program: timer_create(0x3, 0x0, &(0x7f0000000280)=0x0) timer_settime(r0, 0x0, &(0x7f000006b000), 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x20}}, 0x0) r2 = socket(0x1e, 0x2, 0xfffffeff) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x38, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000580)={@in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, 0x0, 0x0, 0x42, 0x0, "bd1c790806ed6dcd18899f9ea77ca9fb5184ff0ba54b7dfe784d2f6b7dcd9474d9b295588ac0b991d5c66461eca3f1ff5543acc6c970d0ad22d692e84d692972368e64c272da633a217b45fcc8b1ff3b"}, 0xd8) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000340)=0x2, 0xa2) io_setup(0x3, &(0x7f0000000140)) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000540), 0x3c) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f000000e0c0), 0x10010) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000200)=@gcm_256={{0x304}, "00e0f07600", "832b4d2434b35bca8c0b78d2afff6d70d2025c7f53123828322d5af0d5c6c3a5", '`\a-N', "298f0e6df9ae9b3d"}, 0x38) ioctl$int_in(r5, 0x5421, &(0x7f0000000000)=0x3) sendfile(r5, r6, &(0x7f0000000100)=0x6, 0x100000000010001) close_range(r4, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtfilter={0x48, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0x5, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_CT_LABELS={0x14, 0x61, "cc4751af6e86592f024d38f66dbc1702"}]}}]}, 0x48}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) [ 69.135352][ T4662] Bluetooth: hci0: command tx timeout [ 69.264007][ C0] [ 69.264908][ C0] ============================= [ 69.266579][ C0] [ BUG: Invalid wait context ] [ 69.268285][ C0] 6.13.0-syzkaller-00918-g95ec54a420b8 #0 Not tainted [ 69.270755][ C0] ----------------------------- [ 69.272553][ C0] syz.0.0/5316 is trying to lock: [ 69.274534][ C0] ffff88805ffd7298 (&zone->lock){..-.}-{3:3}, at: get_page_from_freelist+0xb3d/0x37a0 [ 69.278160][ C0] other info that might help us debug this: [ 69.280272][ C0] context-{2:2} [ 69.281529][ C0] 3 locks held by syz.0.0/5316: [ 69.283256][ C0] #0: ffff88803f73c5d8 (sk_lock-AF_INET6){+.+.}-{0:0}, at: tls_setsockopt+0x244/0x1220 [ 69.286748][ C0] #1: ffffffff8f03dc30 ((crypto_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x53/0x90 [ 69.290547][ C0] #2: ffff88801fc44b18 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x7d3/0x37a0 [ 69.293893][ C0] stack backtrace: [ 69.295241][ C0] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted 6.13.0-syzkaller-00918-g95ec54a420b8 #0 [ 69.298772][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 69.302468][ C0] Call Trace: [ 69.303628][ C0] [ 69.304638][ C0] dump_stack_lvl+0x241/0x360 [ 69.306307][ C0] ? __pfx_dump_stack_lvl+0x10/0x10 [ 69.308171][ C0] ? __pfx__printk+0x10/0x10 [ 69.309768][ C0] ? try_to_wake_up+0x959/0x1470 [ 69.311476][ C0] __lock_acquire+0x15a8/0x2100 [ 69.313120][ C0] lock_acquire+0x1ed/0x550 [ 69.314689][ C0] ? get_page_from_freelist+0xb3d/0x37a0 [ 69.316673][ C0] ? __pfx_validate_chain+0x10/0x10 [ 69.318580][ C0] ? __pfx_lock_acquire+0x10/0x10 [ 69.320351][ C0] ? validate_chain+0x11e/0x5920 [ 69.322045][ C0] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 69.324163][ C0] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 69.326357][ C0] ? __pfx_validate_chain+0x10/0x10 [ 69.328152][ C0] _raw_spin_lock_irqsave+0xd5/0x120 [ 69.329955][ C0] ? get_page_from_freelist+0xb3d/0x37a0 [ 69.331972][ C0] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 69.334088][ C0] get_page_from_freelist+0xb3d/0x37a0 [ 69.335984][ C0] __alloc_pages_noprof+0x292/0x710 [ 69.337830][ C0] ? __pfx___alloc_pages_noprof+0x10/0x10 [ 69.339843][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 69.342132][ C0] ? __kernel_text_address+0xd/0x40 [ 69.344099][ C0] ? unwind_get_return_address+0x4d/0x90 [ 69.346111][ C0] alloc_pages_mpol_noprof+0x3e1/0x780 [ 69.348049][ C0] ? __pfx_alloc_pages_mpol_noprof+0x10/0x10 [ 69.350169][ C0] ? stack_trace_save+0x118/0x1d0 [ 69.351979][ C0] ? alloc_pages_noprof+0x43/0x170 [ 69.353843][ C0] stack_depot_save_flags+0x72d/0x940 [ 69.355884][ C0] kasan_save_stack+0x4f/0x60 [ 69.357657][ C0] ? kasan_save_stack+0x3f/0x60 [ 69.359431][ C0] ? __kasan_record_aux_stack+0xac/0xc0 [ 69.361450][ C0] ? task_work_add+0xd9/0x490 [ 69.363259][ C0] ? run_posix_cpu_timers+0x6ac/0x810 [ 69.365115][ C0] ? tick_nohz_handler+0x37c/0x500 [ 69.367044][ C0] ? __hrtimer_run_queues+0x551/0xd30 [ 69.369000][ C0] ? hrtimer_interrupt+0x403/0xa40 [ 69.370861][ C0] ? __sysvec_apic_timer_interrupt+0x110/0x420 [ 69.373041][ C0] ? sysvec_apic_timer_interrupt+0xa1/0xc0 [ 69.375210][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 69.377505][ C0] ? _raw_spin_unlock_irqrestore+0xd8/0x140 [ 69.379744][ C0] ? __rmqueue_pcplist+0x21fd/0x2a90 [ 69.381723][ C0] ? get_page_from_freelist+0x886/0x37a0 [ 69.383871][ C0] ? __alloc_pages_noprof+0x292/0x710 [ 69.385887][ C0] ? alloc_pages_mpol_noprof+0x3e1/0x780 [ 69.387962][ C0] ? stack_depot_save_flags+0x72d/0x940 [ 69.390009][ C0] ? kasan_save_track+0x51/0x80 [ 69.391892][ C0] ? __kasan_kmalloc+0x98/0xb0 [ 69.393650][ C0] ? __kmalloc_cache_noprof+0x243/0x390 [ 69.395757][ C0] ? cryptomgr_notify+0x84/0xb10 [ 69.397599][ C0] ? notifier_call_chain+0x1a5/0x3f0 [ 69.399429][ C0] ? blocking_notifier_call_chain+0x69/0x90 [ 69.401408][ C0] ? crypto_alg_mod_lookup+0x372/0x760 [ 69.403319][ C0] ? crypto_alloc_tfm_node+0x130/0x360 [ 69.405759][ C0] ? cryptd_alloc_aead+0xe2/0x200 [ 69.407628][ C0] ? simd_aead_init+0x67/0x150 [ 69.409376][ C0] ? crypto_create_tfm_node+0x167/0x3d0 [ 69.411427][ C0] ? crypto_alloc_tfm_node+0x161/0x360 [ 69.413344][ C0] ? tls_set_sw_offload+0xa37/0x13e0 [ 69.415326][ C0] ? tls_setsockopt+0xb3b/0x1220 [ 69.417096][ C0] ? do_sock_setsockopt+0x3af/0x720 [ 69.418974][ C0] ? __x64_sys_setsockopt+0x1ee/0x280 [ 69.420847][ C0] ? do_syscall_64+0xf3/0x230 [ 69.422565][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.424926][ C0] ? __phys_addr+0xba/0x170 [ 69.426633][ C0] __kasan_record_aux_stack+0xac/0xc0 [ 69.428474][ C0] task_work_add+0xd9/0x490 [ 69.430095][ C0] ? __pfx_lock_acquire+0x10/0x10 [ 69.431982][ C0] ? __pfx_task_work_add+0x10/0x10 [ 69.433757][ C0] run_posix_cpu_timers+0x6ac/0x810 [ 69.435421][ C0] ? __pfx_run_posix_cpu_timers+0x10/0x10 [ 69.437440][ C0] ? sched_balance_trigger+0x51/0x890 [ 69.439315][ C0] tick_nohz_handler+0x37c/0x500 [ 69.441219][ C0] ? __pfx_tick_nohz_handler+0x10/0x10 [ 69.443303][ C0] __hrtimer_run_queues+0x551/0xd30 [ 69.445092][ C0] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 69.447001][ C0] ? kvm_clock_get_cycles+0x52/0x70 [ 69.448919][ C0] ? ktime_get_update_offsets_now+0x38e/0x3b0 [ 69.451149][ C0] hrtimer_interrupt+0x403/0xa40 [ 69.452940][ C0] __sysvec_apic_timer_interrupt+0x110/0x420 [ 69.455094][ C0] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 69.457222][ C0] [ 69.458368][ C0] [ 69.459498][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 69.461691][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 [ 69.463955][ C0] Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 5e ef 34 f6 f6 44 24 21 02 75 52 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 23 97 9c f5 65 8b 05 44 d6 32 74 85 c0 74 43 48 c7 04 24 0e 36 [ 69.470867][ C0] RSP: 0018:ffffc9000d25ee80 EFLAGS: 00000206 [ 69.473118][ C0] RAX: 71bcd91cf8c35b00 RBX: 1ffff92001a4bdd4 RCX: ffffffff817b2e5a [ 69.475985][ C0] RDX: dffffc0000000000 RSI: ffffffff8c0a9960 RDI: 0000000000000001 [ 69.478905][ C0] RBP: ffffc9000d25ef18 R08: ffffffff942c2887 R09: 1ffffffff2858510 [ 69.481762][ C0] R10: dffffc0000000000 R11: fffffbfff2858511 R12: dffffc0000000000 [ 69.484719][ C0] R13: 1ffff92001a4bdd0 R14: ffffc9000d25eea0 R15: 0000000000000246 [ 69.487732][ C0] ? mark_lock+0x9a/0x360 [ 69.489399][ C0] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 69.491702][ C0] __rmqueue_pcplist+0x21fd/0x2a90 [ 69.493617][ C0] ? is_bpf_text_address+0x285/0x2a0 [ 69.495498][ C0] ? is_bpf_text_address+0x26/0x2a0 [ 69.497369][ C0] get_page_from_freelist+0x886/0x37a0 [ 69.499199][ C0] ? __pfx___might_resched+0x10/0x10 [ 69.500961][ C0] __alloc_pages_noprof+0x292/0x710 [ 69.502916][ C0] ? __pfx___alloc_pages_noprof+0x10/0x10 [ 69.505023][ C0] ? is_bpf_text_address+0x26/0x2a0 [ 69.506633][ C0] ? kernel_text_address+0xa7/0xe0 [ 69.508184][ C0] ? arch_stack_walk+0xfd/0x150 [ 69.509758][ C0] alloc_pages_mpol_noprof+0x3e1/0x780 [ 69.511689][ C0] ? __pfx_alloc_pages_mpol_noprof+0x10/0x10 [ 69.513995][ C0] ? stack_trace_save+0x118/0x1d0 [ 69.515884][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 69.517941][ C0] ? alloc_pages_noprof+0xef/0x170 [ 69.519843][ C0] stack_depot_save_flags+0x72d/0x940 [ 69.521754][ C0] ? mark_lock+0x9a/0x360 [ 69.523371][ C0] kasan_save_track+0x51/0x80 [ 69.525015][ C0] ? kasan_save_track+0x3f/0x80 [ 69.526815][ C0] ? __kasan_kmalloc+0x98/0xb0 [ 69.528666][ C0] ? __kmalloc_cache_noprof+0x243/0x390 [ 69.530693][ C0] ? cryptomgr_notify+0x84/0xb10 [ 69.532343][ C0] ? notifier_call_chain+0x1a5/0x3f0 [ 69.534176][ C0] ? blocking_notifier_call_chain+0x69/0x90 [ 69.536330][ C0] ? crypto_alg_mod_lookup+0x372/0x760 [ 69.538208][ C0] ? crypto_alloc_tfm_node+0x130/0x360 [ 69.540151][ C0] ? cryptd_alloc_aead+0xe2/0x200 [ 69.541984][ C0] ? simd_aead_init+0x67/0x150 [ 69.543786][ C0] ? crypto_create_tfm_node+0x167/0x3d0 [ 69.545644][ C0] ? crypto_alloc_tfm_node+0x161/0x360 [ 69.547568][ C0] ? tls_set_sw_offload+0xa37/0x13e0 [ 69.549325][ C0] ? tls_setsockopt+0xb3b/0x1220 [ 69.551184][ C0] ? do_sock_setsockopt+0x3af/0x720 [ 69.552985][ C0] ? __x64_sys_setsockopt+0x1ee/0x280 [ 69.554793][ C0] ? do_syscall_64+0xf3/0x230 [ 69.556231][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.558093][ C0] __kasan_kmalloc+0x98/0xb0 [ 69.559763][ C0] __kmalloc_cache_noprof+0x243/0x390 [ 69.561791][ C0] ? cryptomgr_notify+0x84/0xb10 [ 69.563747][ C0] cryptomgr_notify+0x84/0xb10 [ 69.565460][ C0] notifier_call_chain+0x1a5/0x3f0 [ 69.567412][ C0] blocking_notifier_call_chain+0x69/0x90 [ 69.569587][ C0] crypto_alg_mod_lookup+0x372/0x760 [ 69.571645][ C0] crypto_alloc_tfm_node+0x130/0x360 [ 69.573554][ C0] cryptd_alloc_aead+0xe2/0x200 [ 69.575375][ C0] ? __pfx_cryptd_alloc_aead+0x10/0x10 [ 69.577277][ C0] ? rcu_is_watching+0x15/0xb0 [ 69.579341][ C0] ? trace_kmalloc+0x1f/0xd0 [ 69.581201][ C0] simd_aead_init+0x67/0x150 [ 69.583133][ C0] crypto_create_tfm_node+0x167/0x3d0 [ 69.585118][ C0] crypto_alloc_tfm_node+0x161/0x360 [ 69.587096][ C0] ? tls_set_sw_offload+0x9d3/0x13e0 [ 69.589012][ C0] tls_set_sw_offload+0xa37/0x13e0 [ 69.590855][ C0] ? tls_set_device_offload+0x286/0xb30 [ 69.592865][ C0] tls_setsockopt+0xb3b/0x1220 [ 69.594894][ C0] ? __pfx_tls_setsockopt+0x10/0x10 [ 69.596883][ C0] ? __pfx_lock_acquire+0x10/0x10 [ 69.598786][ C0] ? aa_sock_opt_perm+0x79/0x120 [ 69.600708][ C0] ? sock_common_setsockopt+0x37/0xc0 [ 69.602761][ C0] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 69.605003][ C0] do_sock_setsockopt+0x3af/0x720 [ 69.606950][ C0] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 69.608971][ C0] ? __fget_files+0x395/0x410 [ 69.610822][ C0] ? __fget_files+0x2a/0x410 [ 69.612567][ C0] __x64_sys_setsockopt+0x1ee/0x280 [ 69.614560][ C0] do_syscall_64+0xf3/0x230 [ 69.616298][ C0] ? clear_bhb_loop+0x35/0x90 [ 69.618062][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 69.620283][ C0] RIP: 0033:0x7f61f5785d29 [ 69.621988][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 69.629004][ C0] RSP: 002b:00007f61f65b5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 69.632111][ C0] RAX: ffffffffffffffda RBX: 00007f61f5975fa0 RCX: 00007f61f5785d29 [ 69.635094][ C0] RDX: 0000000000000001 RSI: 000000000000011a RDI: 0000000000000006 [ 69.638073][ C0] RBP: 00007f61f5801b08 R08: 0000000000000038 R09: 0000000000000000 [ 69.641075][ C0] R10: 0000000020000200 R11: 0000000000000246 R12: 0000000000000000 [ 69.643997][ C0] R13: 0000000000000000 R14: 00007f61f5975fa0 R15: 00007fff68e19ca8 [ 69.647009][ C0]