0xc138fd09, &(0x7f0000000e80)={0x4, 0x0, 0x0, 0x1a8, 0x138, 0x1, 0x0, 0x11, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@cache={0x0, 0x418, 0x0, 0x70, 'cache\x00', {@ram={'/dev/ram', 0x0}, 0x20, @ram_num={'1:', 0x0}, 0x20, @ram_num={'1:', 0x0}, 0x20, '512', 0x20, '0', 0x20, 'cleaner 0'}}]}) gettid() timer_create(0xb, 0x0, &(0x7f0000000040)=0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000140)={0x0, 0xfffffffffffffe16, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000005000100070000000900020073797a30000000001400078008001240000000000500150004000000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x48, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x48}}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x48, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x48}}, 0x0) (async) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x48, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x48}}, 0x0) sendmsg$IPSET_CMD_TEST(r10, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="400000000b0603000000000000000000020000060e0001000700000005000100070000001c0007800900120073797a31000000000c00148008000140e0000001"], 0x40}, 0x1, 0x0, 0x0, 0x44080}, 0x4000002) (async) sendmsg$IPSET_CMD_TEST(r10, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=ANY=[@ANYBLOB="400000000b0603000000000000000000020000060e0001000700000005000100070000001c0007800900120073797a31000000000c00148008000140e0000001"], 0x40}, 0x1, 0x0, 0x0, 0x44080}, 0x4000002) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timer_gettime(r7, &(0x7f0000000100)) r11 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r11, 0xc0045627, &(0x7f00000000c0)=0x1) (async) ioctl$VIDIOC_S_INPUT(r11, 0xc0045627, &(0x7f00000000c0)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x5, &(0x7f0000000600)=ANY=[@ANYBLOB], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$ITER_CREATE(0xb, 0x0, 0x0) [ 102.459203][ T4662] Bluetooth: hci0: command tx timeout [ 102.673924][ T5358] netlink: 'syz.0.0': attribute type 1 has an invalid length. [ 102.674428][ T5357] netlink: 'syz.0.0': attribute type 1 has an invalid length. [ 102.740809][ T5355] workqueue: Failed to create a rescuer kthread for wq "kcopyd": -EINTR [ 102.742477][ T5355] ================================================================== [ 102.742487][ T5355] BUG: KASAN: null-ptr-deref in dm_kcopyd_client_destroy+0xae/0x480 [ 102.742648][ T5355] Read of size 4 at addr 0000000000000174 by task syz.0.0/5355 [ 102.742658][ T5355] [ 102.742690][ T5355] CPU: 0 UID: 0 PID: 5355 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.742702][ T5355] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.742708][ T5355] Call Trace: [ 102.742713][ T5355] [ 102.742718][ T5355] dump_stack_lvl+0xe8/0x150 [ 102.742738][ T5355] ? dm_kcopyd_client_destroy+0xae/0x480 [ 102.742749][ T5355] kasan_report+0x117/0x150 [ 102.742774][ T5355] ? dm_kcopyd_client_destroy+0xae/0x480 [ 102.742788][ T5355] kasan_check_range+0x264/0x2c0 [ 102.742803][ T5355] dm_kcopyd_client_destroy+0xae/0x480 [ 102.742813][ T5355] ? __pfx_dm_kcopyd_client_destroy+0x10/0x10 [ 102.742822][ T5355] ? kasan_quarantine_put+0xbb/0x1f0 [ 102.742834][ T5355] ? lockdep_hardirqs_on+0x7b/0x110 [ 102.742892][ T5355] ? kfree+0x1c5/0x650 [ 102.742901][ T5355] ? __destroy+0x139/0x2f0 [ 102.742910][ T5355] ? vfree+0x426/0x490 [ 102.742926][ T5355] __destroy+0x172/0x2f0 [ 102.742936][ T5355] cache_ctr+0x1674/0x2bf0 [ 102.742952][ T5355] ? __pfx_cache_ctr+0x10/0x10 [ 102.742962][ T5355] ? skip_spaces+0x8a/0xa0 [ 102.743050][ T5355] dm_table_add_target+0x58d/0xc70 [ 102.743068][ T5355] table_load+0x325/0x8a0 [ 102.743084][ T5355] ? __pfx_table_load+0x10/0x10 [ 102.743098][ T5355] ? __might_fault+0xaf/0x130 [ 102.743117][ T5355] dm_ctl_ioctl+0x9ec/0xe10 [ 102.743133][ T5355] ? __pfx_table_load+0x10/0x10 [ 102.743146][ T5355] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 102.743169][ T5355] ? __fget_files+0x2a/0x420 [ 102.743223][ T5355] ? bpf_lsm_file_ioctl+0x9/0x20 [ 102.743237][ T5355] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 102.743251][ T5355] __se_sys_ioctl+0xfc/0x170 [ 102.743278][ T5355] do_syscall_64+0x166/0x520 [ 102.743291][ T5355] ? trace_irq_disable+0x3b/0x140 [ 102.743306][ T5355] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.743317][ T5355] ? clear_bhb_loop+0x70/0xc0 [ 102.743329][ T5355] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.743340][ T5355] RIP: 0033:0x7f872179f559 [ 102.743359][ T5355] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.743366][ T5355] RSP: 002b:00007f872263dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 102.743378][ T5355] RAX: ffffffffffffffda RBX: 00007f8721a26180 RCX: 00007f872179f559 [ 102.743386][ T5355] RDX: 0000200000000e80 RSI: 00000000c138fd09 RDI: 0000000000000008 [ 102.743393][ T5355] RBP: 00007f8721836b50 R08: 0000000000000000 R09: 0000000000000000 [ 102.743399][ T5355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.743406][ T5355] R13: 00007f8721a26218 R14: 00007f8721a26180 R15: 00007ffdec256518 [ 102.743418][ T5355] [ 102.743422][ T5355] ================================================================== [ 102.743431][ T5355] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 102.874685][ T5355] CPU: 0 UID: 0 PID: 5355 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.878566][ T5355] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.882765][ T5355] Call Trace: [ 102.884232][ T5355] [ 102.885581][ T5355] vpanic+0x26f/0x710 [ 102.887345][ T5355] panic+0xc5/0xd0 [ 102.888948][ T5355] ? __pfx_panic+0x10/0x10 [ 102.890795][ T5355] ? dm_kcopyd_client_destroy+0xae/0x480 [ 102.893078][ T5355] ? rcu_is_watching+0x16/0xb0 [ 102.895172][ T5355] ? dm_kcopyd_client_destroy+0xae/0x480 [ 102.897562][ T5355] check_panic_on_warn+0x89/0xb0 [ 102.899770][ T5355] ? dm_kcopyd_client_destroy+0xae/0x480 [ 102.902212][ T5355] end_report+0x73/0x170 [ 102.904116][ T5355] ? dm_kcopyd_client_destroy+0xae/0x480 [ 102.906607][ T5355] kasan_report+0x128/0x150 [ 102.908638][ T5355] ? dm_kcopyd_client_destroy+0xae/0x480 [ 102.911071][ T5355] kasan_check_range+0x264/0x2c0 [ 102.913204][ T5355] dm_kcopyd_client_destroy+0xae/0x480 [ 102.918420][ T5355] ? __pfx_dm_kcopyd_client_destroy+0x10/0x10 [ 102.920967][ T5355] ? kasan_quarantine_put+0xbb/0x1f0 [ 102.923295][ T5355] ? lockdep_hardirqs_on+0x7b/0x110 [ 102.925603][ T5355] ? kfree+0x1c5/0x650 [ 102.927464][ T5355] ? __destroy+0x139/0x2f0 [ 102.929392][ T5355] ? vfree+0x426/0x490 [ 102.931196][ T5355] __destroy+0x172/0x2f0 [ 102.933071][ T5355] cache_ctr+0x1674/0x2bf0 [ 102.935078][ T5355] ? __pfx_cache_ctr+0x10/0x10 [ 102.937186][ T5355] ? skip_spaces+0x8a/0xa0 [ 102.939164][ T5355] dm_table_add_target+0x58d/0xc70 [ 102.941346][ T5355] table_load+0x325/0x8a0 [ 102.943233][ T5355] ? __pfx_table_load+0x10/0x10 [ 102.945175][ T5355] ? __might_fault+0xaf/0x130 [ 102.947247][ T5355] dm_ctl_ioctl+0x9ec/0xe10 [ 102.949263][ T5355] ? __pfx_table_load+0x10/0x10 [ 102.951420][ T5355] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 102.953712][ T5355] ? __fget_files+0x2a/0x420 [ 102.955791][ T5355] ? bpf_lsm_file_ioctl+0x9/0x20 [ 102.957989][ T5355] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 102.960213][ T5355] __se_sys_ioctl+0xfc/0x170 [ 102.962271][ T5355] do_syscall_64+0x166/0x520 [ 102.964243][ T5355] ? trace_irq_disable+0x3b/0x140 [ 102.966413][ T5355] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.968993][ T5355] ? clear_bhb_loop+0x70/0xc0 [ 102.971020][ T5355] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.973491][ T5355] RIP: 0033:0x7f872179f559 [ 102.975428][ T5355] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.983402][ T5355] RSP: 002b:00007f872263dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 102.986832][ T5355] RAX: ffffffffffffffda RBX: 00007f8721a26180 RCX: 00007f872179f559 [ 102.990115][ T5355] RDX: 0000200000000e80 RSI: 00000000c138fd09 RDI: 0000000000000008 [ 102.993393][ T5355] RBP: 00007f8721836b50 R08: 0000000000000000 R09: 0000000000000000 [ 102.996637][ T5355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.999982][ T5355] R13: 00007f8721a26218 R14: 00007f8721a26180 R15: 00007ffdec256518 [ 103.003291][ T5355] [ 103.005088][ T5355] Kernel Offset: disabled [ 103.006944][ T5355] Rebooting in 86400 seconds..