program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), r0) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x3c, r1, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) (async) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000600), r0) sendmsg$SMC_PNETID_FLUSH(r0, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x1000018}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x60, r3, 0x200, 0x70bd29, 0x25dfdbfe, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000081}, 0x4000004) (async) syz_mount_image$udf(&(0x7f0000000f00), &(0x7f0000000f40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xa00010, &(0x7f0000000000)=ANY=[@ANYBLOB='iocharset=iso8859-1,nostrict,uid=forget,anchor=00000000000000000145,gid=', @ANYRESDEC=0x0, @ANYBLOB="2c646d6f64653d30303030303030303030303030303030303030303030312c756e64656c6574652c706172746974696f6e3d30303030303030303030303030303030303030312c756e686964652c00f320a479804437529f4233"], 0x1, 0xc47, &(0x7f0000001040)="$eJzs3U9sHNd9B/DfGy3FldxWTOwqThoHm7ZIZcVy9S+mYhXuqqbZBpBlIhRzC8CVSKkLUyRBUo1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9vCRlD0wBYBAhQIGMzsW3FJkTYtkhKlfD4G9Z2deW/mvZn1jCTozQsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIOL3Xrl0+kzaYsOhh9AYAOCBuDL65dNnt3r+AwCPravb/fkfAAAAAAAAAAAAAAA4KFIU8WSkmL2ymsarzx31y+2+23fGhoa3rnYkVTUPVeXLn/qZs+fOf+GFwQvdvNye/oD6e+1T8dro1UuNl2duzc5Nzs9PTjTGptvXZyYmd7yH3dbf7GR1Ahq3Xr89cePGfOPs8+c2bL4z8H7/E8cHLg4+e+qZbtmxoeHh0fUi9d7ytftuSMd2IzwORxGnIsVz3/lxakVEEbs/F/UHe+03O1J14mTVibGh4aojU+3W9EK5caR7IoqIRk+lZvccbX0totb3QPuwvWbEYtn8ssEny+6NzrbmWtemJhsjrbmF9kJ7ZnokdVpb9qcRRVxIEUsRsdJ/7+76oohapPjWsdV0Lb/1ozoPn68GBm/fjmIf+7gDZTsbfRFLxSNwzQ6w/iji1Ujxk3dOxPV8n6nuNZ+LeLXM70W8VeZLEan8YpyPeG+L7xGPploU8efl9b+4miaq+0H3vnL5K40vTd+Y6Snbva98xOfDPXeKh/R8OLIpH4wDfm+qRxGt6o6/mu7/NzsAAAAAAAAAAAAAAAAA7LUjUcQnI8Ur//ZH1bjiqMalH7s4+PsDv9w7ZvzpD9lPWfb5iFgsdjYm93AeGDiSRlJ6yGOJf5HVo4g/zuP/vvGwGwMAAAAAAAAAAAAAAAAAAPALrYgfRYoX3z2RlqJ3TvH29M3G1da1qc6ssN25f7tzpq+tra01UiebOcdzLuZcyrmccyVnFLl+zmbO8ZyLOZdyLudcyRmHcv2czZzjORdzLuVczrmSM2q5fs5mzvGcizmXci7nXMkZB2TuXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAx0kRRfwsUnzza6spUkQ0I8ajk8v9D7t1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAECpPxXx3UjR+IPm3XW1iP7eMifKX85H83CZH4/mYJkvRfNSzlaVteY3HnDb2b2+VMQPI0V//e1IeV0tolzu63xKd8u+9fX1T5+qdfJQd+PA+/1PHD92cXD4M09vt5y2asDJy+3p23caY0PDw6M9q2v56B/vWTeQj1vsTdeJiPk33ny9NTU1OXf/C+VXYBfVH6GFVNttT//jWMTD7oWFHS9E7UA04+H0fYP6w7pBsa/K5/97keK33/337gO/8/yvxy91Pt19wsdP/2T9+f/i5h3t8Plf21wvP//LZ/pWz/8ne9a9mH830leLqC/cmu07HlGff+PNU+1brZuTNyenz58+/cXBwS+eO913OKJ+oz012bO0J6cLAAAAAAAAAAAAAAAA4MFJRfxupGj9cDU1IuJONV5r4OLgs6eeORSHqvFWG8ZtvzZ69VLj5Zlbs3OT8/OTE42x6fb1mYnJnR6uXg33Ghsa3pfOfKgj+9z+I/WXZ2bfmGvf/MOFLbcfrV+6Nr8w17q+9eY4EkVEs3fNyarBY0PDVaOn2q3pqurIloPpP7q+VMR/Rorr5xvps3ldHv+/eYT/hvH/i5t3tIfj/z9zdH3838d6ipbHTKmIn0aK3/qLp+OzVTuPxj3nLJf7m0hx8sKnc7k4XJbrtqHzXoHOyMCy7P9Gin/42cay3fGQT66XPfORTu4joLz+xyLFd//s2/Hred3G9z9sff2Pbt7RPr3/4amedUc3vK9g110nX/9TkeKlJ9+O36jW/P8Hvv+j++6NE53C6+/n2Kfr/6s96wbycX9zrzoPAAAAAAAAAADwCOtLRfxtpPj+cC29kNft5N//TWze0T79+69P9Kyb2Jv5ij5kwexSAAAAADw++lIRP4oUNxfevjuGeuP4757xn7+zPv5zKG3aWv09369U7w3Yy7//6zWQjzu++24DAAAAAAAAAAAAAAAAAADAgZJSES/k+dTHq/H8E9vOp74cKV757+dyuXS8LNedB36g+rV+ZWb61KWpqZl6LLSuTU02Rmdb1yfLuk9FitW//nSuW1Tzq3fnm+/M8b4+F/tcpBj+u27Zzlzs3bnJn1ove6Ys+7FI8V9/v7Fsnpo6zx1dlT1blv2rSPHVf9q67PH1sufKst+OFD/4aqNb9mhZtvt+1E+sl33++oz3hQIAAAAAAAAAAAAAAAAAALB7famIP40U/3Nr6e5Y/jz/f1/Px8pbX++Z73+TO9U8/wPV/P/bLd/P/P/VewUWtzsqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8nlIU8WakmL2ympb7y88d9cvt6dt3xoaGt652JFU1D1Xly5/6mbPnzn/hhcEL3fzg+nvtk/Ha6NVLjZdnbs3OTc7PT040xqbb12cmJne8h93W3+xkdQIat16/PXHjxnzj7PPnNmy+M/B+/xPHBy4OPnvqmW7ZsaHh4dGeMrW++z76PdI26w9HEX8ZKZ77zo/T9/sjitj9ufiQ785+O1J14mTVibGh4aojU+3W9EK5caR7IoqIRk+lZvccPYBrsSvNiMWy+WWDT5bdG51tzbWuTU02RlpzC+2F9sz0SOq0tuxPI4q4kCKWImKl/97d9UURr0eKbx1bTf/cH3Goex4+f2X0y6fPbt+OYh/7uANlOxt9EUvFI3DNDrD+KOIfI8VP3jkR/9IfUYvOT3wu4tUyvxfxVnSudyq/GOcj3tvie8SjqRZF/F95/S+upnf6y/tB975y+SuNL03fmOkp272vPPLPhwfpgN+b6lHED6o7/mr6V/9fAwAAAAAAAAAAAAAAABwgRfxapHjx3ROpGh98d0xxe/pm42rr2lRnWF937F93zPTa2tpaI3WymXM852LOpZzLOVdyRpHr52yWWV9bG8+fF3Mu5VzOuZIzDuX6OZs5x3Mu5lzKuZxzJWfUcv2czZzjORdzLuVczrmSMw7I2D0AAAAAAAAAAAAAAAAAAODxUlT/pfjm11bTWn9nfunx6OSy+UAfez8PAAD//17092s=") r4 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$IP6T_SO_GET_REVISION_MATCH(r4, 0x29, 0x44, &(0x7f0000001040)={'icmp\x00'}, &(0x7f0000001080)=0x1e) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r7, 0x50009417, &(0x7f0000000400)={{r7}, 0x0, 0x4, @inherit={0x48, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, {0x19, 0x14e, 0x2}}}, @subvolid=0xfc}) (async) r8 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r8, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) (async) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r8, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r8, 0xc02064b6, &(0x7f0000000500)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_GETPLANE(r8, 0xc02064b6, &(0x7f0000000200)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r7, 0xc02064b9, &(0x7f00000007c0)={&(0x7f0000000740)=[0x0], &(0x7f0000000780)=[0x0, 0x0, 0x0, 0x0], 0x1, r9, 0xb0b0b0b0}) r10 = syz_open_dev$vcsu(&(0x7f0000000340), 0x80000000, 0x400) pread64(r2, &(0x7f00000004c0)=""/203, 0xcb, 0x240000000000000) (async) sendmsg$NFNL_MSG_ACCT_NEW(r10, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB="50000000000701020000000000000000030000090cec014000000000000000400c00064000000000000000060900010073797a31000000000c000640000000000000080c0900010073797a3100000000"], 0x50}, 0x1, 0x0, 0x0, 0xc020}, 0x80080) (async) sendmsg$NL80211_CMD_SET_NOACK_MAP(r5, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0x50, r6, 0x400, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x5, 0x6c}}}}, [@NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x4}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x4}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x10}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x1}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x80}]}, 0x50}, 0x1, 0x0, 0x0, 0x20040890}, 0x24000805) [ 103.618545][ T5313] Bluetooth: hci0: command tx timeout [ 103.633189][ T5329] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 103.635866][ T5329] #PF: supervisor instruction fetch in kernel mode [ 103.638109][ T5329] #PF: error_code(0x0010) - not-present page [ 103.640075][ T5329] PGD 0 P4D 0 [ 103.641119][ T5329] Oops: Oops: 0010 [#1] SMP KASAN NOPTI [ 103.647323][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted 6.14.0-syzkaller-07422-gacb4f33713b9 #0 PREEMPT(full) [ 103.654917][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 103.659199][ T5329] RIP: 0010:0x0 [ 103.660313][ T5329] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 103.662551][ T5329] RSP: 0018:ffffc9000d47f8b8 EFLAGS: 00010293 [ 103.664462][ T5329] RAX: ffffffff81fdd89a RBX: 0000000000000000 RCX: ffff88801d0aa440 [ 103.666995][ T5329] RDX: 0000000000000000 RSI: ffffea00013583c0 RDI: ffff888042db61c0 [ 103.670010][ T5329] RBP: ffffc9000d47f980 R08: ffffffff81fdd85e R09: 1ffffd400026b078 [ 103.673056][ T5329] R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffffd400026b078 [ 103.676104][ T5329] R13: ffffea00013583c0 R14: ffffc9000d47f900 R15: 1ffffd400026b079 [ 103.678789][ T5329] FS: 00007f0c7ef046c0(0000) GS:ffff88808c5f1000(0000) knlGS:0000000000000000 [ 103.682150][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.684506][ T5329] CR2: ffffffffffffffd6 CR3: 0000000040cbc000 CR4: 0000000000352ef0 [ 103.687646][ T5329] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 103.690704][ T5329] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 103.694040][ T5329] Call Trace: [ 103.695430][ T5329] [ 103.696632][ T5329] ? __die_body+0x5f/0xb0 [ 103.698336][ T5329] ? page_fault_oops+0x991/0xd80 [ 103.700038][ T5329] ? __pfx_page_fault_oops+0x10/0x10 [ 103.701953][ T5329] ? __lock_acquire+0xad5/0xd80 [ 103.703714][ T5329] ? rcu_is_watching+0x15/0xb0 [ 103.705389][ T5329] ? is_errata93+0xbe/0x260 [ 103.707062][ T5329] ? exc_page_fault+0x5f1/0x8b0 [ 103.708850][ T5329] ? asm_exc_page_fault+0x26/0x30 [ 103.710858][ T5329] ? filemap_read_folio+0xfe/0x3b0 [ 103.712963][ T5329] ? filemap_read_folio+0x13a/0x3b0 [ 103.715048][ T5329] filemap_read_folio+0x14a/0x3b0 [ 103.717076][ T5329] ? __pfx_filemap_read_folio+0x10/0x10 [ 103.719285][ T5329] ? __filemap_get_folio+0x9d2/0xb40 [ 103.721396][ T5329] do_read_cache_folio+0x373/0x5b0 [ 103.723203][ T5329] freader_get_folio+0x54d/0x880 [ 103.724931][ T5329] freader_fetch+0x9d/0x5b0 [ 103.726540][ T5329] ? mt_find+0x699/0x8f0 [ 103.728281][ T5329] __build_id_parse+0x185/0x8e0 [ 103.730283][ T5329] ? __pfx___build_id_parse+0x10/0x10 [ 103.732386][ T5329] procfs_procmap_ioctl+0xd09/0x1680 [ 103.734391][ T5329] ? __pfx_procfs_procmap_ioctl+0x10/0x10 [ 103.736699][ T5329] ? __fget_files+0x2a/0x420 [ 103.738472][ T5329] ? __fget_files+0x2a/0x420 [ 103.740043][ T5329] ? __pfx_procfs_procmap_ioctl+0x10/0x10 [ 103.742168][ T5329] __se_sys_ioctl+0xf1/0x160 [ 103.744019][ T5329] do_syscall_64+0xf3/0x230 [ 103.745911][ T5329] ? clear_bhb_loop+0x45/0xa0 [ 103.747820][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.749918][ T5329] RIP: 0033:0x7f0c7e18d169 [ 103.751603][ T5329] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 103.758497][ T5329] RSP: 002b:00007f0c7ef04038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.761604][ T5329] RAX: ffffffffffffffda RBX: 00007f0c7e3a5fa0 RCX: 00007f0c7e18d169 [ 103.764729][ T5329] RDX: 0000200000000180 RSI: 00000000c0686611 RDI: 0000000000000004 [ 103.767790][ T5329] RBP: 00007f0c7e20e2a0 R08: 0000000000000000 R09: 0000000000000000 [ 103.770959][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.773949][ T5329] R13: 0000000000000000 R14: 00007f0c7e3a5fa0 R15: 00007ffd30d6ae78 [ 103.777130][ T5329] [ 103.778439][ T5329] Modules linked in: [ 103.780156][ T5329] CR2: 0000000000000000 [ 103.781753][ T5329] ---[ end trace 0000000000000000 ]--- [ 103.783920][ T5329] RIP: 0010:0x0 [ 103.785348][ T5329] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 103.788167][ T5329] RSP: 0018:ffffc9000d47f8b8 EFLAGS: 00010293 [ 103.790373][ T5329] RAX: ffffffff81fdd89a RBX: 0000000000000000 RCX: ffff88801d0aa440 [ 103.793425][ T5329] RDX: 0000000000000000 RSI: ffffea00013583c0 RDI: ffff888042db61c0 [ 103.796335][ T5329] RBP: ffffc9000d47f980 R08: ffffffff81fdd85e R09: 1ffffd400026b078 [ 103.799290][ T5329] R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffffd400026b078 [ 103.802201][ T5329] R13: ffffea00013583c0 R14: ffffc9000d47f900 R15: 1ffffd400026b079 [ 103.805266][ T5329] FS: 00007f0c7ef046c0(0000) GS:ffff88808c5f1000(0000) knlGS:0000000000000000 [ 103.808854][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.811140][ T5329] CR2: ffffffffffffffd6 CR3: 0000000040cbc000 CR4: 0000000000352ef0 [ 103.814078][ T5329] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 103.817232][ T5329] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 103.820238][ T5329] Kernel panic - not syncing: Fatal exception [ 103.822899][ T5329] Kernel Offset: disabled [ 103.824613][ T5329] Rebooting in 86400 seconds..