program: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x800, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x802, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000000540)={0x2020}, 0x2020) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'ip6tnl0\x00', &(0x7f00000005c0)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @private1={0xfc, 0x1, '\x00', 0x1}}}) r2 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x14, 0x4, 0x8, 0x6, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) recvfrom(r0, &(0x7f0000000240)=""/176, 0xb0, 0x10000, &(0x7f0000000380)=@sco={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x80) r3 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r2, &(0x7f0000000280), &(0x7f0000001840)=@udp6=r3}, 0x20) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000014c0)=@newtfilter={0x48, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {}, {0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_IPV6_DST={0x14, 0x10, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f00000004c0)={'ip6_vti0\x00', r5, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @loopback}}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000180)={0x9, 0x0, [{0x2a3, 0x0, 0x1000}, {0xb35, 0x0, 0x8}, {0xb31, 0x0, 0x704}, {0x38c, 0x0, 0x200}, {0xb82, 0x0, 0x4}, {0xbac, 0x0, 0x3}, {0xb5a, 0x0, 0x4}, {0x2f5, 0x0, 0x7f}, {0x400000b5, 0x0, 0x8}]}) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000080), 0x4) [ 70.620696][ T4533] Bluetooth: hci0: command tx timeout [ 70.687002][ T5107] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 71.142686][ T29] page: refcount:2 mapcount:0 mapping:0000000000000000 index:0x55a51d60c pfn:0x11a19 [ 71.149750][ T2905] list_add corruption. next->prev should be prev (ffffe8ffffc31ed0), but was ffff8880354f5000. (next=ffff88801aa39400). [ 71.157482][ T2905] ------------[ cut here ]------------ [ 71.159576][ T2905] kernel BUG at lib/list_debug.c:31! [ 71.161762][ T2905] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 71.164419][ T2905] CPU: 0 UID: 0 PID: 2905 Comm: kworker/u4:10 Not tainted 6.12.0-rc1-syzkaller #0 [ 71.168198][ T2905] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 71.172883][ T2905] Workqueue: zswap1 compact_page_work [ 71.175404][ T2905] RIP: 0010:__list_add_valid_or_report+0xd6/0xf0 [ 71.178052][ T2905] Code: e8 6f 08 00 07 90 0f 0b 48 c7 c7 00 f9 60 8c e8 60 08 00 07 90 0f 0b 48 c7 c7 60 f9 60 8c 4c 89 e6 4c 89 f1 e8 4b 08 00 07 90 <0f> 0b 48 c7 c7 e0 f9 60 8c 4c 89 f6 4c 89 e1 e8 36 08 00 07 90 0f [ 71.186406][ T2905] RSP: 0018:ffffc9000c497ad0 EFLAGS: 00010246 [ 71.189885][ T2905] RAX: 0000000000000075 RBX: ffff88801aa39408 RCX: da664adfef8a5100 [ 71.193996][ T2905] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 [ 71.196901][ T2905] RBP: ffffe8ffffc31ed0 R08: ffffffff81749dec R09: 1ffff92001892ef4 [ 71.199855][ T2905] R10: dffffc0000000000 R11: fffff52001892ef5 R12: ffffe8ffffc31ed0 [ 71.203194][ T2905] R13: dffffc0000000000 R14: ffff88801aa39400 R15: ffff888011a19000 [ 71.206633][ T2905] FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 [ 71.210863][ T2905] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 71.213413][ T2905] CR2: 00007f01a69980e8 CR3: 000000004c12e000 CR4: 0000000000352ef0 [ 71.216545][ T2905] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 71.219114][ T2905] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 71.222126][ T2905] Call Trace: [ 71.223643][ T2905] [ 71.225005][ T2905] ? __die_body+0x5f/0xb0 [ 71.226847][ T2905] ? die+0x9e/0xc0 [ 71.228400][ T2905] ? do_trap+0x15a/0x3a0 [ 71.230037][ T2905] ? __list_add_valid_or_report+0xd6/0xf0 [ 71.232225][ T2905] ? do_error_trap+0x1dc/0x2c0 [ 71.234017][ T2905] ? __list_add_valid_or_report+0xd6/0xf0 [ 71.236221][ T2905] ? __pfx_do_error_trap+0x10/0x10 [ 71.238280][ T2905] ? handle_invalid_op+0x34/0x40 [ 71.240430][ T2905] ? __list_add_valid_or_report+0xd6/0xf0 [ 71.243120][ T2905] ? exc_invalid_op+0x38/0x50 [ 71.245320][ T2905] ? asm_exc_invalid_op+0x1a/0x20 [ 71.247623][ T2905] ? __wake_up_klogd+0xcc/0x110 [ 71.249514][ T2905] ? __list_add_valid_or_report+0xd6/0xf0 [ 71.251786][ T2905] add_to_unbuddied+0x2e4/0x4d0 [ 71.253739][ T2905] do_compact_page+0x924/0xc50 [ 71.255618][ T2905] ? process_scheduled_works+0x976/0x1850 [ 71.257884][ T2905] process_scheduled_works+0xa63/0x1850 [ 71.260185][ T2905] ? __pfx_process_scheduled_works+0x10/0x10 [ 71.262504][ T2905] ? assign_work+0x364/0x3d0 [ 71.264565][ T2905] worker_thread+0x870/0xd30 [ 71.266769][ T2905] ? __kthread_parkme+0x169/0x1d0 [ 71.268817][ T2905] ? __pfx_worker_thread+0x10/0x10 [ 71.270714][ T2905] kthread+0x2f0/0x390 [ 71.272128][ T2905] ? __pfx_worker_thread+0x10/0x10 [ 71.273952][ T2905] ? __pfx_kthread+0x10/0x10 [ 71.275501][ T2905] ret_from_fork+0x4b/0x80 [ 71.277144][ T2905] ? __pfx_kthread+0x10/0x10 [ 71.279128][ T2905] ret_from_fork_asm+0x1a/0x30 [ 71.281472][ T2905] [ 71.283079][ T2905] Modules linked in: [ 71.285482][ T2905] ---[ end trace 0000000000000000 ]--- [ 71.288077][ T2905] RIP: 0010:__list_add_valid_or_report+0xd6/0xf0 [ 71.290601][ T2905] Code: e8 6f 08 00 07 90 0f 0b 48 c7 c7 00 f9 60 8c e8 60 08 00 07 90 0f 0b 48 c7 c7 60 f9 60 8c 4c 89 e6 4c 89 f1 e8 4b 08 00 07 90 <0f> 0b 48 c7 c7 e0 f9 60 8c 4c 89 f6 4c 89 e1 e8 36 08 00 07 90 0f [ 71.298319][ T2905] RSP: 0018:ffffc9000c497ad0 EFLAGS: 00010246 [ 71.301286][ T2905] RAX: 0000000000000075 RBX: ffff88801aa39408 RCX: da664adfef8a5100 [ 71.304436][ T2905] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 [ 71.307510][ T2905] RBP: ffffe8ffffc31ed0 R08: ffffffff81749dec R09: 1ffff92001892ef4 [ 71.310843][ T2905] R10: dffffc0000000000 R11: fffff52001892ef5 R12: ffffe8ffffc31ed0 [ 71.314488][ T2905] R13: dffffc0000000000 R14: ffff88801aa39400 R15: ffff888011a19000 [ 71.317958][ T2905] FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 [ 71.321172][ T2905] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 71.323730][ T2905] CR2: 00007f01a69980e8 CR3: 000000004c12e000 CR4: 0000000000352ef0 [ 71.326722][ T2905] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 71.329925][ T2905] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 71.332982][ T2905] Kernel panic - not syncing: Fatal exception [ 71.335890][ T2905] Kernel Offset: disabled [ 71.337593][ T2905] Rebooting in 86400 seconds..