syzkaller login: [ 34.145335] sshd (243) used greatest stack depth: 24744 bytes left Warning: Permanently added '[localhost]:62919' (ECDSA) to the list of known hosts. 2022/07/18 13:56:13 fuzzer started 2022/07/18 13:56:13 dialing manager at localhost:37835 2022/07/18 13:56:13 checking machine... 2022/07/18 13:56:13 checking revisions... [ 36.320277] kmemleak: Automatic memory scanning thread ended 2022/07/18 13:56:14 testing simple program... [ 36.375330] cgroup: Unknown subsys name 'net' [ 36.457088] cgroup: Unknown subsys name 'rlimit' executing program executing program executing program executing program [ 49.165188] audit: type=1400 audit(1658152586.913:6): avc: denied { execmem } for pid=285 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 50.332726] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 50.335077] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 50.336555] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 50.339319] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 50.347942] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 50.349760] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 executing program [ 52.410817] Bluetooth: hci0: command 0x0409 tx timeout executing program [ 54.457188] Bluetooth: hci0: command 0x041b tx timeout [ 56.505284] Bluetooth: hci0: command 0x040f tx timeout executing program [ 58.554209] Bluetooth: hci0: command 0x0419 tx timeout executing program executing program executing program executing program [ 70.408085] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.409289] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.411196] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 70.469626] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.470713] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.472718] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 2022/07/18 13:56:48 building call list... [ 71.099883] INFO: trying to register non-static key. [ 71.100657] The code is fine but needs lockdep annotation, or maybe [ 71.101520] you didn't initialize this object before use? [ 71.102266] turning off the locking correctness validator. [ 71.103176] CPU: 1 PID: 8 Comm: kworker/u4:0 Not tainted 5.19.0-rc7-next-20220718 #1 [ 71.105188] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 71.106685] Workqueue: netns cleanup_net [ 71.107266] Call Trace: [ 71.107621] [ 71.107954] dump_stack_lvl+0x8b/0xb3 [ 71.108486] register_lock_class+0x1597/0x1890 [ 71.109129] ? check_irq_usage+0x18c/0xcf0 [ 71.109725] ? hlock_conflict+0x54/0x200 [ 71.110295] ? is_dynamic_key.part.0+0x130/0x130 [ 71.110955] ? print_shortest_lock_dependencies_backwards+0x80/0x80 [ 71.111811] ? mark_lock.part.0+0xef/0x2f70 [ 71.112396] __lock_acquire+0x102/0x5e70 [ 71.112966] ? is_dynamic_key.part.0+0x130/0x130 [ 71.113651] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 71.114380] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 71.115093] lock_acquire+0x1a2/0x530 [ 71.115612] ? ieee80211_do_stop+0xbe/0x1dd0 [ 71.116227] ? lock_release+0x750/0x750 [ 71.116759] ? lock_release+0x750/0x750 [ 71.117322] ? lock_is_held_type+0xd7/0x130 [ 71.117947] _raw_spin_lock_bh+0x2f/0x40 [ 71.118493] ? ieee80211_do_stop+0xbe/0x1dd0 [ 71.119113] ieee80211_do_stop+0xbe/0x1dd0 [ 71.119688] ? lock_is_held_type+0xd7/0x130 [ 71.120284] ? ieee80211_stop+0xb8/0x600 [ 71.120859] ? mutex_lock_io_nested+0x1310/0x1310 [ 71.121511] ? lock_release+0x3b2/0x750 [ 71.122078] ? ieee80211_del_virtual_monitor+0x2e0/0x2e0 [ 71.122831] ? mark_held_locks+0x9e/0xe0 [ 71.123382] ? __local_bh_enable_ip+0xa0/0x130 [ 71.124015] ? __local_bh_enable_ip+0xa0/0x130 [ 71.124640] ? ieee80211_do_stop+0x1dd0/0x1dd0 [ 71.125281] ieee80211_stop+0xc5/0x600 [ 71.125852] ? ieee80211_do_stop+0x1dd0/0x1dd0 [ 71.126474] __dev_close_many+0x1b8/0x2f0 [ 71.127069] ? napi_enable+0x220/0x220 [ 71.127603] dev_close_many+0x1b0/0x450 [ 71.128160] ? __dev_close_many+0x2f0/0x2f0 [ 71.128739] ? lockdep_hardirqs_on+0x79/0x100 [ 71.129380] dev_close+0x13a/0x1c0 [ 71.129891] ? netdev_state_change+0x130/0x130 [ 71.130513] ? __mutex_lock+0x231/0x14d0 [ 71.131068] cfg80211_shutdown_all_interfaces+0x96/0x1f0 [ 71.131790] ieee80211_remove_interfaces+0xe3/0x690 [ 71.132490] ? ieee80211_sdata_stop+0x90/0x90 [ 71.133127] ieee80211_unregister_hw+0x47/0x1f0 [ 71.133790] hwsim_exit_net+0x49a/0xb90 [ 71.134331] ? hwsim_register_received_nl+0x410/0x410 [ 71.135259] ? sit_exit_batch_net+0x504/0x720 [ 71.136124] ? hwsim_register_received_nl+0x410/0x410 [ 71.137059] ops_exit_list+0xb3/0x180 [ 71.137784] cleanup_net+0x484/0x9e0 [ 71.138502] ? unregister_pernet_device+0x70/0x70 [ 71.139381] ? lock_is_held_type+0xd7/0x130 [ 71.139984] process_one_work+0xa0f/0x1690 [ 71.140571] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 71.141234] ? rwlock_bug.part.0+0x90/0x90 [ 71.141840] ? _raw_spin_lock_irq+0x41/0x50 [ 71.142414] worker_thread+0x637/0x1260 [ 71.142991] ? process_one_work+0x1690/0x1690 [ 71.143599] kthread+0x2ed/0x3a0 [ 71.144078] ? kthread_complete_and_exit+0x40/0x40 [ 71.144731] ret_from_fork+0x22/0x30 [ 71.145254] executing program [ 73.055515] audit: type=1400 audit(1658152610.804:7): avc: denied { create } for pid=263 comm="syz-fuzzer" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dccp_socket permissive=1 executing program 2022/07/18 13:56:53 syscalls: 2217 2022/07/18 13:56:53 code coverage: enabled 2022/07/18 13:56:53 comparison tracing: enabled 2022/07/18 13:56:53 extra coverage: enabled 2022/07/18 13:56:53 setuid sandbox: enabled 2022/07/18 13:56:53 namespace sandbox: enabled 2022/07/18 13:56:53 Android sandbox: enabled 2022/07/18 13:56:53 fault injection: enabled 2022/07/18 13:56:53 leak checking: enabled 2022/07/18 13:56:53 net packet injection: enabled 2022/07/18 13:56:53 net device setup: enabled 2022/07/18 13:56:53 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2022/07/18 13:56:53 devlink PCI setup: PCI device 0000:00:10.0 is not available 2022/07/18 13:56:53 USB emulation: enabled 2022/07/18 13:56:53 hci packet injection: enabled 2022/07/18 13:56:53 wifi device emulation: enabled 2022/07/18 13:56:53 802.15.4 emulation: enabled 2022/07/18 13:56:53 fetching corpus: 0, signal 0/0 (executing program) 2022/07/18 13:56:53 fetching corpus: 0, signal 0/0 (executing program) 2022/07/18 13:56:54 starting 8 fuzzer processes 13:56:54 executing program 0: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r0 = fork() ptrace$setopts(0x4206, r0, 0x0, 0x0) getpgid(0x0) 13:56:54 executing program 1: perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x535081, 0x0) inotify_init1(0x0) 13:56:54 executing program 2: r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000015c0), 0x1, 0x0) io_setup(0xbb8, &(0x7f0000000540)=0x0) io_submit(r1, 0x1, &(0x7f0000000500)=[&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)="8c", 0x1}]) pwritev(r0, &(0x7f0000000100)=[{&(0x7f0000000300)='\t', 0x1}], 0x1, 0x1f, 0x0) 13:56:54 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCETHTOOL(r0, 0x89b0, &(0x7f0000000040)={'syz_tun\x00', &(0x7f0000000000)=@ethtool_channels={0x3c}}) 13:56:54 executing program 3: unshare(0x20020400) unshare(0x8000000) unshare(0x4050400) unshare(0x40000000) unshare(0xa040000) unshare(0x60000000) unshare(0x40000) r0 = semget$private(0x0, 0x0, 0x106) unshare(0x20000) unshare(0x10000200) unshare(0x2010000) unshare(0x8000500) unshare(0x20800) unshare(0x400) unshare(0x10000800) unshare(0x3c020700) unshare(0x2000000) semctl$SEM_INFO(r0, 0x1, 0x13, &(0x7f0000000000)=""/204) unshare(0x0) semctl$IPC_RMID(r0, 0x0, 0x0) 13:56:54 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x3, &(0x7f0000000000)={@dev}, 0x14) 13:56:54 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x2) write$binfmt_aout(r0, &(0x7f0000000280)=ANY=[], 0x125) ioctl$SG_IO(r0, 0x2285, &(0x7f00000001c0)={0x53, 0x0, 0x0, 0x0, @buffer={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0}) 13:56:54 executing program 7: r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000100), 0x165c02, 0x0) ioctl$CDROMPLAYBLK(r0, 0x5317, 0x0) [ 78.345368] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 78.346523] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 78.349207] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 78.351940] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 78.354068] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 78.355969] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 78.415365] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 78.416477] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 78.418693] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 78.420514] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 78.422430] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 78.423512] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 78.467429] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 78.470249] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 78.471371] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 78.473037] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 78.474486] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 78.475611] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 78.503766] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 78.504584] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 78.505753] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 78.507555] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 78.508714] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 78.513055] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 78.527218] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 78.529175] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 78.532216] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 78.543511] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 78.545653] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 78.547909] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 80.377152] Bluetooth: hci0: command 0x0409 tx timeout [ 80.441181] Bluetooth: hci2: command 0x0409 tx timeout [ 80.441984] Bluetooth: hci1: Opcode 0x c03 failed: -110 [ 80.505160] Bluetooth: hci7: command 0x0409 tx timeout [ 80.505962] Bluetooth: hci6: Opcode 0x c03 failed: -110 [ 80.506774] Bluetooth: hci5: Opcode 0x c03 failed: -110 [ 80.569139] Bluetooth: hci4: command 0x0409 tx timeout [ 80.633164] Bluetooth: hci3: command 0x0409 tx timeout VM DIAGNOSIS: 13:56:49 Registers: info registers vcpu 0 RAX=0000000000004000 RBX=ffff88800860d040 RCX=ffffffff81284674 RDX=ffffed1003a05a09 RSI=0000000000000008 RDI=ffff88801d02d040 RBP=ffffffff8594af80 RSP=ffff8880224bfa68 R8 =0000000000000000 R9 =ffff88801d02d047 R10=ffffed1003a05a08 R11=0000000000000001 R12=0000000000000000 R13=ffff88801d02d040 R14=ffffed1003a05a08 R15=dffffc0000000000 RIP=ffffffff81284721 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000000c0008f7000 CR3=000000001b034000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM01=0000000000000000 0000000000000000 79735f7461706d6f 635f323361695f5f YMM02=0000000000000000 0000000000000000 6f636b2054203033 6334633831386666 YMM03=0000000000000000 0000000000000000 6434633831386666 6666666666660a34 YMM04=0000000000000000 0000000000000000 3030303030303030 3030303030303030 YMM05=0000000000000000 0000000000000000 6434633831386666 6666666666660a34 YMM06=0000000000000000 0000000000000000 706d6f635f323361 695f5f2054203035 YMM07=0000000000000000 0000000000000000 0a34367366746174 735f7379735f7461 YMM08=0000000000000000 0000000000000000 3030653463383138 6666666666666666 YMM09=0000000000000000 0000000000000000 665f7379735f7461 706d6f636b205420 YMM10=0000000000000000 0000000000000000 666666666666660a 3436736674617473 YMM11=0000000000000000 0000000000000000 61695f5f20542030 3266346338313866 YMM12=0000000000000000 0000000000000000 73665f7379735f74 61706d6f635f3233 YMM13=0000000000000000 0000000000000000 00000000008a4dee 00000000008a69cf YMM14=0000000000000000 0000000000000000 000000000089d9b9 00000000008a4694 YMM15=0000000000000000 0000000000000000 00000000004643c1 00000000004360f2 info registers vcpu 1 RAX=0000000000000072 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff82431a51 RDI=ffffffff87627720 RBP=ffffffff876276e0 RSP=ffff88800862edd8 R8 =0000000000000001 R9 =000000000000000a R10=0000000000000072 R11=0000000000000001 R12=0000000000000072 R13=ffffffff876276e0 R14=0000000000000010 R15=ffffffff82431a40 RIP=ffffffff82431aa9 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000558f02f76858 CR3=000000001b8fe000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 2038343a36353a33 31203831206c754a YMM01=0000000000000000 0000000000000000 617420646570706f 7453203a5d315b64 YMM02=0000000000000000 0000000000000000 6c6c694b20465220 657661532f64616f YMM03=0000000000000000 0000000000000000 6574737973207265 6c6c616b7a797320 YMM04=0000000000000000 0000000000000000 2036323a36353a33 31203831206c754a YMM05=0000000000000000 0000000000000000 65636f72703d7373 616c63742030733a YMM06=0000000000000000 0000000000000000 733a755f6d657473 79733d747865746e YMM07=0000000000000000 0000000000000000 725f6d6574737973 3a755f6d65747379 YMM08=0000000000000000 0000000000000000 7475636578652d7a 7973223d6d6d6f63 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000