0\xc2\xed 0f b6 14 38 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 [ 529.079029] RSP: 0018:ffff8880934af3d0 EFLAGS: 00010246 [ 529.088093] kobject: 'kvm' (00000000047262d7): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 529.090899] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc9000c4aa000 [ 529.090909] RDX: 000000000001a3b4 RSI: ffffffff85969d10 RDI: ffff88809fd7d7c0 [ 529.090917] RBP: ffff8880934af460 R08: ffff88805d23a3c0 R09: ffff88808fb56568 [ 529.090925] R10: ffffed1011f6acac R11: ffff88808fb56560 R12: 1ffff11012695e7b [ 529.090933] R13: ffff88809fd7d7c0 R14: ffff8880934af438 R15: dffffc0000000000 [ 529.090944] FS: 00007f77feb2d700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 529.090952] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 529.090959] CR2: 0000001b2fe29000 CR3: 000000009d785000 CR4: 00000000001426f0 [ 529.090968] Call Trace: [ 529.090986] ? memcpy+0x46/0x50 [ 529.091021] ? udp_timeout_nlattr_to_obj+0x240/0x240 [ 529.124801] kobject: 'kvm' (00000000047262d7): kobject_uevent_env [ 529.131586] ? __nla_put+0x37/0x40 [ 529.131601] ? nla_put+0x116/0x150 [ 529.131621] cttimeout_default_get+0x69a/0xa80 [ 529.131639] ? cttimeout_del_timeout+0x1a0/0x1a0 [ 529.131655] ? __lock_is_held+0x81/0x140 [ 529.131673] ? cttimeout_del_timeout+0x1a0/0x1a0 [ 529.131686] nfnetlink_rcv_msg+0xd12/0xfe0 [ 529.131706] ? nfnetlink_bind+0x2d0/0x2d0 [ 529.141502] kobject: 'kvm' (00000000047262d7): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 529.146279] ? avc_has_extended_perms+0x10f0/0x10f0 [ 529.146297] ? __dev_queue_xmit+0x1764/0x3020 [ 529.146320] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 529.174060] kobject: 'kvm' (00000000047262d7): kobject_uevent_env [ 529.175103] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 529.190321] kobject: 'kvm' (00000000047262d7): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 529.193356] ? cred_has_capability+0x193/0x320 [ 529.193372] ? selinux_ipv4_output+0x50/0x50 [ 529.193393] ? __sanitizer_cov_trace_cmp1+0x3/0x20 [ 529.193412] netlink_rcv_skb+0x180/0x460 [ 529.193425] ? nfnetlink_bind+0x2d0/0x2d0 [ 529.193447] ? netlink_ack+0xb60/0xb60 [ 529.304016] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 529.309571] ? ns_capable+0x23/0x30 [ 529.313214] ? __netlink_ns_capable+0x104/0x140 [ 529.317895] nfnetlink_rcv+0x1c0/0x460 [ 529.321797] ? nfnetlink_rcv_batch+0x1770/0x1770 [ 529.326572] ? netlink_deliver_tap+0x254/0xc20 [ 529.331168] netlink_unicast+0x53c/0x720 [ 529.335242] ? netlink_attachskb+0x770/0x770 [ 529.339676] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 529.345224] netlink_sendmsg+0x8ae/0xd70 [ 529.349296] ? netlink_unicast+0x720/0x720 [ 529.353551] ? selinux_socket_sendmsg+0x36/0x40 [ 529.358228] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 529.363773] ? security_socket_sendmsg+0x93/0xc0 [ 529.368555] ? netlink_unicast+0x720/0x720 [ 529.372794] sock_sendmsg+0xdd/0x130 [ 529.376513] ___sys_sendmsg+0x806/0x930 [ 529.380492] ? copy_msghdr_from_user+0x430/0x430 [ 529.385259] ? lock_downgrade+0x810/0x810 [ 529.389425] ? kasan_check_read+0x11/0x20 [ 529.393594] ? __fget+0x367/0x540 [ 529.397075] ? iterate_fd+0x360/0x360 [ 529.400891] ? lock_downgrade+0x810/0x810 [ 529.405057] ? __fget_light+0x1a9/0x230 [ 529.409044] ? __fdget+0x1b/0x20 [ 529.413887] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 529.419440] __sys_sendmsg+0x105/0x1d0 [ 529.423336] ? __ia32_sys_shutdown+0x80/0x80 [ 529.427760] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 529.432523] ? do_syscall_64+0x26/0x610 [ 529.436501] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 529.441871] ? do_syscall_64+0x26/0x610 [ 529.445850] __x64_sys_sendmsg+0x78/0xb0 [ 529.450699] do_syscall_64+0x103/0x610 [ 529.454595] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 529.459787] RIP: 0033:0x458c29 [ 529.462996] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 529.481915] RSP: 002b:00007f77feb2cc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 529.489651] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458c29 [ 529.496931] RDX: 0000000000000000 RSI: 0000000020dddfc8 RDI: 0000000000000004 [ 529.504212] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 529.511483] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f77feb2d6d4 [ 529.518753] R13: 00000000004c6501 R14: 00000000004dae68 R15: 00000000ffffffff [ 529.526868] Modules linked in: 05:51:36 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_emit_ethernet(0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="aaf704e51eaaaaaaaaaaaaaa86dd60b40900003000000000000000001000000000e0"], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x119000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec7) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 529.532023] kobject: 'loop4' (0000000031741023): kobject_uevent_env [ 529.538064] ---[ end trace 1af291905140477a ]--- [ 529.544852] RIP: 0010:udp_timeout_obj_to_nlattr+0x77/0x1a0 [ 529.550582] Code: 96 85 c7 00 f1 f1 f1 f1 c7 40 04 04 f3 f3 f3 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 30 9a d4 fb 48 89 d8 48 c1 e8 03 <42> 0f b6 14 38 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 [ 529.550944] kobject: 'loop4' (0000000031741023): fill_kobj_path: path = '/devices/virtual/block/loop4' 05:51:36 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) listen(r0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0xffffffffffffff4b, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) recvfrom$inet6(r1, &(0x7f00000001c0)=""/31, 0xfffffffffffffe3c, 0x100, &(0x7f0000001880), 0x17c) socketpair(0x0, 0x0, 0x0, 0x0) getsockopt$bt_sco_SCO_OPTIONS(0xffffffffffffffff, 0x11, 0x1, 0x0, 0x0) getsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFMTU(0xffffffffffffffff, 0x8921, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) shutdown(r1, 0x1) r2 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r2, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") 05:51:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000580)=0xffffffffffffffff) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000006cc0)) [ 529.573315] RSP: 0018:ffff8880934af3d0 EFLAGS: 00010246 [ 529.585336] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc9000c4aa000 [ 529.602264] kobject: 'loop5' (00000000517e4172): kobject_uevent_env [ 529.607485] kobject: 'kvm' (00000000047262d7): kobject_uevent_env [ 529.617605] RDX: 000000000001a3b4 RSI: ffffffff85969d10 RDI: ffff88809fd7d7c0 05:51:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000580)=0xffffffffffffffff) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000006cc0)) [ 529.621135] kobject: 'loop5' (00000000517e4172): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 529.625227] kobject: 'kvm' (00000000047262d7): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 529.646259] RBP: ffff8880934af460 R08: ffff88805d23a3c0 R09: ffff88808fb56568 [ 529.651405] kobject: 'loop2' (0000000029655d7f): kobject_uevent_env [ 529.653776] R10: ffffed1011f6acac R11: ffff88808fb56560 R12: 1ffff11012695e7b [ 529.664450] kobject: 'loop2' (0000000029655d7f): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 529.670244] R13: ffff88809fd7d7c0 R14: ffff8880934af438 R15: dffffc0000000000 [ 529.686468] kobject: 'kvm' (00000000047262d7): kobject_uevent_env [ 529.695167] kobject: 'kvm' (00000000047262d7): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 529.696777] kobject: 'loop5' (00000000517e4172): kobject_uevent_env [ 529.706385] FS: 00007f77feb2d700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 529.718027] kobject: 'loop5' (00000000517e4172): fill_kobj_path: path = '/devices/virtual/block/loop5' 05:51:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000580)=0xffffffffffffffff) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000006cc0)) 05:51:37 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) listen(r0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0xffffffffffffff4b, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) recvfrom$inet6(r1, &(0x7f00000001c0)=""/31, 0xfffffffffffffe3c, 0x100, &(0x7f0000001880), 0x17c) socketpair(0x0, 0x0, 0x0, 0x0) getsockopt$bt_sco_SCO_OPTIONS(0xffffffffffffffff, 0x11, 0x1, 0x0, 0x0) getsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFMTU(0xffffffffffffffff, 0x8921, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='lp\x00', 0x3) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) shutdown(r1, 0x1) r2 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r2, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") [ 529.734353] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 529.748496] CR2: 000000000073c000 CR3: 000000009d785000 CR4: 00000000001426e0 [ 529.757021] kobject: 'loop5' (00000000517e4172): kobject_uevent_env [ 529.769382] Kernel panic - not syncing: Fatal exception [ 529.775483] Kernel Offset: disabled [ 529.779108] Rebooting in 86400 seconds..