program: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x9, 0x0, 0x7fff0000}]}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000780)=ANY=[@ANYBLOB="f0000000100001000000000000002000fe8000f2ffffff000000000000000029ac1e000100000000000000000000000000000000000000000000000032000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0100000000000000000000000000000000000032000000ac1414aa000000000000000000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff00000000feffffff00020000000000080a00"/168], 0xf0}}, 0x0) syz_emit_vhci(&(0x7f0000000880)=ANY=[@ANYBLOB="040e07050220"], 0xa) syz_emit_vhci(&(0x7f00000008c0)=ANY=[@ANYBLOB="043e1301"], 0x16) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) openat$dm_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = memfd_create(&(0x7f0000000340)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaaSc\xf3]WhI\xf4\x89\x85!mPl\x90\xa5\x93\x19\f\x9a\xae\xd5a\x9bU5\x1a\x86\x9d)5y\xef\x90\xea5\x81\xfeO;\xd4zh?\x00\x00\x00\x00\xe6\x9d\xcb\xcd\xb6\xad3\x7fWY\x02\xa2\x8baG\x00\x0e\x8e/\xc1\xaf\xd0\xbcH9\x04\x00\x00\x00z\x16\xdf\xf3hLpLaA\x89n]>,^M\x82\x8e\xe40\x97_\x809y)Z\xeb\x9d\xbawv\x02\xc1\x16\xdc\xf5\xcb\xdb\x96\xd6\xba@\xa7\x1bl\xca\xe0\x1e3\x81\xc6S\x86\xf7\xf0\xba\x1b\x14N\xa2\x04\xdb\xd5r\x11\xfb\xe4v\xef\x06\xbb\x00\x96CR\xe0~5\x16=:A2\x9c\b\xd9\xa0CB\r\xe9\xb8$\xfe\x8d\xb1Gg\xa9\xac<\xbf\x10]\b9\x03\x00\x00\x00\xd1\x10\x1fq\xba\x06_NW\xdb67Xv(\xa8\xce\x1b\xe6\xbd\x947\x8f)8\xe5\xb3\xac;\x7f+\xf67\xea\x1ei\x92w-)\xa1\xa1\xcc!\x16\xfc\x92oB/M\x0e7:9\xdb~V\xb7\xd5\x13^v\x14\xe6O\xea\x00\x87\x8dkG\xdf%\xebe\x83\xb97\x01| \xb3\xd8W\xe8o\x17\x97\xd9\x14o\x92\xb9\x9a\x8c\xd7\xcf\xa2\x11\xc3\xa5\xb3\xcf\xdeQ\xa7\x05\x7f\x99Lq(\xcd\\\xa2y\x14or\x1efn\x01\x98\x96c\xda7\t,\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x95\xf7F\vDlW{\xe3\x8f\x8e\xcf\xd3}m\x03z\xf1\x85\xd9\xbaM\xb2\nO\xdfRE\x10\xc4\xe85\xf7\x81\xbe\xb8#~N\xc7\xc8\xb8\xd2\x8bu\x9f(\xa5CC|\xff\x7f\xfcT\x97\x80H\xcbeh&\x03\xb5D\xaaFV(\xad\x84-\x970\xcau;6\xe5\xf9\xd6\xad\x05\xd9\b\x14\xd6|\xc6\xba\xf3\xb9\x00\x83\x8a\x80w\xc7\"\x03\xb8\xb7\'\x02l\xc0\xdd\xa7^\x00\xd5:\xc4\xa5\xf2*e\xe1\x92\xd2a\xe8\xf9<\x92,\xb2\bZ\xaa\xdf\xcfS\b\xe5\xcb,\xf3y\x14!\xbd\fo\xc2\x1d\x95\x8f\xef\xe2@M\x1b\xa90\xfe\xcc\xb2c\xa7X\xc9\xd7j\n\xe0X*!\xc8\b\x01\x82\x1c\xf0\x0f\x8a\x03\xa7P\xd2B\xc9^O_T?R\xa1.\x99\xd9\x16~\ah\xf2\x8a\xe6\'\x85\\\x92\x02\xca\xca\x93\x10\xfd\x04\xa1<\x1aZ\xccq\xb3\x8f\x8a\r\x97\xfd\xee\x8fx\xdaA\x84\xd7\xb7\x8d\xe7x\x00\xb1Z\xfa\xd3;v\xfd\x8a\x1d\xc9\x01\\\xe5x\x90\x8d\xf2\xe1\xb8W\x95\xb8\xa5\xaf\xd2\x8d\xa8\x1c[(\x84\xb2?\xf2\x10\xa5\x8a\xbd\xa2qziX\x91\xc3\xc6\x8d\x9f\xaf\x89$:\n\xe3\xacB\xdcx\x13\xf7\xac\x87kz\xb4\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xd) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x6, 0x0, 0x111, 0x1}}, 0x20) ftruncate(r1, 0x1000000) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r1, 0x660c) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000680)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f00000006c0)={0x48, 0x2, r3}) ioctl(r2, 0x3b8f, &(0x7f0000000740)="2800000006000000010000000400000000081f00000000000010") r4 = openat$dm_control(0xffffffffffffff9c, &(0x7f00000010c0), 0x2, 0x0) ioctl$DM_DEV_CREATE(r4, 0xc138fd03, &(0x7f0000001100)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x88001, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TABLE_LOAD(r4, 0xc138fd09, &(0x7f0000000180)={0x4, 0x0, 0x0, 0x190, 0x138, 0x1, 0x0, 0x0, 0x0, 0x0, @by_dev={r5}, [@snapshot={0x0, 0x1008, 0x0, 0x58, 'snapshot\x00', {@ram={'/dev/ram', 0x1}, 0x20, @ram={'/dev/ram', 0x0}, 0x20, 'P', 0x20, '256', ' 1 discard_zeroes_cow'}}]}) ioctl$DM_TABLE_LOAD(r4, 0xc138fd09, &(0x7f0000001540)={0x4, 0x0, 0x0, 0x1c8, 0x138, 0x1, 0x0, 0xda01, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@mirror={0x0, 0x2888, 0x0, 0x90, 'mirror\x00', {'core 2 1024 sync', 0x20, 0x2, [{0x20, {@ram={'/dev/ram', 0x0}, 0x20, '16'}}, {0x20, {@ram_num={'1:', 0x0}, 0x20, '8'}}], ' 2 handle_errors keep_log'}}]}) [ 93.547025][ T4668] Bluetooth: hci0: command tx timeout [ 93.570672][ T10] cfg80211: failed to load regulatory.db [ 93.788482][ T5350] iommufd_mock iommufd_mock0: Adding to iommu group 11 [ 94.040714][ T5350] Oops: divide error: 0000 [#1] SMP KASAN NOPTI [ 94.044559][ T5350] CPU: 0 UID: 0 PID: 5350 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.048920][ T5350] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.069140][ T5350] RIP: 0010:blk_stack_limits+0x1105/0x2d00 [ 94.072396][ T5350] Code: 68 48 4c 89 e8 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 7c 18 00 00 45 8b 65 00 c7 44 24 10 00 00 00 00 eb 5f 48 8b 44 24 48 31 d2 <41> f7 f5 44 01 e9 29 d1 89 c8 31 d2 41 f7 f5 48 8b 44 24 08 4c 8d [ 94.095748][ T5350] RSP: 0018:ffffc90000eef4f8 EFLAGS: 00010246 [ 94.099480][ T5350] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 94.103156][ T5350] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 94.107499][ T5350] RBP: ffffc90000eef850 R08: ffffc90000eef7e0 R09: 1ffffffff3807ab0 [ 94.112830][ T5350] R10: dffffc0000000000 R11: ffffffff88b0dcd0 R12: 00000000ffffffff [ 94.118751][ T5350] R13: 0000000000000000 R14: 1ffff920001ddf0a R15: ffffc90000eef854 [ 94.123807][ T5350] FS: 00007f458fe236c0(0000) GS:ffff88808ac1d000(0000) knlGS:0000000000000000 [ 94.127449][ T5350] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.130222][ T5350] CR2: 0000563f99d96e60 CR3: 0000000014318000 CR4: 0000000000352ef0 [ 94.134718][ T5350] Call Trace: [ 94.136770][ T5350] [ 94.138701][ T5350] dm_calculate_queue_limits+0x70c/0x1510 [ 94.142315][ T5350] ? __pfx_dm_calculate_queue_limits+0x10/0x10 [ 94.146054][ T5350] ? kmem_cache_alloc_noprof+0x151/0x600 [ 94.149591][ T5350] ? kasan_save_free_info+0x40/0x50 [ 94.153234][ T5350] ? __kasan_mempool_poison_object+0x16e/0x1d0 [ 94.157562][ T5350] ? mempool_init_node+0x474/0x510 [ 94.162955][ T5350] ? __pfx_bioset_init+0x10/0x10 [ 94.165464][ T5350] dm_setup_md_queue+0x199/0x4f0 [ 94.167556][ T5350] ? dm_table_complete+0x1d84/0x22d0 [ 94.169839][ T5350] ? __pfx_dm_setup_md_queue+0x10/0x10 [ 94.172126][ T5350] ? __pfx_dm_table_complete+0x10/0x10 [ 94.174762][ T5350] table_load+0x4fd/0x8a0 [ 94.177359][ T5350] ? __pfx_table_load+0x10/0x10 [ 94.181997][ T5350] dm_ctl_ioctl+0x9ec/0xe10 [ 94.184678][ T5350] ? __pfx_table_load+0x10/0x10 [ 94.187891][ T5350] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 94.191088][ T5350] ? __fget_files+0x2a/0x420 [ 94.193965][ T5350] ? bpf_lsm_file_ioctl+0x9/0x20 [ 94.196913][ T5350] ? __pfx_dm_ctl_ioctl+0x10/0x10 [ 94.199965][ T5350] __se_sys_ioctl+0xfc/0x170 [ 94.202743][ T5350] do_syscall_64+0x166/0x520 [ 94.205680][ T5350] ? trace_irq_disable+0x3b/0x140 [ 94.208936][ T5350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.212948][ T5350] ? clear_bhb_loop+0x70/0xc0 [ 94.216350][ T5350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.220842][ T5350] RIP: 0033:0x7f458ef9f559 [ 94.223958][ T5350] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.236557][ T5350] RSP: 002b:00007f458fe22fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 94.241797][ T5350] RAX: ffffffffffffffda RBX: 00007f458f225fa0 RCX: 00007f458ef9f559 [ 94.246695][ T5350] RDX: 0000200000000180 RSI: 00000000c138fd09 RDI: 0000000000000007 [ 94.251583][ T5350] RBP: 00007f458f036b20 R08: 0000000000000000 R09: 0000000000000000 [ 94.257709][ T5350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.262522][ T5350] R13: 00007f458f226038 R14: 00007f458f225fa0 R15: 00007ffe72123c18 [ 94.267253][ T5350] [ 94.269126][ T5350] Modules linked in: [ 94.272083][ T5350] ---[ end trace 0000000000000000 ]--- [ 94.320482][ T5350] RIP: 0010:blk_stack_limits+0x1105/0x2d00 [ 94.320508][ T5350] Code: 68 48 4c 89 e8 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 7c 18 00 00 45 8b 65 00 c7 44 24 10 00 00 00 00 eb 5f 48 8b 44 24 48 31 d2 <41> f7 f5 44 01 e9 29 d1 89 c8 31 d2 41 f7 f5 48 8b 44 24 08 4c 8d [ 94.320519][ T5350] RSP: 0018:ffffc90000eef4f8 EFLAGS: 00010246 [ 94.320531][ T5350] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000 [ 94.320539][ T5350] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000 [ 94.320545][ T5350] RBP: ffffc90000eef850 R08: ffffc90000eef7e0 R09: 1ffffffff3807ab0 [ 94.320554][ T5350] R10: dffffc0000000000 R11: ffffffff88b0dcd0 R12: 00000000ffffffff [ 94.320561][ T5350] R13: 0000000000000000 R14: 1ffff920001ddf0a R15: ffffc90000eef854 [ 94.320569][ T5350] FS: 00007f458fe236c0(0000) GS:ffff88808ac1d000(0000) knlGS:0000000000000000 [ 94.320657][ T5350] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.320667][ T5350] CR2: 00007f234c842ad8 CR3: 0000000014318000 CR4: 0000000000352ef0 [ 94.322805][ T5350] Kernel panic - not syncing: Fatal exception [ 94.470876][ T5350] Kernel Offset: disabled [ 94.472848][ T5350] Rebooting in 86400 seconds..