program: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}, 0x1, 0x0, 0x0, 0x1}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b040000000000000000020000004c000480240001800b000100736f636b657400001400028008000240000000030800014000000002240001800b0001007470726f7879000014000280080001400000000208000340000000100900010073797a30000000000900020073797a320000000014000000110001"], 0xa0}}, 0x40880) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty, 0x3}, 0x1c) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000340)={@val={0x8, 0x800}, @val={0x0, 0x4, 0x6, 0x1, 0x2f, 0x40}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x28, 0x3d, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0x26}}, {0x4e26, 0x4e20, 0x29, 0x0, @gue={{0x1, 0x1, 0x1, 0x1, 0x100, @void}, "dd6f08c28a0dbd0ca68bba76be68c7afbdb2d2374e64474f7183566ef9"}}}}, 0x4b) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56561, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_NAT={0x8, 0xb, 0x1}]}}]}, 0x3c}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56561, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0x8}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x4}]}}]}, 0x3c}}, 0x0) r11 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r11, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) [ 99.676368][ T5329] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 99.686411][ T5329] 41834 total pagecache pages [ 99.692220][ T5329] 34 pages in swap cache [ 99.697077][ T5329] Free swap = 123812kB [ 99.706069][ T5329] Total swap = 124996kB [ 99.710413][ T5329] 393083 pages RAM [ 99.715167][ T5329] 0 pages HighMem/MovableOnly [ 99.720132][ T5329] 188566 pages reserved [ 99.721873][ T5329] 0 pages cma reserved [ 99.723550][ T5329] oom-kill:constraint=CONSTRAINT_MEMORY_POLICY,nodemask=0,cpuset=/,mems_allowed=0-1,global_oom,task_memcg=/,task=udevd,pid=5336,uid=0 [ 99.730366][ T5329] Out of memory: Killed process 5336 (udevd) total-vm:21672kB, anon-rss:3244kB, file-rss:1288kB, shmem-rss:0kB, UID:0 pgtables:52kB oom_score_adj:0 [ 99.758641][ T4702] udevd[4702]: worker [5336] terminated by signal 9 (Killed) [ 99.773790][ T5329] Out of memory: Killed process 4684 (syslogd) total-vm:4044kB, anon-rss:48kB, file-rss:724kB, shmem-rss:0kB, UID:0 pgtables:48kB oom_score_adj:0 [ 99.804296][ T5329] Out of memory: Killed process 4982 (dbus-daemon) total-vm:4752kB, anon-rss:220kB, file-rss:436kB, shmem-rss:0kB, UID:100 pgtables:44kB oom_score_adj:0 [ 99.845780][ T5329] Out of memory: Killed process 5090 (getty) total-vm:4044kB, anon-rss:184kB, file-rss:20kB, shmem-rss:0kB, UID:0 pgtables:48kB oom_score_adj:0 [ 99.876502][ T5329] Out of memory: Killed process 5080 (crond) total-vm:4044kB, anon-rss:180kB, file-rss:24kB, shmem-rss:0kB, UID:0 pgtables:44kB oom_score_adj:0 [ 99.904717][ T5329] Out of memory: Killed process 4687 (acpid) total-vm:2520kB, anon-rss:0kB, file-rss:12kB, shmem-rss:0kB, UID:0 pgtables:48kB oom_score_adj:0 [ 99.935987][ T5329] syz.0.0 invoked oom-killer: gfp_mask=0x2cc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN), order=0, oom_score_adj=1000 [ 99.943953][ T41] team0 (unregistering): Port device team_slave_1 removed [ 99.947722][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 99.947740][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 99.947746][ T5329] Call Trace: [ 99.947752][ T5329] [ 99.947758][ T5329] dump_stack_lvl+0xe8/0x150 [ 99.947784][ T5329] dump_header+0xd3/0x4b0 [ 99.947800][ T5329] out_of_memory+0x10d4/0x1480 [ 99.947827][ T5329] ? __pfx_out_of_memory+0x10/0x10 [ 99.947850][ T5329] __alloc_pages_may_oom+0x1ea/0x330 [ 99.947866][ T5329] ? __pfx___alloc_pages_may_oom+0x10/0x10 [ 99.947889][ T5329] __alloc_pages_slowpath+0x6e8/0xcc0 [ 99.947913][ T5329] __alloc_frozen_pages_noprof+0x31f/0x380 [ 99.947928][ T5329] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 99.947943][ T5329] ? wake_all_kswapds+0x1e9/0x280 [ 99.947960][ T5329] __alloc_pages_noprof+0x10/0x100 [ 99.947975][ T5329] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 99.947998][ T5329] alloc_pages_bulk_mempolicy_noprof+0x34b/0x1690 [ 99.948047][ T5329] ? __pfx_policy_nodemask+0x10/0x10 [ 99.948066][ T5329] ? __split_page_owner+0x2c/0x330 [ 99.948083][ T5329] ? __pfx_alloc_pages_bulk_mempolicy_noprof+0x10/0x10 [ 99.948106][ T5329] __vmalloc_node_range_noprof+0xb1d/0x1730 [ 99.948136][ T5329] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 99.948150][ T5329] ? __mutex_unlock_slowpath+0x731/0x900 [ 99.948169][ T5329] ? snd_dma_alloc_dir_pages+0x120/0x220 [ 99.948186][ T5329] vmalloc_noprof+0xb2/0xe0 [ 99.948198][ T5329] ? snd_dma_alloc_dir_pages+0x120/0x220 [ 99.948217][ T5329] snd_dma_alloc_dir_pages+0x120/0x220 [ 99.948236][ T5329] do_alloc_pages+0x11c/0x260 [ 99.948256][ T5329] snd_pcm_lib_malloc_pages+0x33a/0x780 [ 99.948278][ T5329] snd_pcm_hw_params+0x870/0x1d50 [ 99.948295][ T5329] ? do_raw_spin_lock+0x12b/0x2f0 [ 99.948312][ T5329] ? __pfx_snd_pcm_hw_params+0x10/0x10 [ 99.948326][ T5329] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 99.948347][ T5329] ? snd_pcm_kernel_ioctl+0x336/0xa70 [ 99.948362][ T5329] snd_pcm_oss_change_params_locked+0x1e90/0x3c80 [ 99.948394][ T5329] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 99.948412][ T5329] ? __pfx_ima_file_free+0x10/0x10 [ 99.948426][ T5329] ? __asan_memset+0x22/0x50 [ 99.948449][ T5329] snd_pcm_oss_sync+0x43e/0xdf0 [ 99.948500][ T5329] snd_pcm_oss_release+0xff/0x250 [ 99.948518][ T5329] ? __pfx_snd_pcm_oss_release+0x10/0x10 [ 99.948532][ T5329] __fput+0x418/0xa50 [ 99.948551][ T5329] task_work_run+0x1d9/0x270 [ 99.948564][ T5329] ? __pfx_task_work_run+0x10/0x10 [ 99.948576][ T5329] ? do_raw_spin_unlock+0x4d/0x210 [ 99.948595][ T5329] do_exit+0x73a/0x2360 [ 99.948612][ T5329] ? __kasan_slab_free+0x5c/0x80 [ 99.948625][ T5329] ? kmem_cache_free+0x182/0x650 [ 99.948639][ T5329] ? do_syscall_64+0x174/0x580 [ 99.948655][ T5329] ? __pfx_do_exit+0x10/0x10 [ 99.948684][ T5329] ? do_raw_spin_lock+0x12b/0x2f0 [ 99.948702][ T5329] do_group_exit+0x22d/0x2f0 [ 99.948713][ T5329] ? _raw_spin_unlock_irq+0x23/0x50 [ 99.948733][ T5329] get_signal+0x121b/0x12c0 [ 99.948759][ T5329] arch_do_signal_or_restart+0xbb/0x860 [ 99.948779][ T5329] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 99.948793][ T5329] ? do_sys_openat2+0x14e/0x200 [ 99.948819][ T5329] exit_to_user_mode_loop+0x104/0x730 [ 99.948835][ T5329] ? rcu_is_watching+0x15/0xb0 [ 99.948850][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.948863][ T5329] do_syscall_64+0x353/0x580 [ 99.948876][ T5329] ? trace_irq_disable+0x3b/0x140 [ 99.948893][ T5329] ? clear_bhb_loop+0x40/0x90 [ 99.948906][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.948919][ T5329] RIP: 0033:0x7f05d0b9de99 [ 99.948931][ T5329] Code: Unable to access opcode bytes at 0x7f05d0b9de6f. [ 99.948936][ T5329] RSP: 002b:00007f05d1b20fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 99.948948][ T5329] RAX: fffffffffffffff0 RBX: 00007f05d0e26090 RCX: 00007f05d0b9de99 [ 99.948955][ T5329] RDX: 0000000000000000 RSI: 0000200000000300 RDI: ffffffffffffff9c [ 99.948961][ T5329] RBP: 00007f05d0c33eaf R08: 0000000000000000 R09: 0000000000000000 [ 99.948967][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 99.948973][ T5329] R13: 00007f05d0e26128 R14: 00007f05d0e26090 R15: 00007fff82769778 [ 99.948991][ T5329] [ 100.120933][ T5329] Mem-Info: [ 100.122590][ T5329] active_anon:1529 inactive_anon:19 isolated_anon:0 [ 100.122590][ T5329] active_file:0 inactive_file:39623 isolated_file:0 [ 100.122590][ T5329] unevictable:1768 dirty:0 writeback:0 [ 100.122590][ T5329] slab_reclaimable:6765 slab_unreclaimable:29609 [ 100.122590][ T5329] mapped:1042 shmem:2177 pagetables:300 [ 100.122590][ T5329] sec_pagetables:291 bounce:0 [ 100.122590][ T5329] kernel_misc_reclaimable:0 [ 100.122590][ T5329] free:52239 free_pcp:1138 free_cma:0 [ 100.141879][ T5329] Node 0 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:916kB isolated(anon):0kB isolated(file):0kB mapped:16kB dirty:0kB writeback:0kB shmem:916kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:2112kB pagetables:512kB sec_pagetables:1084kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 100.155185][ T5329] Node 0 DMA free:1484kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 100.167762][ T5329] lowmem_reserve[]: 0 109 109 109 109 [ 100.170480][ T5329] Node 0 DMA32 free:6624kB boost:4096kB min:8228kB low:9260kB high:10292kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:916kB writepending:0kB zspages:0kB present:770052kB managed:111896kB mlocked:0kB bounce:0kB free_pcp:4552kB local_pcp:4552kB free_cma:0kB [ 100.183855][ T5329] lowmem_reserve[]: 0 0 0 0 0 [ 100.185909][ T5329] Node 0 DMA: 25*4kB (U) 3*8kB (U) 3*16kB (U) 7*32kB (U) 3*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 1484kB [ 100.192233][ T5329] Node 0 DMA32: 68*4kB (UM) 46*8kB (UME) 30*16kB (UME) 28*32kB (UME) 12*64kB (UM) 6*128kB (UME) 2*256kB (U) 3*512kB (UME) 1*1024kB (U) 0*2048kB 0*4096kB = 6624kB [ 100.200766][ T5329] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 100.204754][ T5329] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 100.208976][ T5329] 41825 total pagecache pages [ 100.211279][ T5329] 25 pages in swap cache [ 100.213297][ T5329] Free swap = 124132kB [ 100.215149][ T5329] Total swap = 124996kB [ 100.216987][ T5329] 393083 pages RAM [ 100.218795][ T5329] 0 pages HighMem/MovableOnly [ 100.221495][ T5329] 188566 pages reserved [ 100.223649][ T5329] 0 pages cma reserved [ 100.225464][ T5329] Out of memory and no killable processes... [ 100.228195][ T5329] Kernel panic - not syncing: System is deadlocked on memory [ 100.231183][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 100.234675][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 100.238922][ T5329] Call Trace: [ 100.240290][ T5329] [ 100.241556][ T5329] vpanic+0x56c/0xa60 [ 100.243097][ T5329] ? __pfx_vprintk_emit+0x10/0x10 [ 100.245127][ T5329] ? __pfx_vpanic+0x10/0x10 [ 100.246944][ T5329] panic+0xc5/0xd0 [ 100.248384][ T5329] ? __pfx_panic+0x10/0x10 [ 100.250126][ T5329] ? dump_header+0x140/0x4b0 [ 100.252071][ T5329] out_of_memory+0x13e5/0x1480 [ 100.254044][ T5329] ? __pfx_out_of_memory+0x10/0x10 [ 100.256204][ T5329] __alloc_pages_may_oom+0x1ea/0x330 [ 100.258408][ T5329] ? __pfx___alloc_pages_may_oom+0x10/0x10 [ 100.260776][ T5329] __alloc_pages_slowpath+0x6e8/0xcc0 [ 100.262950][ T5329] __alloc_frozen_pages_noprof+0x31f/0x380 [ 100.265389][ T5329] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 100.268223][ T5329] ? wake_all_kswapds+0x1e9/0x280 [ 100.270435][ T5329] __alloc_pages_noprof+0x10/0x100 [ 100.272641][ T5329] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 100.274979][ T5329] alloc_pages_bulk_mempolicy_noprof+0x34b/0x1690 [ 100.277551][ T5329] ? __pfx_policy_nodemask+0x10/0x10 [ 100.279757][ T5329] ? __split_page_owner+0x2c/0x330 [ 100.282021][ T5329] ? __pfx_alloc_pages_bulk_mempolicy_noprof+0x10/0x10 [ 100.284801][ T5329] __vmalloc_node_range_noprof+0xb1d/0x1730 [ 100.287235][ T5329] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 100.289718][ T5329] ? __mutex_unlock_slowpath+0x731/0x900 [ 100.292001][ T5329] ? snd_dma_alloc_dir_pages+0x120/0x220 [ 100.294312][ T5329] vmalloc_noprof+0xb2/0xe0 [ 100.296169][ T5329] ? snd_dma_alloc_dir_pages+0x120/0x220 [ 100.298468][ T5329] snd_dma_alloc_dir_pages+0x120/0x220 [ 100.300711][ T5329] do_alloc_pages+0x11c/0x260 [ 100.302625][ T5329] snd_pcm_lib_malloc_pages+0x33a/0x780 [ 100.304874][ T5329] snd_pcm_hw_params+0x870/0x1d50 [ 100.307003][ T5329] ? do_raw_spin_lock+0x12b/0x2f0 [ 100.309089][ T5329] ? __pfx_snd_pcm_hw_params+0x10/0x10 [ 100.311234][ T5329] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 100.313575][ T5329] ? snd_pcm_kernel_ioctl+0x336/0xa70 [ 100.315638][ T5329] snd_pcm_oss_change_params_locked+0x1e90/0x3c80 [ 100.318202][ T5329] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 100.320971][ T5329] ? __pfx_ima_file_free+0x10/0x10 [ 100.323124][ T5329] ? __asan_memset+0x22/0x50 [ 100.325091][ T5329] snd_pcm_oss_sync+0x43e/0xdf0 [ 100.327137][ T5329] snd_pcm_oss_release+0xff/0x250 [ 100.329259][ T5329] ? __pfx_snd_pcm_oss_release+0x10/0x10 [ 100.331585][ T5329] __fput+0x418/0xa50 [ 100.333338][ T5329] task_work_run+0x1d9/0x270 [ 100.335342][ T5329] ? __pfx_task_work_run+0x10/0x10 [ 100.337509][ T5329] ? do_raw_spin_unlock+0x4d/0x210 [ 100.339658][ T5329] do_exit+0x73a/0x2360 [ 100.341503][ T5329] ? __kasan_slab_free+0x5c/0x80 [ 100.343429][ T5329] ? kmem_cache_free+0x182/0x650 [ 100.345446][ T5329] ? do_syscall_64+0x174/0x580 [ 100.347427][ T5329] ? __pfx_do_exit+0x10/0x10 [ 100.349291][ T5329] ? do_raw_spin_lock+0x12b/0x2f0 [ 100.351464][ T5329] do_group_exit+0x22d/0x2f0 [ 100.353399][ T5329] ? _raw_spin_unlock_irq+0x23/0x50 [ 100.355346][ T5329] get_signal+0x121b/0x12c0 [ 100.357089][ T5329] arch_do_signal_or_restart+0xbb/0x860 [ 100.359263][ T5329] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 100.361590][ T5329] ? do_sys_openat2+0x14e/0x200 [ 100.363466][ T5329] exit_to_user_mode_loop+0x104/0x730 [ 100.365727][ T5329] ? rcu_is_watching+0x15/0xb0 [ 100.367800][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.370444][ T5329] do_syscall_64+0x353/0x580 [ 100.372335][ T5329] ? trace_irq_disable+0x3b/0x140 [ 100.374461][ T5329] ? clear_bhb_loop+0x40/0x90 [ 100.376533][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.379164][ T5329] RIP: 0033:0x7f05d0b9de99 [ 100.381096][ T5329] Code: Unable to access opcode bytes at 0x7f05d0b9de6f. [ 100.384052][ T5329] RSP: 002b:00007f05d1b20fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 100.387588][ T5329] RAX: fffffffffffffff0 RBX: 00007f05d0e26090 RCX: 00007f05d0b9de99 [ 100.390946][ T5329] RDX: 0000000000000000 RSI: 0000200000000300 RDI: ffffffffffffff9c [ 100.393971][ T5329] RBP: 00007f05d0c33eaf R08: 0000000000000000 R09: 0000000000000000 [ 100.396893][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 100.399765][ T5329] R13: 00007f05d0e26128 R14: 00007f05d0e26090 R15: 00007fff82769778 [ 100.402596][ T5329] [ 100.404259][ T5329] Kernel Offset: disabled [ 100.406076][ T5329] Rebooting in 86400 seconds.. [ 94.398171][ T4652] Bluetooth: hci0: command tx timeout [ 94.542440][ T5328] syz.0.0 uses obsolete (PF_INET,SOCK_PACKET)