Warning: Permanently added '[localhost]:41020' (ECDSA) to the list of known hosts. 2022/09/12 15:42:10 fuzzer started 2022/09/12 15:42:10 dialing manager at localhost:38027 syzkaller login: [ 41.826664] cgroup: Unknown subsys name 'net' [ 41.922684] cgroup: Unknown subsys name 'rlimit' 2022/09/12 15:42:24 syscalls: 2215 2022/09/12 15:42:24 code coverage: enabled 2022/09/12 15:42:24 comparison tracing: enabled 2022/09/12 15:42:24 extra coverage: enabled 2022/09/12 15:42:24 setuid sandbox: enabled 2022/09/12 15:42:24 namespace sandbox: enabled 2022/09/12 15:42:24 Android sandbox: enabled 2022/09/12 15:42:24 fault injection: enabled 2022/09/12 15:42:24 leak checking: enabled 2022/09/12 15:42:24 net packet injection: enabled 2022/09/12 15:42:24 net device setup: enabled 2022/09/12 15:42:24 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2022/09/12 15:42:24 devlink PCI setup: PCI device 0000:00:10.0 is not available 2022/09/12 15:42:24 USB emulation: enabled 2022/09/12 15:42:24 hci packet injection: enabled 2022/09/12 15:42:24 wifi device emulation: failed to parse kernel version (6.0.0-rc5-next-20220912) 2022/09/12 15:42:24 802.15.4 emulation: enabled 2022/09/12 15:42:24 fetching corpus: 0, signal 0/2000 (executing program) 2022/09/12 15:42:25 fetching corpus: 49, signal 39448/42754 (executing program) 2022/09/12 15:42:25 fetching corpus: 99, signal 46836/51561 (executing program) 2022/09/12 15:42:25 fetching corpus: 149, signal 58089/64035 (executing program) 2022/09/12 15:42:25 fetching corpus: 199, signal 65865/72936 (executing program) 2022/09/12 15:42:25 fetching corpus: 249, signal 72106/80211 (executing program) 2022/09/12 15:42:25 fetching corpus: 299, signal 76626/85826 (executing program) 2022/09/12 15:42:25 fetching corpus: 349, signal 81117/91293 (executing program) 2022/09/12 15:42:26 fetching corpus: 399, signal 86136/97268 (executing program) 2022/09/12 15:42:26 fetching corpus: 449, signal 89716/101824 (executing program) 2022/09/12 15:42:26 fetching corpus: 499, signal 93180/106184 (executing program) 2022/09/12 15:42:26 fetching corpus: 549, signal 96275/110151 (executing program) 2022/09/12 15:42:26 fetching corpus: 599, signal 99070/113770 (executing program) 2022/09/12 15:42:26 fetching corpus: 649, signal 102564/118051 (executing program) 2022/09/12 15:42:26 fetching corpus: 699, signal 106826/122816 (executing program) 2022/09/12 15:42:27 fetching corpus: 749, signal 110608/127143 (executing program) 2022/09/12 15:42:27 fetching corpus: 799, signal 113880/130939 (executing program) 2022/09/12 15:42:27 fetching corpus: 849, signal 115862/133662 (executing program) 2022/09/12 15:42:27 fetching corpus: 899, signal 118164/136550 (executing program) 2022/09/12 15:42:27 fetching corpus: 949, signal 120046/139045 (executing program) 2022/09/12 15:42:27 fetching corpus: 999, signal 122606/142135 (executing program) 2022/09/12 15:42:27 fetching corpus: 1049, signal 125072/145084 (executing program) 2022/09/12 15:42:28 fetching corpus: 1099, signal 127380/147868 (executing program) 2022/09/12 15:42:28 fetching corpus: 1149, signal 130236/151105 (executing program) 2022/09/12 15:42:28 fetching corpus: 1199, signal 131729/153126 (executing program) 2022/09/12 15:42:28 fetching corpus: 1249, signal 133529/155343 (executing program) 2022/09/12 15:42:28 fetching corpus: 1299, signal 135359/157555 (executing program) 2022/09/12 15:42:28 fetching corpus: 1349, signal 137208/159813 (executing program) 2022/09/12 15:42:28 fetching corpus: 1399, signal 139782/162522 (executing program) 2022/09/12 15:42:29 fetching corpus: 1449, signal 141477/164558 (executing program) 2022/09/12 15:42:29 fetching corpus: 1499, signal 142822/166365 (executing program) 2022/09/12 15:42:29 fetching corpus: 1549, signal 144252/168182 (executing program) 2022/09/12 15:42:29 fetching corpus: 1599, signal 145574/169852 (executing program) 2022/09/12 15:42:29 fetching corpus: 1649, signal 146848/171445 (executing program) 2022/09/12 15:42:29 fetching corpus: 1699, signal 148658/173433 (executing program) 2022/09/12 15:42:29 fetching corpus: 1749, signal 149714/174853 (executing program) 2022/09/12 15:42:30 fetching corpus: 1799, signal 150776/176323 (executing program) 2022/09/12 15:42:30 fetching corpus: 1849, signal 152733/178322 (executing program) 2022/09/12 15:42:30 fetching corpus: 1899, signal 154545/180260 (executing program) 2022/09/12 15:42:30 fetching corpus: 1949, signal 155403/181480 (executing program) 2022/09/12 15:42:30 fetching corpus: 1999, signal 156987/183131 (executing program) 2022/09/12 15:42:30 fetching corpus: 2049, signal 158488/184718 (executing program) 2022/09/12 15:42:30 fetching corpus: 2099, signal 159709/186088 (executing program) 2022/09/12 15:42:31 fetching corpus: 2149, signal 161120/187571 (executing program) 2022/09/12 15:42:31 fetching corpus: 2199, signal 162077/188791 (executing program) 2022/09/12 15:42:31 fetching corpus: 2249, signal 163317/190160 (executing program) 2022/09/12 15:42:31 fetching corpus: 2299, signal 164662/191550 (executing program) 2022/09/12 15:42:31 fetching corpus: 2349, signal 166447/193178 (executing program) 2022/09/12 15:42:31 fetching corpus: 2399, signal 167287/194223 (executing program) 2022/09/12 15:42:31 fetching corpus: 2449, signal 168418/195442 (executing program) 2022/09/12 15:42:31 fetching corpus: 2499, signal 169429/196564 (executing program) 2022/09/12 15:42:32 fetching corpus: 2549, signal 171207/198029 (executing program) 2022/09/12 15:42:32 fetching corpus: 2599, signal 172099/199045 (executing program) 2022/09/12 15:42:32 fetching corpus: 2649, signal 173132/200101 (executing program) 2022/09/12 15:42:32 fetching corpus: 2699, signal 174403/201262 (executing program) 2022/09/12 15:42:32 fetching corpus: 2749, signal 175397/202313 (executing program) 2022/09/12 15:42:32 fetching corpus: 2799, signal 176867/203491 (executing program) 2022/09/12 15:42:33 fetching corpus: 2849, signal 177691/204341 (executing program) 2022/09/12 15:42:33 fetching corpus: 2899, signal 178590/205249 (executing program) 2022/09/12 15:42:33 fetching corpus: 2949, signal 179343/206147 (executing program) 2022/09/12 15:42:33 fetching corpus: 2999, signal 180189/207001 (executing program) 2022/09/12 15:42:33 fetching corpus: 3049, signal 181229/207912 (executing program) 2022/09/12 15:42:33 fetching corpus: 3099, signal 182194/208815 (executing program) 2022/09/12 15:42:33 fetching corpus: 3149, signal 182736/209504 (executing program) 2022/09/12 15:42:33 fetching corpus: 3199, signal 183621/210289 (executing program) 2022/09/12 15:42:34 fetching corpus: 3249, signal 184902/211197 (executing program) 2022/09/12 15:42:34 fetching corpus: 3299, signal 185749/211949 (executing program) 2022/09/12 15:42:34 fetching corpus: 3349, signal 186467/212612 (executing program) 2022/09/12 15:42:34 fetching corpus: 3399, signal 187381/213347 (executing program) 2022/09/12 15:42:34 fetching corpus: 3449, signal 188299/214064 (executing program) 2022/09/12 15:42:34 fetching corpus: 3499, signal 188744/214605 (executing program) 2022/09/12 15:42:34 fetching corpus: 3549, signal 189802/215463 (executing program) 2022/09/12 15:42:35 fetching corpus: 3599, signal 190591/216109 (executing program) 2022/09/12 15:42:35 fetching corpus: 3649, signal 191235/216845 (executing program) 2022/09/12 15:42:35 fetching corpus: 3699, signal 192255/217632 (executing program) 2022/09/12 15:42:35 fetching corpus: 3749, signal 193150/218295 (executing program) 2022/09/12 15:42:35 fetching corpus: 3799, signal 194304/219014 (executing program) 2022/09/12 15:42:35 fetching corpus: 3849, signal 195015/219544 (executing program) 2022/09/12 15:42:36 fetching corpus: 3899, signal 195567/220094 (executing program) 2022/09/12 15:42:36 fetching corpus: 3949, signal 196250/220620 (executing program) 2022/09/12 15:42:36 fetching corpus: 3999, signal 196948/221171 (executing program) 2022/09/12 15:42:36 fetching corpus: 4049, signal 197625/221655 (executing program) 2022/09/12 15:42:36 fetching corpus: 4099, signal 198897/222302 (executing program) 2022/09/12 15:42:36 fetching corpus: 4149, signal 199678/222816 (executing program) 2022/09/12 15:42:36 fetching corpus: 4199, signal 200317/223260 (executing program) 2022/09/12 15:42:36 fetching corpus: 4249, signal 201018/223704 (executing program) 2022/09/12 15:42:37 fetching corpus: 4299, signal 201925/224241 (executing program) 2022/09/12 15:42:37 fetching corpus: 4349, signal 202630/224662 (executing program) 2022/09/12 15:42:37 fetching corpus: 4399, signal 203592/225163 (executing program) 2022/09/12 15:42:37 fetching corpus: 4449, signal 204556/225605 (executing program) 2022/09/12 15:42:37 fetching corpus: 4499, signal 205340/225963 (executing program) 2022/09/12 15:42:37 fetching corpus: 4549, signal 206109/226394 (executing program) 2022/09/12 15:42:38 fetching corpus: 4599, signal 207154/226794 (executing program) 2022/09/12 15:42:38 fetching corpus: 4649, signal 207859/227139 (executing program) 2022/09/12 15:42:38 fetching corpus: 4699, signal 208262/227382 (executing program) 2022/09/12 15:42:38 fetching corpus: 4749, signal 208929/227818 (executing program) 2022/09/12 15:42:38 fetching corpus: 4799, signal 209651/228129 (executing program) 2022/09/12 15:42:38 fetching corpus: 4849, signal 210289/228381 (executing program) 2022/09/12 15:42:38 fetching corpus: 4899, signal 210786/228651 (executing program) 2022/09/12 15:42:38 fetching corpus: 4949, signal 211488/228911 (executing program) 2022/09/12 15:42:39 fetching corpus: 4999, signal 212133/229182 (executing program) 2022/09/12 15:42:39 fetching corpus: 5049, signal 212573/229409 (executing program) 2022/09/12 15:42:39 fetching corpus: 5099, signal 213085/229686 (executing program) 2022/09/12 15:42:39 fetching corpus: 5149, signal 213602/229898 (executing program) 2022/09/12 15:42:39 fetching corpus: 5199, signal 214147/230082 (executing program) 2022/09/12 15:42:39 fetching corpus: 5249, signal 214760/230290 (executing program) 2022/09/12 15:42:40 fetching corpus: 5299, signal 215367/230491 (executing program) 2022/09/12 15:42:40 fetching corpus: 5349, signal 216010/230689 (executing program) 2022/09/12 15:42:40 fetching corpus: 5399, signal 216532/230826 (executing program) 2022/09/12 15:42:40 fetching corpus: 5449, signal 217161/230968 (executing program) 2022/09/12 15:42:40 fetching corpus: 5499, signal 217874/231313 (executing program) 2022/09/12 15:42:40 fetching corpus: 5549, signal 218419/231587 (executing program) 2022/09/12 15:42:40 fetching corpus: 5599, signal 219085/231626 (executing program) 2022/09/12 15:42:40 fetching corpus: 5649, signal 219540/231650 (executing program) 2022/09/12 15:42:41 fetching corpus: 5699, signal 220089/231658 (executing program) 2022/09/12 15:42:41 fetching corpus: 5749, signal 220936/231672 (executing program) 2022/09/12 15:42:41 fetching corpus: 5799, signal 221352/231672 (executing program) 2022/09/12 15:42:41 fetching corpus: 5849, signal 222010/231687 (executing program) 2022/09/12 15:42:41 fetching corpus: 5899, signal 222876/231699 (executing program) 2022/09/12 15:42:41 fetching corpus: 5908, signal 223117/231699 (executing program) 2022/09/12 15:42:41 fetching corpus: 5908, signal 223117/231699 (executing program) 2022/09/12 15:42:43 starting 8 fuzzer processes 15:42:43 executing program 0: fallocate(0xffffffffffffffff, 0x0, 0x2, 0x0) readv(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000300)=""/102, 0x66}], 0x1) r0 = syz_mount_image$tmpfs(&(0x7f00000006c0), &(0x7f0000000700)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)) getdents64(r0, &(0x7f0000000140)=""/26, 0x1a) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, &(0x7f0000000200)=ANY=[@ANYRES16=r1, @ANYRES32, @ANYRES32], 0x8) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f0000000140)='\x00', 0x1a}], 0x1, 0x7fffffc, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000f00)='mountinfo\x00') read$hiddev(r5, &(0x7f0000000040)=""/169, 0x200000e9) sendfile(r4, r3, 0x0, 0xfffffdef) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r3, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="20007dbc498dfb68165e5d25d36f3c17011c5c89ce961f15c73cc5791bb3acd2c7b7625d009eeb67c405fce273f1e3c3c4c2b59cdeb7b76aa850ec4604cf9511ae707cea5eccbebe49a6dc24307e93bfc20f071b872699c1bece45fccc848fa4fa013572"], 0x14}, 0x1, 0x0, 0x0, 0x44000}, 0x10004000) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xa0014, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) truncate(&(0x7f0000000180)='./file1\x00', 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/consoles\x00', 0x0, 0x0) 15:42:43 executing program 4: timer_create(0xfffffff1, 0x0, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f00000003c0)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timer_gettime(0x0, &(0x7f0000000500)) 15:42:43 executing program 1: openat$zero(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) mq_open(&(0x7f0000000000)=':.\\U\x00', 0xf146a4008b531a6b, 0x20, &(0x7f0000000040)={0x0, 0x3, 0x3, 0x5}) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) pread64(r0, 0x0, 0x0, 0x5) 15:42:43 executing program 2: shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) r0 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000fff000/0x1000)=nil) r1 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmctl$IPC_SET(r1, 0x1, &(0x7f0000000000)={{0x3, 0x0, 0x0, 0xee01}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) shmat(r1, &(0x7f0000ff9000/0x2000)=nil, 0x4000) shmat(0x0, &(0x7f0000ffb000/0x4000)=nil, 0x2000) shmat(r0, &(0x7f0000ffc000/0x4000)=nil, 0x0) shmctl$IPC_RMID(0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x208, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='smaps\x00') shmget(0x1, 0x3000, 0x20, &(0x7f0000ff9000/0x3000)=nil) pread64(r2, &(0x7f00000000c0)=""/98, 0x62, 0x7fff) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) shmget$private(0x0, 0x1000, 0x2, &(0x7f0000fff000/0x1000)=nil) 15:42:43 executing program 3: r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) sendmmsg(r0, &(0x7f0000001240)=[{{&(0x7f0000000000)=@ll={0x11, 0x4, r2}, 0x80, 0x0}}], 0x1, 0x0) 15:42:43 executing program 5: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000180), 0x201, 0x0) write$binfmt_aout(r0, &(0x7f00000018c0)=ANY=[], 0x1220) 15:42:43 executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)={0x24, 0x2d, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @fd}, @generic="a060bb866ba95c67d4"]}, 0x24}], 0x1}, 0x0) 15:42:43 executing program 6: syz_mount_image$iso9660(&(0x7f0000000040), &(0x7f0000000080)='.\x00', 0x0, 0x1, &(0x7f0000001400)=[{&(0x7f00000000c0)="9941d3cfaa017e87bb9cf63c881bf363ae76b683f1d05ed45af18fc85f53ae74969da3abcc7e80dccbe3e2e152a7fa470fb48b1c61fac91a7e1639635fb52ca7cc6b547306f96840013d05f8055593ae8e1abf1d2e0d6a3e984cdfb0f9d3986f33a706baf735ebbd2115fec9fe4209ddd7c0c38984bba842519d587630dad6459c80a87fd57de24e6c15fe54e97a7f69d24d497599987d7db52f9a3abd525837c0ce8918bb8caf8b26bda230a0c4881eac8211067f5e9d7b183510edbe7276cd16ca07684d7c8aa33ce6d581c807da3d6d0862b77c110c5a89b5579eff0a8ec04cf54112dee42f452958957b4d47c62930edc8933cef5cce25bf56a321d776ce5cbdc7cb19ec21917574eb149092dba193e7981a12be8014ed3cb6ba5056d6a41bb9205754fd6f8e5ab1309cf0a8cec48aa2c9f17aeeb24ef2e3bf9189a9c180aa35497600ff0b774545eda19b6f4d00bd66628f36dd9fc02bf2d62d6fc1fef645189058e66c38e4b4b3ae7d398611094bb3a192a14c415811d0c4a41e3f943e5f68c29ecea017d7cb8bf33c868ba2a991cd4a12fa056a8f7df7bfb24f8cbea7a88a0a010c499c5e7e968cd74a950aef4e73ad2fe3f92df8822b180e6ec2b31d3afb45af6c70654d00b2f8c024e39879e668b54a3b8b764c971e7b33b5df4c3325d3b6c2f7fc588fa9d5d4f464e09502ef45535691e21a2775fc792183e4172e", 0x200}], 0x0, &(0x7f0000001480)) socket$inet6_udp(0xa, 0x2, 0x0) r0 = syz_open_dev$sg(&(0x7f0000001ac0), 0x0, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000001c00), 0x2, 0x0) [ 74.884161] audit: type=1400 audit(1662997363.943:6): avc: denied { execmem } for pid=287 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 76.172588] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.175352] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.177304] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.179984] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.181082] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 76.182394] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 76.184348] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 76.186192] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 76.189035] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 76.190246] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 76.198822] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 76.200067] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 76.204827] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.207374] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 76.209229] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 76.213464] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 76.214026] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 76.216112] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 76.217015] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 76.217304] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.218749] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 76.219220] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 76.222382] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.223839] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.227006] Bluetooth: hci6: HCI_REQ-0x0c1a [ 76.232953] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.237699] Bluetooth: hci7: HCI_REQ-0x0c1a [ 76.237981] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 76.239470] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.239504] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.242348] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 76.243836] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.261642] Bluetooth: hci0: HCI_REQ-0x0c1a [ 76.274222] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 76.284701] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.288514] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 76.290922] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.291053] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 76.300052] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 76.301474] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 76.307010] Bluetooth: hci2: HCI_REQ-0x0c1a [ 76.307126] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.307701] Bluetooth: hci4: HCI_REQ-0x0c1a [ 76.310393] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.323037] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.324369] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.332134] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 76.333329] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 76.335326] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.345788] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.355014] Bluetooth: hci3: HCI_REQ-0x0c1a [ 76.358658] Bluetooth: hci1: HCI_REQ-0x0c1a [ 76.379720] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 76.404076] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 76.405413] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 76.421049] Bluetooth: hci5: HCI_REQ-0x0c1a [ 78.300647] Bluetooth: hci0: command 0x0409 tx timeout [ 78.301841] Bluetooth: hci7: command 0x0409 tx timeout [ 78.302355] Bluetooth: hci6: command 0x0409 tx timeout [ 78.363954] Bluetooth: hci4: command 0x0409 tx timeout [ 78.364425] Bluetooth: hci2: command 0x0409 tx timeout [ 78.427992] Bluetooth: hci5: command 0x0409 tx timeout [ 78.429632] Bluetooth: hci1: command 0x0409 tx timeout [ 78.430426] Bluetooth: hci3: command 0x0409 tx timeout [ 80.347944] Bluetooth: hci6: command 0x041b tx timeout [ 80.348484] Bluetooth: hci7: command 0x041b tx timeout [ 80.348972] Bluetooth: hci0: command 0x041b tx timeout [ 80.411988] Bluetooth: hci2: command 0x041b tx timeout [ 80.412628] Bluetooth: hci4: command 0x041b tx timeout [ 80.475978] Bluetooth: hci3: command 0x041b tx timeout [ 80.476626] Bluetooth: hci1: command 0x041b tx timeout [ 80.477131] Bluetooth: hci5: command 0x041b tx timeout [ 82.396113] Bluetooth: hci0: command 0x040f tx timeout [ 82.397274] Bluetooth: hci7: command 0x040f tx timeout [ 82.398245] Bluetooth: hci6: command 0x040f tx timeout [ 82.460004] Bluetooth: hci4: command 0x040f tx timeout [ 82.460808] Bluetooth: hci2: command 0x040f tx timeout [ 82.524058] Bluetooth: hci5: command 0x040f tx timeout [ 82.525410] Bluetooth: hci1: command 0x040f tx timeout [ 82.526321] Bluetooth: hci3: command 0x040f tx timeout [ 84.444012] Bluetooth: hci6: command 0x0419 tx timeout [ 84.444511] Bluetooth: hci7: command 0x0419 tx timeout [ 84.444974] Bluetooth: hci0: command 0x0419 tx timeout [ 84.507955] Bluetooth: hci2: command 0x0419 tx timeout [ 84.508471] Bluetooth: hci4: command 0x0419 tx timeout [ 84.571957] Bluetooth: hci3: command 0x0419 tx timeout [ 84.572427] Bluetooth: hci1: command 0x0419 tx timeout [ 84.572820] Bluetooth: hci5: command 0x0419 tx timeout [ 132.742956] audit: type=1400 audit(1662997421.802:7): avc: denied { open } for pid=3759 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 132.744361] audit: type=1400 audit(1662997421.802:8): avc: denied { kernel } for pid=3759 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 132.748795] ------------[ cut here ]------------ [ 132.748813] [ 132.748816] ====================================================== [ 132.748819] WARNING: possible circular locking dependency detected [ 132.748823] 6.0.0-rc5-next-20220912 #1 Not tainted [ 132.748829] ------------------------------------------------------ [ 132.748832] syz-executor.0/3769 is trying to acquire lock: [ 132.748838] ffffffff853fa878 ((console_sem).lock){....}-{2:2}, at: down_trylock+0xe/0x70 [ 132.748874] [ 132.748874] but task is already holding lock: [ 132.748877] ffff88800df38820 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_out+0x53b/0x18d0 [ 132.748903] [ 132.748903] which lock already depends on the new lock. [ 132.748903] [ 132.748906] [ 132.748906] the existing dependency chain (in reverse order) is: [ 132.748909] [ 132.748909] -> #3 (&ctx->lock){....}-{2:2}: [ 132.748923] _raw_spin_lock+0x2a/0x40 [ 132.748938] __perf_event_task_sched_out+0x53b/0x18d0 [ 132.748951] __schedule+0xedd/0x2470 [ 132.748960] preempt_schedule_common+0x45/0xc0 [ 132.748971] __cond_resched+0x17/0x30 [ 132.748980] __mutex_lock+0xa3/0x14d0 [ 132.748991] __do_sys_perf_event_open+0x1eec/0x32c0 [ 132.749004] do_syscall_64+0x3b/0x90 [ 132.749017] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.749033] [ 132.749033] -> #2 (&rq->__lock){-.-.}-{2:2}: [ 132.749047] _raw_spin_lock_nested+0x30/0x40 [ 132.749062] raw_spin_rq_lock_nested+0x1e/0x30 [ 132.749074] task_fork_fair+0x63/0x4d0 [ 132.749091] sched_cgroup_fork+0x3d0/0x540 [ 132.749105] copy_process+0x3f9e/0x6df0 [ 132.749115] kernel_clone+0xe7/0x890 [ 132.749124] user_mode_thread+0xad/0xf0 [ 132.749134] rest_init+0x24/0x250 [ 132.749151] arch_call_rest_init+0xf/0x14 [ 132.749169] start_kernel+0x4c1/0x4e6 [ 132.749185] secondary_startup_64_no_verify+0xe0/0xeb [ 132.749199] [ 132.749199] -> #1 (&p->pi_lock){-.-.}-{2:2}: [ 132.749213] _raw_spin_lock_irqsave+0x39/0x60 [ 132.749230] try_to_wake_up+0xab/0x1920 [ 132.749243] up+0x75/0xb0 [ 132.749255] __up_console_sem+0x6e/0x80 [ 132.749271] console_unlock+0x46a/0x590 [ 132.749287] do_con_write+0xc05/0x1d50 [ 132.749298] con_write+0x21/0x40 [ 132.749307] n_tty_write+0x4d4/0xfe0 [ 132.749319] file_tty_write.constprop.0+0x49c/0x8f0 [ 132.749331] vfs_write+0x9c3/0xd90 [ 132.749349] ksys_write+0x127/0x250 [ 132.749366] do_syscall_64+0x3b/0x90 [ 132.749379] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.749395] [ 132.749395] -> #0 ((console_sem).lock){....}-{2:2}: [ 132.749409] __lock_acquire+0x2a02/0x5e70 [ 132.749426] lock_acquire+0x1a2/0x530 [ 132.749442] _raw_spin_lock_irqsave+0x39/0x60 [ 132.749457] down_trylock+0xe/0x70 [ 132.749469] __down_trylock_console_sem+0x3b/0xd0 [ 132.749486] vprintk_emit+0x16b/0x560 [ 132.749502] vprintk+0x84/0xa0 [ 132.749519] _printk+0xba/0xf1 [ 132.749536] report_bug.cold+0x72/0xab [ 132.749548] handle_bug+0x3c/0x70 [ 132.749560] exc_invalid_op+0x14/0x50 [ 132.749573] asm_exc_invalid_op+0x16/0x20 [ 132.749589] group_sched_out.part.0+0x2c7/0x460 [ 132.749600] ctx_sched_out+0x8f1/0xc10 [ 132.749609] __perf_event_task_sched_out+0x6d0/0x18d0 [ 132.749622] __schedule+0xedd/0x2470 [ 132.749631] preempt_schedule_common+0x45/0xc0 [ 132.749641] __cond_resched+0x17/0x30 [ 132.749651] __mutex_lock+0xa3/0x14d0 [ 132.749662] __do_sys_perf_event_open+0x1eec/0x32c0 [ 132.749674] do_syscall_64+0x3b/0x90 [ 132.749687] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.749704] [ 132.749704] other info that might help us debug this: [ 132.749704] [ 132.749706] Chain exists of: [ 132.749706] (console_sem).lock --> &rq->__lock --> &ctx->lock [ 132.749706] [ 132.749721] Possible unsafe locking scenario: [ 132.749721] [ 132.749723] CPU0 CPU1 [ 132.749725] ---- ---- [ 132.749728] lock(&ctx->lock); [ 132.749733] lock(&rq->__lock); [ 132.749739] lock(&ctx->lock); [ 132.749745] lock((console_sem).lock); [ 132.749751] [ 132.749751] *** DEADLOCK *** [ 132.749751] [ 132.749753] 2 locks held by syz-executor.0/3769: [ 132.749760] #0: ffff88806cf37cd8 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x1cf/0x2470 [ 132.749785] #1: ffff88800df38820 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_out+0x53b/0x18d0 [ 132.749813] [ 132.749813] stack backtrace: [ 132.749815] CPU: 1 PID: 3769 Comm: syz-executor.0 Not tainted 6.0.0-rc5-next-20220912 #1 [ 132.749828] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 132.749835] Call Trace: [ 132.749838] [ 132.749842] dump_stack_lvl+0x8b/0xb3 [ 132.749856] check_noncircular+0x263/0x2e0 [ 132.749873] ? format_decode+0x26c/0xb50 [ 132.749887] ? print_circular_bug+0x450/0x450 [ 132.749904] ? enable_ptr_key_workfn+0x20/0x20 [ 132.749918] ? __lockdep_reset_lock+0x180/0x180 [ 132.749935] ? format_decode+0x26c/0xb50 [ 132.749950] ? alloc_chain_hlocks+0x1ec/0x5a0 [ 132.749968] __lock_acquire+0x2a02/0x5e70 [ 132.749990] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 132.750013] lock_acquire+0x1a2/0x530 [ 132.750030] ? down_trylock+0xe/0x70 [ 132.750045] ? rcu_read_unlock+0x40/0x40 [ 132.750062] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 132.750084] ? vprintk+0x84/0xa0 [ 132.750103] _raw_spin_lock_irqsave+0x39/0x60 [ 132.750118] ? down_trylock+0xe/0x70 [ 132.750132] down_trylock+0xe/0x70 [ 132.750145] ? vprintk+0x84/0xa0 [ 132.750162] __down_trylock_console_sem+0x3b/0xd0 [ 132.750180] vprintk_emit+0x16b/0x560 [ 132.750197] ? lock_downgrade+0x6d0/0x6d0 [ 132.750216] vprintk+0x84/0xa0 [ 132.750234] _printk+0xba/0xf1 [ 132.750252] ? record_print_text.cold+0x16/0x16 [ 132.750272] ? hrtimer_try_to_cancel+0x163/0x2c0 [ 132.750286] ? lock_downgrade+0x6d0/0x6d0 [ 132.750304] ? report_bug.cold+0x66/0xab [ 132.750318] ? group_sched_out.part.0+0x2c7/0x460 [ 132.750329] report_bug.cold+0x72/0xab [ 132.750344] handle_bug+0x3c/0x70 [ 132.750358] exc_invalid_op+0x14/0x50 [ 132.750372] asm_exc_invalid_op+0x16/0x20 [ 132.750389] RIP: 0010:group_sched_out.part.0+0x2c7/0x460 [ 132.750402] Code: 5e 41 5f e9 3b b7 ef ff e8 36 b7 ef ff 65 8b 1d ab 15 ac 7e 31 ff 89 de e8 d6 b3 ef ff 85 db 0f 84 8a 00 00 00 e8 19 b7 ef ff <0f> 0b e9 a5 fe ff ff e8 0d b7 ef ff 48 8d 7d 10 48 b8 00 00 00 00 [ 132.750414] RSP: 0018:ffff88801899f978 EFLAGS: 00010006 [ 132.750423] RAX: 0000000040000002 RBX: 0000000000000000 RCX: 0000000000000000 [ 132.750430] RDX: ffff88802055d040 RSI: ffffffff81566027 RDI: 0000000000000005 [ 132.750438] RBP: ffff888010008000 R08: 0000000000000005 R09: 0000000000000001 [ 132.750445] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800df38800 [ 132.750453] R13: ffff88806cf3d100 R14: ffffffff8547bfc0 R15: 0000000000000002 [ 132.750464] ? group_sched_out.part.0+0x2c7/0x460 [ 132.750477] ? group_sched_out.part.0+0x2c7/0x460 [ 132.750490] ctx_sched_out+0x8f1/0xc10 [ 132.750502] __perf_event_task_sched_out+0x6d0/0x18d0 [ 132.750518] ? lock_is_held_type+0xd7/0x130 [ 132.750536] ? __perf_cgroup_move+0x160/0x160 [ 132.750548] ? set_next_entity+0x304/0x550 [ 132.750566] ? update_curr+0x267/0x740 [ 132.750585] ? lock_is_held_type+0xd7/0x130 [ 132.750603] __schedule+0xedd/0x2470 [ 132.750616] ? io_schedule_timeout+0x150/0x150 [ 132.750627] ? find_held_lock+0x2c/0x110 [ 132.750643] ? lock_is_held_type+0xd7/0x130 [ 132.750661] ? __cond_resched+0x17/0x30 [ 132.750672] preempt_schedule_common+0x45/0xc0 [ 132.750684] __cond_resched+0x17/0x30 [ 132.750694] __mutex_lock+0xa3/0x14d0 [ 132.750707] ? lock_is_held_type+0xd7/0x130 [ 132.750724] ? __do_sys_perf_event_open+0x1eec/0x32c0 [ 132.750739] ? mutex_lock_io_nested+0x1310/0x1310 [ 132.750751] ? lock_release+0x3b2/0x750 [ 132.750769] ? __up_read+0x192/0x730 [ 132.750784] ? up_write+0x480/0x480 [ 132.750801] __do_sys_perf_event_open+0x1eec/0x32c0 [ 132.750818] ? perf_compat_ioctl+0x130/0x130 [ 132.750831] ? xfd_validate_state+0x59/0x180 [ 132.750854] ? syscall_enter_from_user_mode+0x1d/0x50 [ 132.750872] ? syscall_enter_from_user_mode+0x1d/0x50 [ 132.750892] do_syscall_64+0x3b/0x90 [ 132.750906] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.750923] RIP: 0033:0x7fe239c2fb19 [ 132.750932] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 132.750943] RSP: 002b:00007fe237184188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 132.750954] RAX: ffffffffffffffda RBX: 00007fe239d43020 RCX: 00007fe239c2fb19 [ 132.750962] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000280 [ 132.750969] RBP: 00007fe239c89f6d R08: 0000000000000000 R09: 0000000000000000 [ 132.750976] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 132.750984] R13: 00007fff6d16a26f R14: 00007fe237184300 R15: 0000000000022000 [ 132.750997] [ 132.811410] WARNING: CPU: 1 PID: 3769 at kernel/events/core.c:2309 group_sched_out.part.0+0x2c7/0x460 [ 132.812116] Modules linked in: [ 132.812383] CPU: 1 PID: 3769 Comm: syz-executor.0 Not tainted 6.0.0-rc5-next-20220912 #1 [ 132.812967] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 132.813777] RIP: 0010:group_sched_out.part.0+0x2c7/0x460 [ 132.814169] Code: 5e 41 5f e9 3b b7 ef ff e8 36 b7 ef ff 65 8b 1d ab 15 ac 7e 31 ff 89 de e8 d6 b3 ef ff 85 db 0f 84 8a 00 00 00 e8 19 b7 ef ff <0f> 0b e9 a5 fe ff ff e8 0d b7 ef ff 48 8d 7d 10 48 b8 00 00 00 00 [ 132.815765] RSP: 0018:ffff88801899f978 EFLAGS: 00010006 [ 132.816272] RAX: 0000000040000002 RBX: 0000000000000000 RCX: 0000000000000000 [ 132.816920] RDX: ffff88802055d040 RSI: ffffffff81566027 RDI: 0000000000000005 [ 132.817468] RBP: ffff888010008000 R08: 0000000000000005 R09: 0000000000000001 [ 132.818095] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800df38800 [ 132.818629] R13: ffff88806cf3d100 R14: ffffffff8547bfc0 R15: 0000000000000002 [ 132.819180] FS: 00007fe237184700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 [ 132.819794] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 132.820242] CR2: 00007ff08dc76bd8 CR3: 000000001b732000 CR4: 0000000000350ee0 [ 132.820801] Call Trace: [ 132.821000] [ 132.821178] ctx_sched_out+0x8f1/0xc10 [ 132.821483] __perf_event_task_sched_out+0x6d0/0x18d0 [ 132.821873] ? lock_is_held_type+0xd7/0x130 [ 132.822212] ? __perf_cgroup_move+0x160/0x160 [ 132.822559] ? set_next_entity+0x304/0x550 [ 132.822892] ? update_curr+0x267/0x740 [ 132.823197] ? lock_is_held_type+0xd7/0x130 [ 132.823532] __schedule+0xedd/0x2470 [ 132.823826] ? io_schedule_timeout+0x150/0x150 [ 132.824183] ? find_held_lock+0x2c/0x110 [ 132.824496] ? lock_is_held_type+0xd7/0x130 [ 132.824827] ? __cond_resched+0x17/0x30 [ 132.825128] preempt_schedule_common+0x45/0xc0 [ 132.825473] __cond_resched+0x17/0x30 [ 132.825766] __mutex_lock+0xa3/0x14d0 [ 132.826056] ? lock_is_held_type+0xd7/0x130 [ 132.826383] ? __do_sys_perf_event_open+0x1eec/0x32c0 [ 132.826775] ? mutex_lock_io_nested+0x1310/0x1310 [ 132.827149] ? lock_release+0x3b2/0x750 [ 132.827470] ? __up_read+0x192/0x730 [ 132.827758] ? up_write+0x480/0x480 [ 132.828048] __do_sys_perf_event_open+0x1eec/0x32c0 [ 132.828437] ? perf_compat_ioctl+0x130/0x130 [ 132.828780] ? xfd_validate_state+0x59/0x180 [ 132.829137] ? syscall_enter_from_user_mode+0x1d/0x50 [ 132.829540] ? syscall_enter_from_user_mode+0x1d/0x50 [ 132.829949] do_syscall_64+0x3b/0x90 [ 132.830324] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.830817] RIP: 0033:0x7fe239c2fb19 [ 132.831174] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 132.832675] RSP: 002b:00007fe237184188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 132.833281] RAX: ffffffffffffffda RBX: 00007fe239d43020 RCX: 00007fe239c2fb19 [ 132.833827] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000280 [ 132.834367] RBP: 00007fe239c89f6d R08: 0000000000000000 R09: 0000000000000000 [ 132.834910] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 132.835448] R13: 00007fff6d16a26f R14: 00007fe237184300 R15: 0000000000022000 [ 132.835989] [ 132.836170] irq event stamp: 452 [ 132.836426] hardirqs last enabled at (451): [] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 132.837140] hardirqs last disabled at (452): [] __schedule+0x1225/0x2470 [ 132.837745] softirqs last enabled at (0): [] copy_process+0x1dfe/0x6df0 [ 132.838359] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 132.838831] ---[ end trace 0000000000000000 ]--- [ 133.387436] syz-executor.0 (3760) used greatest stack depth: 23808 bytes left [ 139.548016] Bluetooth: hci4: Opcode 0x c03 failed: -110 [ 139.548055] Bluetooth: hci0: Opcode 0x c03 failed: -110 [ 141.796265] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 141.797627] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 141.800125] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 141.802339] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 141.804104] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 141.805464] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 141.808424] Bluetooth: hci4: HCI_REQ-0x0c1a VM DIAGNOSIS: 15:43:42 Registers: info registers vcpu 0 RAX=0000000000000000 RBX=0000000000000000 RCX=0000000000000000 RDX=ffff888041600000 RSI=ffffffff816b9b22 RDI=ffff88800be67900 RBP=ffff88800fb5ad00 RSP=ffff88801761fa20 R8 =0000000000000007 R9 =0000000000000002 R10=0000000000000000 R11=0000000000000001 R12=ffff88800be67900 R13=dffffc0000000000 R14=ffff88801895d400 R15=0000000000000000 RIP=ffffffff817de7f2 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fe6a6b86028 CR3=000000001742e000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 756e696c2d34365f 3638782f62696c2f YMM01=0000000000000000 0000000000000000 6f732e616d7a6c62 696c2f756e672d78 YMM02=0000000000000000 0000000000000000 00352e6f732e616d 7a6c62696c2f756e YMM03=0000000000000000 0000000000000000 672d78756e696c2d 34365f3638782f62 YMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 RAX=0000000000000061 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff822b1e41 RDI=ffffffff8763fae0 RBP=ffffffff8763faa0 RSP=ffff88801899f3c8 R8 =0000000000000001 R9 =000000000000000a R10=0000000000000061 R11=0000000000000001 R12=0000000000000061 R13=ffffffff8763faa0 R14=0000000000000010 R15=ffffffff822b1e30 RIP=ffffffff822b1e99 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007fe237184700 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ff08dc76bd8 CR3=000000001b732000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 756e696c2d34365f 3638782f62696c2f YMM01=0000000000000000 0000000000000000 6461657268747062 696c2f756e672d78 YMM02=0000000000000000 0000000000000000 00302e6f732e6461 657268747062696c YMM03=0000000000000000 0000000000000000 2f756e672d78756e 696c2d34365f3638 YMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000