5359b716dca2ab15408b6764e38f0718079c68e5c720c462af47a394d8bcc36f4b60d41b4b19133168043cae32fbbb3a7d1d5a497d2843a40574d82b833278e49bcf9e9d5be242794f5c0da3798169f8dab7dadb874bf291bec4097a3eca39ab869a188554c76c6d19547d09527b8c33c7cb407266ade3c823b00b342805e4f627f916c1581457a7d93e109bcb5aa4536b82fc8d19db34d11f32d1fb763c7775252bba7682d9741dd4bff0bfbc0459fe24a966c8a22e3f74ffad76c8a1e839befc1c69c980b23b1db742118dd293d3f453a561250ac26bf205ef4ead36a12a599d51194de8dea656d31f4984a1eb03012e9c7e5f29cbfbd08158ae9a7cf8572f8e836841804085997ad9c63087865ef0cfdc97630c88f59ded359871ee8405e55e71634b6a883c4f714e4d39a8683d1b06ea57cdc610b5d40b3faabef99d964c25007ce3a032c8b4184385d5489fc568a0a990aebc9c18c5a7f10b535f44f2637312be3de42ef98a784b5ce33e493152df0f6e7eef824b3b1a2ee0e408375fb0bc76572127a03e97f3976e4526bc1439e69a3c6848bffb5d6b24d631fc70e16316e6744687311cb27fe5adf81e148c24a845789890214ffd7f98d87cb43170edd2c6a486e1092e6a00094ff4762333337879acb898d4de177bc2bea4f7d25b1f12f0164036a4139cd29b4bf5df3fd9e3b83efbf8bd09e7898a15c524441f3e055686268966b5dc439668fc6613eef42dbf59da62836b16f604877d89ac447aa48fdbbe224a5c759c6ef2410e401bba8e036390b67a055016ba58696c30eede517f25a7667a4b30932e2a61aa3292f268b8f832bc9188139cad8957fc4d220518c158bf6c5068b258500e55eee3665cfa00dbf8855da890a9d21cdf359f01b87cb2b42aba9702b3b34056dc13dfc371dcce16c0d44a6a45430cccc3f2789ea0b0098438984b8a384bb979c850b36569bc1af0c2fb927ac3da76885febc358c013bec1cbcc60fc8f6951fca22bf8416437b813380b33c4d2511a0b3d77f95b1a5b2c8f3a05ccef7cb7558c5d89ff9c25c7a20f7e2f1b6b7533cea497c23257b4ff0f73b57dd23227bc487ad482299e1d62afbd4fc8b8a62adcf10d319d4f4dacf14928235a14be89ce3915154f1d7f39ce4af100c9e4b64e7b8cbd9f78b06a7457df1cb17994205b233603dc0b5834ef0dedfd84d032761cb1ecddc5dea28ac280ec203ab3fc16218e7674badf83ac12d4f559bbcbf446059f8de97f4472e84cba6b6326620e99f702f72055889edd1dbe670a81f0ca4cd6bef3ea15d6b1750f96dd4afa6007121e5e8791a20b913e0641599932f4356350e03cc5cc2794a6c9dcced82da72a8c043c25d36c9d34f5aa9f232d40ba4eab37a99832e1aa6257f221ad0f345fab715bc6e9895164340e9400f569f883c5c84ce7dc2bbe5afae1003cae16560561371df5187c9cb5d6bf7b5d45870b459f212fa65421f788b3998bf028544330d2e6112ae54101a7c18280256bf6e1bb2ff2d50490f7b90d22789f4cbe6031376df8522117d8b37fb78a4e2d96db156f827caae538fb28212a963a46931487eb860ebab21ae843d8cc97b781dac782bd1f130d2615f3fd6623fe51a2afb37b06286ae27491cff7bf5f2d774f1efc1aa1685eb0b15a618c86777d2e9de30e71fc3cfae005e855944769a3dec78f10068ce81aafcce7de8ef02e9656c89a1906835ce7bba1ee92b3b08ef0a0c9b7c65e8b4fbb35d65805090c9fed715d534de7d7bd015f77007445c06dd433c0386ee47fcaf1b56893ad7bca03d5be9e852d01440dfd140660a47c71bf639d1b2c7012e9802411947e7867600e96d3391f10546c422e8b81a2f64defca17d04303615f76f4a5382b3623b9fa03dcdeadb5a6fbadababa92b91ee81b9a94840415b3c904ca3e32c21c5ae9ae5d66c895da04b58e7a1a938f2600c7e51bf47f8ea03e2dd3f91b0ebacbf4b8693257988", 0x1000, 0x5, 0x0, 0x2}, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x3, 0x0, r6, &(0x7f00000015c0)="79c6011ea3733cae806749515eb28a958e477dd9b29eeeb9969998a085142a5fa10ea74069540e0ca44c322f242164e90c77165b89733ce3bf6f2c3de64c0b719c36631139d6739dc440238c26b888aaebecf3f2c5a7467e5254f61b6617baaabd5a13995881e8ed00c36f39fb13a70fd2", 0x71, 0x6, 0x0, 0x1}]) write$bt_hci(0xffffffffffffffff, &(0x7f00000016c0)=ANY=[@ANYBLOB="027d7f010000000000000087161464c75057cba637203e19742428a3f1"], 0x178) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 11:53:36 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:53:36 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1, @ANYBLOB="39022d5a4515a2fcb92f9c9954a3d81988b286700a28ea90e21835da1a237ae101c46260639773e1d4a697a6c9d28d8d23fa638431799da246279b21f483d6cdadd69bf17dc369d598b634df9f878fe76249ec3ba6f9118c08c404448b82b0e76661e4301db7f44b721bce0d5d34bb4b192282035347b4864c829cf320742a63a82963cdfee93af650334513640183fd7b62ddd299f75fa29b5eb74492421dd114ccd1145b181b963b93a55a1ad9975f393cf3cf07013d85bbd9f43cc21c8bad7643ccb306e45e8a1d3ffb4e254863eceed78c585095", @ANYBLOB="fb5eb9d932ee18e0088ac14e5e049a7243e81168956e91e70e97fc2b1db5e7965d57cdb3f6aa5e0dec8c518be1a3af83ec5fb103bb320631b53d90ad613576ed6d3f12d5c73def5ea0cc030348e47d542702b121edc57bd110a30f90804c63be2e9a4a408f7a4d70b1d5475d6f88e7ecfc8e6c35054a45c37247cd80bec7f047eb8b79133ed3353f4726135a646864b1b47e19b41db80457482fdf77c00b"], 0x178) 11:53:47 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x8, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:53:47 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$binfmt_script(r1, &(0x7f0000000100)={'#! ', './file0', [{0x20, '\xfb#'}, {0x20, '!/\xa8/'}], 0xa, "24ea48dc9f56219322a00875b8220fdb35caa9e492afc1455a7acee1a684fd9ca0257c928ff9ef8bec1f88c02fbd8e63d143eec623102583a621c3fe1a53dd83ce1892b43ecaedbb6cf2f7ec8284528e767f2ce2f37bc9506174484d1bd8aa168953b51f33f4fc9d16afbcb22f19f736ad28135a8a30652bccea7aea9bbfd82a9b0352eabf683aeb8c562291a7cadb3a81a9c345d7c40481d289f3bfc863a05151e7a6d7d07961235b31e75c74f2c699"}, 0xc3) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) 11:53:47 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x2, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:53:47 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000340)='\x00') accept$unix(r0, &(0x7f00000000c0)=@abs, &(0x7f0000000140)=0x6e) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:53:47 executing program 3: openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r0 = epoll_create1(0x0) r1 = dup(0xffffffffffffffff) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x80000) epoll_pwait2(r0, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:53:47 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1, @ANYBLOB="39022d5a4515a2fcb92f9c9954a3d81988b286700a28ea90e21835da1a237ae101c46260639773e1d4a697a6c9d28d8d23fa638431799da246279b21f483d6cdadd69bf17dc369d598b634df9f878fe76249ec3ba6f9118c08c404448b82b0e76661e4301db7f44b721bce0d5d34bb4b192282035347b4864c829cf320742a63a82963cdfee93af650334513640183fd7b62ddd299f75fa29b5eb74492421dd114ccd1145b181b963b93a55a1ad9975f393cf3cf07013d85bbd9f43cc21c8bad7643ccb306e45e8a1d3ffb4e254863eceed78c585095"], 0x178) 11:53:47 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) (fail_nth: 9) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:53:47 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) syz_io_uring_setup(0x7f37, &(0x7f0000000080)={0x0, 0xca90, 0x20, 0x1, 0x330, 0x0, r0}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) 11:53:47 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 11:53:47 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000340)='\x00') accept$unix(r0, &(0x7f00000000c0)=@abs, &(0x7f0000000140)=0x6e) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(0xffffffffffffffff, r2, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:53:47 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) bind$bt_hci(r1, &(0x7f0000000000), 0xffffffd5) write$bt_hci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="b27fd655080aabbe451c02edaa4269732f7fa3905bed1e0282b9cfe086788b97d22bb7cc74732f2437fe005540659a4d266b74822879085ea06e67f591a012c59479c2202a9f0e0f95e65d9ae606ceb81ee6b5f681c053ccef4c4f1848f494dda907db755698d97d16faff9d8fe32600bea454e12644f91fe44e7bbd6df3e8e7845beacf02dcc314f23ec524a7522c6f0e0d4de2b71cdb04"], 0x178) [ 1735.004834] FAULT_INJECTION: forcing a failure. [ 1735.004834] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1735.005926] CPU: 1 UID: 0 PID: 13155 Comm: syz-executor.6 Not tainted 6.17.0-next-20251003 #1 PREEMPT(voluntary) [ 1735.005942] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1735.005950] Call Trace: [ 1735.005954] [ 1735.005958] dump_stack_lvl+0xfa/0x120 [ 1735.005984] should_fail_ex+0x4d7/0x5e0 [ 1735.006003] _copy_to_user+0x32/0xd0 [ 1735.006021] simple_read_from_buffer+0xe0/0x180 [ 1735.006037] proc_fail_nth_read+0x18a/0x240 [ 1735.006056] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1735.006073] ? security_file_permission+0x22/0x90 [ 1735.006093] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1735.006110] vfs_read+0x1eb/0xc70 [ 1735.006130] ? __pfx_vfs_read+0x10/0x10 [ 1735.006146] ? lock_release+0xc8/0x290 [ 1735.006164] ? __fget_files+0x20d/0x3b0 [ 1735.006185] ksys_read+0x121/0x240 [ 1735.006200] ? __pfx_ksys_read+0x10/0x10 [ 1735.006221] do_syscall_64+0xbf/0x390 [ 1735.006237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1735.006250] RIP: 0033:0x7fb9ba7af69c [ 1735.006260] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1735.006271] RSP: 002b:00007fb9b7d72170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1735.006283] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fb9ba7af69c [ 1735.006291] RDX: 000000000000000f RSI: 00007fb9b7d721e0 RDI: 0000000000000004 [ 1735.006298] RBP: 00007fb9b7d721d0 R08: 0000000000000000 R09: 0000000000000000 [ 1735.006306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1735.006313] R13: 00007ffc437f8faf R14: 00007fb9b7d72300 R15: 0000000000022000 [ 1735.006331] 11:53:47 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x9, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:53:47 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[], 0x178) 11:53:47 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[], 0x178) 11:53:47 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:53:47 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x3, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:53:47 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x2, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:53:57 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000340)='\x00') accept$unix(r0, &(0x7f00000000c0)=@abs, &(0x7f0000000140)=0x6e) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(0xffffffffffffffff, r2, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:53:57 executing program 7: r0 = syz_io_uring_setup(0xfffffff8, &(0x7f0000000000)={0x0, 0x0, 0x10, 0x400000}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff7000/0x9000)=nil, &(0x7f0000000100), &(0x7f0000000140)) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000580)=ANY=[@ANYBLOB="6761302fc832c4073caaca48472f842e5b2600", @ANYRES32=r0, @ANYBLOB="00fbfa6765c9b8148dbe21bd300a9b00fb0722f0bb7294d7926f83054eec007d86c8b839a5c9bc63a2cab3220ea4c4d77437e1d4cb68dcd5baef1a2737315208664715eb2e4708cdb3d20b9ea8ba32901940ca48beef885e790bec4af6bf128bc97ed3009b71425d89b0f7dcf1cb4c0783d9d396c59f7b577ee1e071ae7cf3f958426492884794a853ecd430c03278084592a7b053400f25025415"]) perf_event_open$cgroup(&(0x7f0000000080)={0x0, 0x80, 0x19, 0x1, 0x9, 0xff, 0x0, 0x4, 0x21084, 0xb7a19700752da64c, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x10001, 0x1, @perf_config_ext={0x8, 0x400}, 0x108c, 0x64, 0x8, 0x9, 0x101, 0x80, 0x7, 0x0, 0xa9e, 0x0, 0x4}, 0xffffffffffffffff, 0xc, r1, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x40040, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000085c0)={0x0, 0x0, 0x0}, &(0x7f0000008600)=0xc) setresgid(r4, 0x0, 0xee01) setgroups(0x3, &(0x7f0000000340)=[r4, 0x0, 0x0]) fchown(r2, 0xee01, r4) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r5, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) getgroups(0x2, &(0x7f0000000380)=[r4, r4]) r6 = getpid() get_robust_list(r6, &(0x7f00000002c0)=0x0, &(0x7f0000000300)) r7 = openat2(r2, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)={0x400600, 0x92, 0x1d}, 0x18) perf_event_open(&(0x7f0000000400)={0x5, 0x80, 0xff, 0xc0, 0x6f, 0xfd, 0x0, 0x1, 0x15310, 0x8, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x6, 0x0, @perf_config_ext={0x9, 0x8}, 0x3010, 0x20, 0x8000007, 0x4, 0x5, 0x9402, 0x200, 0x0, 0x8}, r6, 0x9, r7, 0x0) r8 = fork() wait4(r8, &(0x7f0000000480), 0x2, &(0x7f00000004c0)) 11:53:57 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x4, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:53:57 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[], 0x178) 11:53:57 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000040)=0x7ff, 0x4) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) 11:53:57 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x3, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:53:57 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x0, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:53:57 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xa, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:53:57 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="06006afab7ee90958b4d0c9667da35adbed8bd0a94199433a75099d24593a850cb8f7a5668e63813d1ccd95644ab0a845757c007d7fe6316dee9fc383142f8db9559c2a70387c9561e1ff59a273cd5f8a141823eb751617def622d59ec901ca5d5"], 0x178) 11:53:57 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xb, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:53:57 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x5, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:53:57 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32], 0x178) 11:53:57 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x4, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:53:57 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYRESDEC], 0x178) 11:53:57 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x10, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:54:08 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x300, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:54:08 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x5, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:54:08 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32], 0x178) 11:54:08 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) r1 = socket(0x27, 0x80000, 0x4) recvfrom(r1, &(0x7f0000000040)=""/49, 0x31, 0x400000c0, &(0x7f0000000100)=@phonet={0x23, 0xff, 0x20, 0xf8}, 0x80) 11:54:08 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000340)='\x00') accept$unix(r0, &(0x7f00000000c0)=@abs, &(0x7f0000000140)=0x6e) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(0xffffffffffffffff, r2, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:54:08 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x0, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:54:08 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x6, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:54:08 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x800) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000085c0)={0x0, 0x0, 0x0}, &(0x7f0000008600)=0xc) setresgid(r4, 0x0, 0xee01) setgroups(0x3, &(0x7f0000000340)=[r4, 0x0, 0x0]) newfstatat(0xffffffffffffff9c, 0x0, &(0x7f0000002640)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1100) setresuid(0x0, r5, 0x0) write$P9_RSTATu(r1, &(0x7f0000000240)={0x4c, 0x7d, 0x2, {{0x0, 0x36, 0x1, 0x8, {0x20, 0x2, 0x4}, 0x80000, 0x80000001, 0x9, 0x40, 0x1, '\x00', 0x0, '', 0x1, '\x00', 0x1, '&'}, 0x1, ')', r2, r4, r5}}, 0x4c) close(r0) 11:54:08 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x700, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:54:08 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x7, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:54:08 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32], 0x178) 11:54:08 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x80800) readv(r1, &(0x7f0000001400)=[{&(0x7f00000000c0)=""/18, 0x12}], 0x1) close(r0) 11:54:08 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x7, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:54:08 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448cc, &(0x7f0000000180)="e392847ee3ef16f8fb1f63ff3897a02aa1678f414f99ba53c7709f2ac7e63b2ebe20eae2e5663930aaf4af79e2bb8f42624f71eb9f7ab9916c24a8c870739a2f440f0220cd72c48cb9691eb8e534eb140c7cb1662e9c90c38c20a4e6529076a816b87ace9ca83439e90a29e1df4a53ee14227bcd33c3bdf1a922e0b9e5ece5d467e8e67b58228d136b7681565c05987a6db3798b73f1b71465141f7ffed66e820843c9dc87f7b30b9a1e2d4f64acea6efe2057bc247d019c1d52ca215af398fe5994c724b0e24a8281919e3539e874c3b76109be26283e9214a0c2469503") bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="9e82e9b0020000002f93600c44d078fa1b521b9a4943ac3cf4220c090db243eb652c991da17201d49793e7ce74ee2a984ef4b34460940ae170bfce2b722e03a74c11e36fcc4109353d28adbf24987d98c1938440b74b858ca07eb7e4d5ac358bd50a2300a23f"], 0x178) ioctl$sock_bt_hci(r0, 0x400448e2, &(0x7f0000000080)="7775593cb476be905b483f608d60be3ebef923a6e8dadeff7adcfda13d369e9d8c8a3425dc8edcb5a9338b2948b1ab130065aae5b8554d67246a1a399bea4244acaf80262188d1bea1ab01b4b56fd0e5fedb2f41b25e239c8e09ce273146a3a417aafc8a2f6239b9f34e4e5a1e756ef91badb1d9b1babf5714f1c88b988d3f45e930a996e8f737d3929c3c94dc0328aae568854cb8df643f30c80264809fdd2fb8baf6b784f271069b49579a2da0d80fe39b06f83ff8a85df2bef35d82f70b45208c6a6f50dc8c8aba3a53df2fc4b7fcf63ed637fbfd0e01df7b9a707c8d33b5bd191f64a37e6c071b57917d89761be12bba4e5312b092ac026f37") 11:54:08 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x810, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:54:08 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x8, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:54:08 executing program 2: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x4, 0x10, 0x2}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$CDROMREADMODE1(0xffffffffffffffff, 0x530d, &(0x7f0000000400)={0xfe, 0x8, 0xff, 0x4, 0xe1, 0x3}) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/152, 0x98}, {&(0x7f0000000240)=""/168, 0xa8}], 0x2) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/bus/hdaudio', 0x8000, 0x29d) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r6 = inotify_init() finit_module(r6, &(0x7f0000000340)='\x00', 0x1) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r7, &(0x7f0000000300)={0x80000008}) 11:54:20 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) (fail_nth: 1) 11:54:20 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000340)='\x00') r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:54:20 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$FS_IOC_FSGETXATTR(r3, 0x801c581f, &(0x7f0000000180)={0x7fffffff, 0x6, 0x20, 0x9dd, 0x7}) close(r2) ioctl$KDGKBENT(r1, 0x4b46, &(0x7f00000000c0)={0x0, 0x8, 0x7f}) read(r0, &(0x7f0000000080)=""/12, 0xc) 11:54:20 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$FAT_IOCTL_GET_VOLUME_ID(r1, 0x80047213, &(0x7f0000000040)) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='blkio.bfq.io_queued_recursive\x00', 0x0, 0x0) ioctl$EVIOCGKEYCODE(r2, 0x80084504, &(0x7f0000000180)=""/44) r3 = open(&(0x7f0000000080)='./file0\x00', 0x28180, 0x40) write$bt_hci(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) 11:54:20 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x8, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:54:20 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x900, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:54:20 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x2, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:54:20 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x0, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) [ 1767.718365] FAULT_INJECTION: forcing a failure. [ 1767.718365] name failslab, interval 1, probability 0, space 0, times 0 [ 1767.719858] CPU: 0 UID: 0 PID: 13600 Comm: syz-executor.2 Not tainted 6.17.0-next-20251003 #1 PREEMPT(voluntary) [ 1767.719882] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1767.719892] Call Trace: [ 1767.719898] [ 1767.719905] dump_stack_lvl+0xfa/0x120 [ 1767.719933] should_fail_ex+0x4d7/0x5e0 [ 1767.719959] should_failslab+0xc2/0x120 [ 1767.719991] kmem_cache_alloc_node_noprof+0x79/0x6a0 [ 1767.720012] ? lock_release+0xc8/0x290 [ 1767.720033] ? __alloc_skb+0x2ab/0x370 [ 1767.720058] ? __alloc_skb+0x2ab/0x370 [ 1767.720073] __alloc_skb+0x2ab/0x370 [ 1767.720091] ? __pfx___alloc_skb+0x10/0x10 [ 1767.720121] alloc_skb_with_frags+0x8f/0x7c0 [ 1767.720145] ? __pfx_perf_trace_lock+0x10/0x10 [ 1767.720171] sock_alloc_send_pskb+0x7cb/0x950 [ 1767.720189] ? lock_acquire+0x15e/0x2f0 [ 1767.720208] ? avc_has_perm_noaudit+0x59/0x3d0 [ 1767.720236] ? avc_has_perm_noaudit+0x11b/0x3d0 [ 1767.720265] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1767.720283] ? avc_has_perm_noaudit+0x150/0x3d0 [ 1767.720312] ? sock_has_perm+0x21d/0x2b0 [ 1767.720339] ? __pfx_sock_has_perm+0x10/0x10 [ 1767.720369] hci_sock_sendmsg+0x190/0x2270 [ 1767.720397] ? perf_trace_lock+0xb5/0x5d0 [ 1767.720421] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 1767.720455] sock_write_iter+0x57e/0x610 [ 1767.720481] ? __pfx_sock_write_iter+0x10/0x10 [ 1767.720519] ? security_file_permission+0x22/0x90 [ 1767.720549] vfs_write+0xbe9/0x1150 [ 1767.720574] ? __pfx_sock_write_iter+0x10/0x10 [ 1767.720598] ? __fget_files+0x34/0x3b0 [ 1767.720620] ? __pfx_vfs_write+0x10/0x10 [ 1767.720661] ksys_write+0x1ef/0x240 [ 1767.720683] ? __pfx_ksys_write+0x10/0x10 [ 1767.720714] do_syscall_64+0xbf/0x390 [ 1767.720751] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1767.720768] RIP: 0033:0x7f4f07636b19 [ 1767.720782] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1767.720799] RSP: 002b:00007f4f04bac188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1767.720816] RAX: ffffffffffffffda RBX: 00007f4f07749f60 RCX: 00007f4f07636b19 [ 1767.720827] RDX: 0000000000000178 RSI: 00000000200007c0 RDI: 0000000000000004 [ 1767.720838] RBP: 00007f4f04bac1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1767.720848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1767.720858] R13: 00007ffd8140db8f R14: 00007f4f04bac300 R15: 0000000000022000 [ 1767.720883] 11:54:20 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x9, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:54:20 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) (fail_nth: 2) 11:54:20 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)=""/1, 0x1}], 0x1, &(0x7f0000000140)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x40000000) bind$bt_hci(r1, &(0x7f00000001c0)={0x1f, 0x3, 0x2}, 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) write$bt_hci(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="01240c03fd5424abcf8ee4dd76cea532be70407815512401d5634c977a4a5a38ca9a5a8aae6cc483913a5d52d09becd0e5815d45ef69dc780b8f57a9d6fbb3c170e8069226be6a688f03225aad49feff987063b4628b8a4444284cdb41b661671f238bcc3196296b3cf32fb7c4189619fc4bf5550b13c15b32aae836be6e4ecbe019cc6208c00bfe7f04e3fc614325c684fbb8e0f24b783135dbe7f5b9c4ce1f6da17bf81c0d4b10206e35f0c6f1addf8259c56fc92befd8de3b2e4da7cfb9f30e251ad61a5b5b37b73bab81400a47312c65eeba63fb87463216d4cf61b77d8c4524f1430db4512c5bdc29529695a97fe76c1b84ccc9c4efab7fc31d2986782ea76db4151cf1e6f47a35cea666b30813c0de5c9068e961a3859fbc63a9943c5544d31fdf324b13379f37ceeaae5f05ead63e709c57e49e7f2ecacbb73fec7fcba1f12c5efe84159c"], 0x7) 11:54:20 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xa00, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:54:20 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) (fail_nth: 3) 11:54:20 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x3, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:54:20 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$AUTOFS_DEV_IOCTL_VERSION(r2, 0xc0189371, &(0x7f0000000080)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) [ 1769.882119] Bluetooth: hci0: command 0x0406 tx timeout 11:54:31 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) (fail_nth: 4) 11:54:31 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000080)=0x1, 0x4) 11:54:31 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)={0x200b}) r2 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r3, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r2) 11:54:31 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, 0x0, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:54:31 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xb00, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:54:31 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xd, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:54:31 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000340)='\x00') r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:54:31 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x4, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:54:31 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x11, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:54:31 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:54:31 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) (fail_nth: 5) 11:54:31 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x1008, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:54:31 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x80000) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:54:31 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000040)={0x3, 0x40, "3f1317", 0x0, 0xba}) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) 11:54:31 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x5, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:54:31 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xe0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) [ 1778.989537] FAULT_INJECTION: forcing a failure. [ 1778.989537] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1778.991458] CPU: 1 UID: 0 PID: 13764 Comm: syz-executor.2 Not tainted 6.17.0-next-20251003 #1 PREEMPT(voluntary) [ 1778.991487] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1778.991500] Call Trace: [ 1778.991507] [ 1778.991516] dump_stack_lvl+0xfa/0x120 [ 1778.991548] should_fail_ex+0x4d7/0x5e0 [ 1778.991579] _copy_from_iter+0x1dc/0x1660 [ 1778.991607] ? lock_acquire+0x15e/0x2f0 [ 1778.991633] ? __virt_addr_valid+0x1c6/0x5d0 [ 1778.991667] ? find_held_lock+0x2b/0x80 [ 1778.991701] ? __pfx__copy_from_iter+0x10/0x10 [ 1778.991725] ? lock_release+0xc8/0x290 [ 1778.991755] ? __virt_addr_valid+0x100/0x5d0 [ 1778.991790] ? __check_object_size+0x57b/0x880 [ 1778.991821] hci_sock_sendmsg+0x402/0x2270 [ 1778.991856] ? perf_trace_lock+0xb5/0x5d0 [ 1778.991886] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 1778.991929] sock_write_iter+0x57e/0x610 [ 1778.991963] ? __pfx_sock_write_iter+0x10/0x10 [ 1778.992018] ? security_file_permission+0x22/0x90 [ 1778.992056] vfs_write+0xbe9/0x1150 [ 1778.992085] ? __pfx_sock_write_iter+0x10/0x10 [ 1778.992115] ? __fget_files+0x34/0x3b0 [ 1778.992141] ? __pfx_vfs_write+0x10/0x10 [ 1778.992193] ksys_write+0x1ef/0x240 [ 1778.992221] ? __pfx_ksys_write+0x10/0x10 [ 1778.992260] do_syscall_64+0xbf/0x390 [ 1778.992288] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1778.992310] RIP: 0033:0x7f4f07636b19 [ 1778.992326] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1778.992347] RSP: 002b:00007f4f04bac188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1778.992368] RAX: ffffffffffffffda RBX: 00007f4f07749f60 RCX: 00007f4f07636b19 [ 1778.992383] RDX: 0000000000000178 RSI: 00000000200007c0 RDI: 0000000000000004 [ 1778.992396] RBP: 00007f4f04bac1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1778.992408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1778.992421] R13: 00007ffd8140db8f R14: 00007f4f04bac300 R15: 0000000000022000 [ 1778.992453] 11:54:31 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) ioctl$sock_bt_hci(r0, 0x800448d7, &(0x7f0000000040)="b576b61abdcf5ccbea867114d3b2a67ebaa2cf60aed4cca3f959f64707a43a3d00453e2fe92686026c2f9fd09fa2bb16565f714061ce680392fb129283debba97007") write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) r1 = openat$incfs(0xffffffffffffffff, &(0x7f0000000140)='.pending_reads\x00', 0x10200, 0x62) syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), r1) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x48440, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000180)={0x0, 0x44e5, "d74f93", 0x0, 0x9}) 11:54:31 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x6, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:54:41 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) (fail_nth: 6) 11:54:41 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x1020, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:54:41 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, 0x0, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:54:41 executing program 7: r0 = perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1021, &(0x7f0000000080)) perf_event_open(&(0x7f0000000180)={0x4, 0x80, 0x40, 0x12, 0x81, 0x8, 0x0, 0x59, 0x10000, 0x8, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xd70, 0x1, @perf_bp={&(0x7f0000000140), 0x6}, 0x2400, 0x0, 0x1, 0x0, 0x7, 0xe427, 0xff, 0x0, 0x80000000, 0x0, 0x100004000}, 0xffffffffffffffff, 0x8, r0, 0x7) r1 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000080)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r2, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r1) 11:54:41 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x8, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:54:41 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xf4, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:54:41 executing program 0: sendmsg$DEVLINK_CMD_SB_POOL_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x1dc, 0x0, 0x2, 0x70bd2a, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x5}, {0x6, 0x11, 0x4}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x4}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x7}, {0x6}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x101}, {0x6, 0x11, 0x42ea}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x1000}, {0x6, 0x11, 0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}, {0x6}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x8}, {0x6, 0x11, 0x3}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x401}}]}, 0x1dc}}, 0xc800) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_io_uring_complete(0x0) bind$bt_hci(r1, &(0x7f0000000000), 0x0) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) 11:54:41 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x80000) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:54:41 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x80000) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:54:41 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 1788.662374] FAULT_INJECTION: forcing a failure. [ 1788.662374] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1788.663308] CPU: 0 UID: 0 PID: 13914 Comm: syz-executor.2 Not tainted 6.17.0-next-20251003 #1 PREEMPT(voluntary) [ 1788.663324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1788.663332] Call Trace: [ 1788.663336] [ 1788.663341] dump_stack_lvl+0xfa/0x120 [ 1788.663362] should_fail_ex+0x4d7/0x5e0 [ 1788.663380] _copy_to_user+0x32/0xd0 [ 1788.663398] simple_read_from_buffer+0xe0/0x180 [ 1788.663414] proc_fail_nth_read+0x18a/0x240 [ 1788.663433] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1788.663450] ? security_file_permission+0x22/0x90 [ 1788.663469] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1788.663485] vfs_read+0x1eb/0xc70 [ 1788.663505] ? __pfx_vfs_read+0x10/0x10 [ 1788.663520] ? lock_release+0xc8/0x290 [ 1788.663538] ? __fget_files+0x20d/0x3b0 [ 1788.663560] ksys_read+0x121/0x240 [ 1788.663574] ? __pfx_ksys_read+0x10/0x10 [ 1788.663595] do_syscall_64+0xbf/0x390 [ 1788.663611] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1788.663623] RIP: 0033:0x7f4f075e969c [ 1788.663633] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1788.663644] RSP: 002b:00007f4f04bac170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1788.663656] RAX: ffffffffffffffda RBX: 0000000000000178 RCX: 00007f4f075e969c [ 1788.663664] RDX: 000000000000000f RSI: 00007f4f04bac1e0 RDI: 0000000000000006 [ 1788.663671] RBP: 00007f4f04bac1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1788.663677] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1788.663684] R13: 00007ffd8140db8f R14: 00007f4f04bac300 R15: 0000000000022000 [ 1788.663702] 11:54:41 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = dup3(r0, r0, 0x0) write$bt_hci(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="01920c0700000000000072"], 0xb) ioctl$BTRFS_IOC_RESIZE(r1, 0x50009403, &(0x7f00000000c0)={{r1}, {@val, @actul_num={@val=0x2d, 0x8, 0x4b}}}) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000140)={{0x2, 0x2, 0x800000, 0x1, 0x3}, 0x10001, 0x7}) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x9}) epoll_ctl$EPOLL_CTL_MOD(r5, 0x3, r2, &(0x7f0000000100)={0x60000002}) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0x0, 0x2}, 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000200)=ANY=[], 0x178) 11:54:41 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 11:54:41 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x2000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:54:53 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x400, 0x15) 11:54:53 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, 0x0, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:54:53 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x300, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:54:53 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x300, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:54:53 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x3) 11:54:53 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x2010, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:54:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$bt_hci(r1, 0x0, 0x2, &(0x7f0000000180)=""/200, &(0x7f0000000040)=0xc8) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000100)=ANY=[@ANYBLOB="011302000100000018000000", @ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="5a1186d60ac2960522070f1aa295f8d0907438fa5a117ade484aff01d24bb0d12126367463eadbe871b1d972956bd1dcc5dbbc317533970368a05d75fa8d347d6e34cf8a1fd25e80ceb2a5a80100b58a8ca5ba8a227076aa1862fa1975"]) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000007f5a10c676183895941e9016b8d388f12dd83ea8aabdc85bf01677d648677d070f95a1c4ce74e423961da630fd752eb75e1942c6cdc263d16cc9dfb79124b3f794ddf104d5444ad2329e46693738950ca0560025bff11e6c62f08ed6ae23028caf9112359b0d63a998ae5aa4bdb951c9d16c355d9e712e5d3716b024a6d41d1ed005b44dd3f04eebfada71aab3a39fa58e35891040ae35063c1aff01a60116b194c32b9e"], 0x178) 11:54:53 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) r1 = dup(0xffffffffffffffff) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x80000) epoll_pwait2(r0, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:54:53 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x33a, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:54:53 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x404) 11:54:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r3 = fsmount(r1, 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000240)={0x20002003}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r1) sendmsg$TIPC_CMD_SHOW_PORTS(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, r4, 0x600, 0x70bd2a, 0x25dfdbfc, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x801}, 0x0) write$bt_hci(r1, &(0x7f0000000040)={0x1, @reject_conn_req={{0x40a, 0x7}}}, 0xb) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) 11:54:53 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x4000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:54:53 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x500, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:54:53 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x3c0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:54:53 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0xfdef) 11:55:05 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0xfffffdef) 11:55:05 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x600, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:05 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xedc0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:05 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:05 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x500, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:55:05 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) r1 = dup(0xffffffffffffffff) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x80000) epoll_pwait2(r0, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:05 executing program 7: syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r0, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/mcfilter6\x00') io_uring_enter(r1, 0x4527, 0x95a2, 0x0, &(0x7f00000000c0)={[0xfffffffffffffffc]}, 0x8) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) write$hidraw(r2, &(0x7f0000000400)="c2e0d8e4a717bd88a0044d49b14885f330d5777573508da3b3da170949c6297dc4bb059b904f511b15a9fdca280320ccbea9debd2f315f45735ef7386661f9bddf4bed02c34496f1ecf79cc9ad407057e5726b79dffc29438535225f1b3e3d7b582263a732ef634aec70f3a560d6459e35de52b5d0b6506ca7385a1a46f44ed2c338c370f85ea533be19f182e66810dfecfc44827a27dda1befa2976a1936e970e99af8f0d7855ffa37cc9c20bda9c8f4c4c27f1e1194efb2a57d86e656b9b17fce6fcc0a369a69b25d19537f6a87feda3a8477521336cd02b64b57c0af78cadc4d44078f56d6486bb6d87114bf7754628a7a037fc7f6c921989b8d4bb93378a256cee8b35cbed759dbb3bb3f7a93400850bfb4c058110f3b4557a6768064af49d20bd2de79b012eaf3e76b5ec4cc2fcd4d377d1deaf2e68312a3e93b07fe72b79498813aae1a6beb07b1488b86248a5d92396c9f31a57d3fd23b3ff55a05c2b0ee1aa94334a4197ceb776da3b3032663053c26ead23c910b779842110342add193c0b81cd6862ba2c8a225acccf13522991615d5d806ef2906840f0af94008d77160df34a3078852d9a97ac4c610cc6bd65066d8f568bbba5b80db69b18979ccbc513dd0c73d8b58159dd5123a7025afb2e0bbd0810e669c206513f96fb5c3e67c4527b4fd5ed19c3819ec53342265d54b892b00d6ef84bf8be970d1ba2c674586b36e0aa89a141274e224a5b8e8404a248d2d5706656e0fab6cc3b36e545eb74d5f7e44f8c7795b77be54605ae99cfbb19c6f459ff3b2dc9c635c29297cf8be320db874965d2599e4446a69a5dc3e6ff53fbf1b7465f2dc1a5cd29adf6d00a85b1073ee0b0a2f8d84b6d6548da948d0185561ee5c0edf471e5c0bfa164aef72135ee53bdff3fdfb9b443ad243000e987f8fa3bb32caed51924c289bbc58cf39d169425a1f3725bea2c31ed301fece6ffe390edf07474febb4ff9b3ea89dd64e9200c395df3a0772b995e6d8de1b7cd7b1e7ae4945de07feedc7423467179c693be9e031bae44a583b38838a7a6da483aab47cda22d76ab14edf73f58a2d934f60347a028626d9cc8c180a2e8b83213c07f5c18f9f884cc99ffbd87b5f7a581ea9e08753f17017cb190edc3e4b6d2e894bc4b1918bb5da2f96cf8f03e925c5ea3fc91bb62be85f79a51d881b907ddf8338458d806b6f8ece35618023ad1e7e953edde30bda5bbfce8fd58c4d2e2f7551581fe0dbff1a4574d53b2d56c93cf31aebeb23ebae6ef9c33e79bad0c636083cb9807cd03eb67700af847f32c0c5c79330f0ca51d5aeb5f502ead7beb036a661634df873ff9c76f7f9d2c878e8d4bfac8aa78c338310b43b5312a35e31def0db7ac8eba5d270458f1b0bb6ea2b7bed109869f484cf6170c0a103640f35ac4a357f41bfb848aa1d40dc3a438cda734525f489f91fe1ab2a446ab9a43a164699699fc71d7f6b41e1355d5771cba7f54fed9d45c698bd2ae06267751e02eb851a1aff55b11862581c48203cf83be40f53aade7389aee05d4202397322c3264efb01636ac9f2a5b097db6315ff324807c35636a640262a8f81f3b05a07490bfd58a3126c34f971385b5b3b4388fa918cd6c2b0d654d9936865bd23399b88405628a4a74b30c3ef613b96369aa2d44dbef44a4a61f5033d64506b4509fe251f0f25ccc2e01c3eb7c87ac041e575a72bb0ef0181e73c037e2f19fbaec037462221b4d801fc95d8426267d2876f0cb9991141043a6ff4cba9c06be0c355de09fa2a145c904c25375facb3131cd9af2057f4d62b9eb1abdeff7e58b003fb1d458b98d3435ef368f0573186df43f5e85cc7ec952b7a636ceca972c4aacb34305fd724dd01c53b9f0c66b519ce29a9a9752a87ee5604ef977bfcacb04770b3c772a998930e6f5b4dac765b0e80e1ad78ace0c99e5b45dd6d40297f8d13f36d347ac56933db5c0825efbe674911ff88d566c3640c0283a9c026699903645a1781d457c00622976277d09f6d980c8ca23d84be0640586dc3016cac4edae0b3bea643522d323c8fc7f26072cc3295dcd52d9b439d94649ab5ebe68a6796fa95ce32a3d69112471162b33b2db393ff36dc26f073154c90c335d834473c35a64c323fc2ffa15e0a94a740337210d11b654298aecfb1cd455d5a9dfad60591c5fde4885f670e6649799735ab7b66664292cc63f62a3b455dfaeb26fc111b6ce9f1e7442a2bc8b80ff466194f5ceef1dfa6822e5bcbc435657bc9c05e6de785bad19da8ef1174bd5d97c497d01609ed9c81b43091e5fece8798587b3f57a09f794a85d78ef38a233e22535cc8820ab4ea7b7538ec701556c12112a0e30aaed9a0870d9bb0ebed7f0b5844b2228e75d133a1525375d3ab6ae4961101583de17fc18faf6563d3b917a3b327b5a71d342a4df6a2f0ee5b258378d2dffe1ceff4cfe2ffe41e3988ac30b6c0dfaf5d2ee5c2c24e2eb8d420bd63c32d663c46939370c738c25467569bc9e3ec03f9b79582c26c30ff168d81e3eb987c99aa7d97d28c16155367a7adf57e9025799955c340d5e3bb639bb410460fe820a59aa3ca85621512ca129617ef13574a80b3695e88ede448fe90ed4b7ccce27ff921b31fc8cfc535848c1875e020c5b19101100b210aa28470be00e3e7a04c1f43a3874e6eb9f1879f09bc3ac9322d7af158d260ee8fe36f32d2af6b88b5ada19f3ff63b46a5802eabc500014d172c0cb02f07a8247cf35a3082c648ca3373eaefb0becf4ecd51e768c4fd0e66a9ca3fe3bd87a34c72616ef85c562d72045d811077ef26aa581dab3b1db6578ef0df80f8bfac843916bf7bc54ae19d94aec450810608f6324a2ce9cff3109436dffb359546dbb42b9ffd697657027d96f437b6ed6095f67063761ad73278aac4107b506efa2d49da6858fb42eeab45425a1946016023cd5a4b7ba1ee176255328d214ad3d0b8676e8498e149ba95bb547fd68d22c50aa5842f3a2688c1809e99876189b02ca3d3e0d43507ce334bda43257e105f9be725acf6f8871cd0150f4a2119e344ef1efdb4b14ccdfb8533f780273d08a1ed69edcdc871cab36d0e682398aa03cade9ce53d265c024cf790d446b282e5dd1e9cff2ddf4e80f31f943af627db4882cfc6b8bcdb4f16180abafbdcfe3222ab13152842b5bce746775fd050a036b0dde909e9db84d382e4179dcbae5021f221ebca4b5de99dcd078626cf0c9ff70912a3947ec765fb8f3d35d6bc0f2b660c46ed74bd33fd1facdeda2abb854ab76f7c948dda20be5a291bc58d9e2e3cf34b4e7bea1209bd683d097c774775f92af8e56e8f09902c899a6ab2381fb8f5aa87872a745be835bd6b45b1013185486bda86ea5a8d77f060294d0643748a21f3fb343dc4866006f9887f75d14158e34af7b9b55f37fb80a26c12d0f06b1f2251cf7df8b9946fc9d406d081ad130ad771bdcc1b4bf2cbb211706ba0a88b35060893358dee65a4f25be08e657d70f50c6423f6fd19cdf9c063cf4ef3f38beb42471eec1a1e3572ae52de2fd435843dfa69337b7d73f3a82614ffc9e5e2e885fe51d5f0d424509f5ba37f47f428dae2ca6cd2213983eeb85133de4fddcef0f2808ae6c9c172d33c194d64543a444d65d96b49c9ce90b12f956c180925079ccfe2dbd7e75bbb28323e699546c21d1c9f0dbdfc0afaf02328b9392d87fb0a0bf64a59ac0efe54b153cd06499d7b567effa42b4fde62eeafebe5af23c2482ea825bd0f594b2ce0cae0fe1b376bb5a10794f58252e551779eeec8f24c771abb13ab72295c57dd72a97367328073852622f8307d259036601818f8bb1dc1764cf192e164a472c6b0d01205e89a31ec3f4202969fc8bfd961df39e9fa2a13da4fc096732cc3bfde12c6b4f257809f54033dbcf5358bfdfb17c2f6bf7c5e6353cbc5bb6af30b20e56b41cc29f0d85cd85e067120022ca48db95176eb6df076e8c86f9d65b049f0be28b1be06d236ede418c528cdc90db6907a2fae8b3f656f0f26113ba80c065cdef6e366ec7ca29f5905584d0693a9b0e13596bd05c14dbcd49dcb7cb10fdfd7c5365e0cc68640b3beba169bed436c5f937d2c274f4c338f6437659a55b0722d4310129d0b827dfded03a3e2ed2c7bedc90701894b17270cf953df448830c0dedf73715c56f60bb8ee62311cc66b1ecae6d712d5fd019d42aba4ef18a2c804501492485dd663f0ded2a7c249fecbeb8edd5428c0723f25908560b973f681d3f6845fc1d63362799fe51b98a3e16ad6790f061e47575e7a519fcf22600eb4b384a78f779ccac65ce00076d69d3d28bf167cd836f3ed9a5c78f553831c89c337aa92e36e43d2cbec65e459bd7c0189a7370a7c228221c6112ae16ff4176feca517c4c5ecde01595f39a493540ba4eb7783d0c29f198bdc469872318b56aedc948de531d4f260851931d5bf7095e99321095ba3feaf4094c61e72afbc9716d41d2dc266a94564b3907dd3b19d4ef59f7a30ce044fa809138ba30589d396bec503c7a8f1494fe2d05de91a15e2ed02844bbbdef29c3a85748df6c2ea587b66726a1d2fa82adfdc469f18a92a948343e296673ec47e2dfcfa2648fd7add7f495807187fa83516dbb99aeb419d05aef65977356e134e8ac87fe9845b08b71add4dc2a3fba8798579e7c1ff87b2b752ed3454f9e4cfa87057e897c32d0209b7f1d1ab85d74cfa3cdc77cc48a8375629bc4273110c622d484dfcdfc6a5b4e02098c5397559d13114d9b265753e2f1cf94cfbda902f87bcac4a5fcca3056a4ecf0ea00c6cff129eb90a54291ee688b2bb58cb81123736b8b05050fbf1fa454cd6462383ef320d6205717782aa2747d87a60248aada7f2152474da12af93f4ed454b0bfc4927a17b2c24abb2e4a85dd6da3a6885e50d4fbe5f01308d3276d59293ece25c00f22d0f62b0c6383ca0d98645ced2d20d8a4bcf7a1c1fd603400eb4fa33b61fe987416189b06af8135ca16dba9bc535c02f7121803df2b6943f10e19defb72856a8df6f9580c438c7f69c258d75fc08a98b0e7e7687173a6d9466db5a2ae184798c3d1d8ed458b76a6aef5c0873ed6078da000d7c6c021851a951bb5cbb90490770de3850bac79cc4d24e58d19b7f4e488b681898734413f534509f1badf070822fa7148772a74fcd19dc077be7cdc6794526167c5356dd2e7279a54c7e90662405a58a8b8c4cb6e04bb7b15e6ffd5a9e6b648f93db92a2641a1b5f3867054c4f7394d0168dd413c732f8008220c29fdd1bc6caf6f86b34352633b475a6cef66b26d2321ed41a6262e1e77b7c371dfba7b4f0cc5ff776d4aaec5d70ad29ebf0a4643381342dbc8da9b4ed4dba89bdf6ddedc6f96a9d4c1dfdad20382c7faf8ceec168b114508bebd0aa220de4122b72f7494509f51a1ebafbb25f179bffe0092851b5ee5acd162fd39838fa1f3cb158c33dfa5b1a790a91a4e5386e95508b05d0110f26e93606ed59eebf00a1a622c5a71abf6900d0944bf7dd9959361f5e2339f104ed928035439ba7ebb37c5002ea5551d8177c600a6a7cdf2394095d83439db64f62e2f41f9f7555d893619ef1a1728632fdd8886c036c953be85a23a972b46f9c8969464117e0832704ac2441a57bd730311a764a87193181b70f323d3f8eefba8fc55b118a2acdd8ef1d3137e12da1ef92927fc00c6ca83ecdc19fbb0d2db516f64dc77a210be2b4d7d0d1b499a8968968060e405c219e922298b685f71e8f58e31e065030b65b83fa6294f5949a2e7fb7c244ddbe62b63cc5fac66", 0x1000) 11:55:05 executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)={0x200b}) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x3}, 0xffffffffffffffbd) 11:55:05 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xfeff, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:05 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0xfffffffffffffdef) 11:55:05 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xfffe, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:05 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x810, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:05 executing program 0: r0 = syz_open_dev$mouse(&(0x7f0000000040), 0xc0000000, 0x80004) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) sendmsg$NL80211_CMD_LEAVE_MESH(r0, &(0x7f00000002c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB="20100000", @ANYRES16=0x0, @ANYBLOB="00042abd7000fddbdf25450000000c0099008d47000029000000"], 0x20}, 0x1, 0x0, 0x0, 0x40440c4}, 0x20008085) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x8300, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000000), 0x6) ioctl$sock_bt_hci(r2, 0x400448e3, &(0x7f0000000100)="f6717666aa1ba27a2f528c805a3bf3628cca5b2fddac7cf8f43a72ac65467edf8fca6971c2b2b17b21ef687f7944dbff19b594dc4417c77f4c4d36b1c7765f2e6f3d0a06dd1736c859975e780dad23def450450e89009589494d267492fe41601cadab15df6d21acb2d813446075c84baff448d140bc95361ce7fccb469f857e02c679c278e9370142139fbb6be4ff9850320d5944d3359127b0f686c81a7ca87bc5513253035d8a54777cf0ffc3aa57e040e6f25ea328b72fa7e8b59cb733101e3c1421fb89c899a1757b38320580fc781ffcfb1518d86ab91aefe25c9e33ab9559804e3ca36e5807ec4092e7cc6e0e267bb4") write$bt_hci(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="b302000000000000"], 0x178) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000380)={0xa8, 0x0, 0x8, "1637b3519603cb3deeb44133dea191485cf5ba8b12b24f818412f13a57a83034810162e87cd225eb45120b59e261615df5c73154b78d0dddf2bff84b517d7eff7a4a47ae09a31cb6ef0964ac374fd29d338aa58fe4288c0d7ae0b639125e9b0d6965d4516160602295bcb19f1ebffc48abde558e8990024cd64b32884a44ca87f2c56b8db5d3d8af2f51986444433791b74684db58683eeb687c1efb5eee5392a84de5d18667bad8"}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) ioctl$LOOP_SET_FD(r3, 0x4c00, r2) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f00000004c0)={{r5}, 0x0, 0x18, @inherit={0x60, &(0x7f0000000440)={0x0, 0x3, 0x2, 0xfffffffffffeffff, {0x3b, 0x2, 0x4, 0x89, 0x55f9}, [0x2, 0x7f, 0x9]}}, @subvolid=0xffffffffffffff36}) 11:55:05 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x600, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:55:06 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x1008, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:06 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x40000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:06 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) lstat(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) clone3(&(0x7f0000000b80)={0x40000, &(0x7f0000000900)=0xffffffffffffffff, &(0x7f0000000940), &(0x7f0000000980), {0x26}, &(0x7f00000009c0)=""/172, 0xac, &(0x7f0000000a80)=""/190, &(0x7f0000000b40)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x3}, 0x58) r4 = syz_io_uring_complete(0x0) r5 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r6 = socket$inet(0x2, 0x80000, 0x4581) r7 = perf_event_open$cgroup(&(0x7f0000000c40)={0x5, 0x80, 0x4, 0x9, 0x3f, 0x6, 0x0, 0x800, 0x90443, 0x9, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x3, 0x4, @perf_bp={&(0x7f0000000c00), 0x8}, 0x10, 0x132, 0x8100, 0x6, 0x0, 0x5, 0x1, 0x0, 0x7f, 0x0, 0x6}, 0xffffffffffffffff, 0xd, 0xffffffffffffffff, 0x3) newfstatat(0xffffffffffffff9c, 0x0, &(0x7f0000002640)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1100) setresuid(0x0, r8, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f00000085c0)={0x0, 0x0, 0x0}, &(0x7f0000008600)=0xc) setresgid(r10, 0x0, 0xee01) setgroups(0x3, &(0x7f0000000340)=[r10, 0x0, 0x0]) stat(&(0x7f0000000cc0)='./file0\x00', &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0}) r12 = getgid() sendmsg$unix(0xffffffffffffffff, &(0x7f0000000ec0)={&(0x7f0000000080)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000000640)=[{&(0x7f0000000100)="2e81f3291e29411612bd2ab9c5d19264a466be45053c4c2b", 0x18}, {&(0x7f0000000140)="8943af3f465aa2c0809d7cc28e682df89f891a6b21b280fd155584b2a84c766ef9e3eaffb137bde34fb65621ccb8aaf4e6652dc17c6c5406c88778df379cb96d7e1ad7cc569b6f44e75598d383e04d8c8d0c0b09deb2f6a7552c79c0121935da90edf4ab3beed641f053fdd246e29e3be25d7272e6ce55e60defb3e156e4e7538fb8d3fe36266c3435ad78431384818a0f09126f9708a6a0fbbdd57b7a64a97b", 0xa0}, {&(0x7f0000000200)="18f43856a3c933c6eae78274e4a22d216a9f6b613b81c26659c0bcc549b99bc39c81ceac30942e827ba71a4ee681c6c1620025e7f951f4437614f934c9636e770d1de653c9e68c115d327ec07b69c0b6cc88eb3b2abd934bc43c2e2696587f3f7413745bdbac52555d511438ace77add7e02e66d68a033fdb575fe4ffdcc38065d8b7685ebd2a3f8039c2ab2e3a83eec561c3af36618f97bbbb9ff2e5e074c53eb8d2e7ebf0054bbb74f29eb6992bb93d65c4d29faae67b04ae4cbb789042d6ba30994112d2d3809", 0xc8}, {&(0x7f0000000300)="ee70119d6d83afc19e527abe38743a7dd0c0cf60dd99d7e17f36538ccb202c671c6f40e61f08312e20eb7a43ce85eeaf0f13249b956b0a0cc42456d19c1d6cbcd431eac561ee67431e171ddfe0210f8b1523b8e7c66bf3c0a51836b521", 0x5d}, {&(0x7f0000000380)="ffd2e88ea0ccd479cdbf53eca0297e6fee64b425cf7f3225d45be24a66f852f7b4378ac7d542c9a03c819efbc80fa7285589308f908e8e2bcb114afec9aa25e907f817790daf7c5c03eb690dead92272c8353598764e9d223cb31c0b", 0x5c}, {&(0x7f0000000400)="dc64b628790023da5db31aae5a50fb1d2e82e8500fe105859d2d1c85413b92cd7729e824d8dfb890f4ecc4c53ca1e71ff6ca75ac41fada30fe0da9972b2a3fb312c456131e988c5589912683b2eab2fcfecce754fc9d1fbb6ca4ee09d1e0042de471b625fd215a052be847becc6b03bce6d49b8a18b275a4a1730740121651653b3b9d2030a4741d00b31a50d092ae36a297651fde719ddc3e840f6b1ab12603aec7f8812a5aac3a48a6b308ea96786206b08e8abc8dd6f241ae026ccb30b3adfffafe6dc7956688d8c5d018b7c5e05dfc731b3852e0c97a1f4406b465e6b0", 0xdf}, {&(0x7f0000000500)="f8b751f930f9f0674dd3b158", 0xc}, {&(0x7f0000000540)="32c193da158f7e298d9719ec8992f4715849fbf6fb7774851b8da760827fc013a5c724a0871d092e269aa6c0b78379ddaaeca807db69f1c0c8ebafd00577c1f40d8268634df22cebd099161a9af2fb57a2b1f089bffdc19e67addd94e09f3e020f918e197c2402db7564c97bb687dcaee274264153b959aed3bce7848d99045c43780378e9af8984ebe99c7a83bb2da84f66561eef0fc2cd9b216ef15dfb1d1dc540ca8bd3ad082e2ee1525a7f1a0c2413a9028c62205e7b90ffcea48feba4d36e97585fc3318eb97ffa3fd40ac3df7f76f175a9c5be05132c28463a511e63bd121f9903339f724dfd1c", 0xea}], 0x8, &(0x7f0000000d80)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0xffffffffffffffff, 0xee00}}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xee01}}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xee01}}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0x0, r2}}}, @rights={{0x30, 0x1, 0x1, [r3, r1, r4, 0xffffffffffffffff, r5, r6, r0, r7]}}, @rights={{0x14, 0x1, 0x1, [r1]}}, @rights={{0x18, 0x1, 0x1, [r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r8, r10}}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r11, r12}}}], 0x120, 0x40000}, 0x20008000) r13 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r13], 0x178) 11:55:06 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x1002, 0x3}, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1800) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4c23, @private=0xa010102}, 0x10) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYRES16], 0x178) recvmmsg(r0, &(0x7f0000002540)=[{{&(0x7f00000000c0)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000140)=""/6, 0x6}], 0x1, &(0x7f00000001c0)=""/168, 0xa8}, 0x7}, {{&(0x7f0000000280)=@pppoe={0x18, 0x0, {0x0, @random}}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000300)=""/250, 0xfa}, {&(0x7f0000000400)}, {&(0x7f0000000440)=""/11, 0xb}, {&(0x7f0000000480)=""/29, 0x1d}, {&(0x7f00000004c0)=""/90, 0x5a}, {&(0x7f0000000540)=""/78, 0x4e}, {&(0x7f00000005c0)=""/9, 0x9}, {&(0x7f0000000600)=""/67, 0x43}], 0x8, &(0x7f0000000700)=""/110, 0x6e}, 0x7}, {{&(0x7f0000000780)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000000dc0)=[{&(0x7f0000000800)=""/85, 0x55}, {&(0x7f0000000880)=""/252, 0xfc}, {&(0x7f0000000980)=""/254, 0xfe}, {&(0x7f0000000a80)=""/236, 0xec}, {&(0x7f0000000b80)=""/11, 0xb}, {&(0x7f0000000bc0)=""/229, 0xe5}, {&(0x7f0000000cc0)=""/87, 0x57}, {&(0x7f0000000d40)=""/73, 0x49}], 0x8, &(0x7f0000000e40)=""/93, 0x5d}, 0x7}, {{&(0x7f0000000ec0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f0000002400)=[{&(0x7f0000000f40)=""/27, 0x1b}, {&(0x7f0000000f80)=""/146, 0x92}, {&(0x7f0000001040)=""/180, 0xb4}, {&(0x7f0000001100)=""/184, 0xb8}, {&(0x7f00000011c0)=""/137, 0x89}, {&(0x7f0000001280)=""/66, 0x42}, {&(0x7f0000001300)=""/119, 0x77}, {&(0x7f0000001380)=""/4096, 0x1000}, {&(0x7f0000002380)=""/77, 0x4d}], 0x9, &(0x7f00000024c0)=""/122, 0x7a}, 0x6}], 0x4, 0x10001, &(0x7f0000002640)={0x0, 0x989680}) 11:55:06 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x4000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:16 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="42ff03000047d5e9"], 0x178) setsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000040)=0x2, 0x4) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r3 = accept$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @broadcast}, &(0x7f0000000280)=0x10) ioctl$sock_inet_SIOCGIFDSTADDR(r3, 0x8917, &(0x7f00000002c0)={'nr0\x00', {0x2, 0x0, @private}}) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) bind$bt_hci(r4, &(0x7f0000000300)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$sock_bt_hci(r1, 0x400448e0, &(0x7f0000000100)="2c441fa2becd8bfab925cf24db962f1be1782a39ae59ea231fea6dbb9ad9e01216018918f44b24bbeb27b968d8ee24a18c1205f5bbd9fb0d372000b6183ecc688cfaabcf34361030144f7aa81a5e0e2b8a9d5b0f7fd7522bf1fa871c6e1ba8458e025548a36ce34f1a5ff43eaf6484d409a97be90654e5f3be3cb4a22a85c0ca929248c81e11188043377fc199e97991d07041cf5ed9c2761488a1c1b1af44a45f56d95b8c6fde8335ed1120ea4c714a02ca3c09ec9bbe0e91cbb0d0f465bb724c06ab966d9619fe0ffbb7e5d1d3d4b355221c1e062f498595e897aed0314a8f23fd32") 11:55:16 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x700, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:55:16 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x11000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:16 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) write$bt_hci(r1, &(0x7f00000007c0)=ANY=[@ANYRES16=r0], 0x178) 11:55:16 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) r1 = dup(0xffffffffffffffff) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x80000) epoll_pwait2(r0, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:16 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:16 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)=0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x8043, 0x10) pwrite64(r2, &(0x7f0000000140)=' ', 0x1, 0x99ad) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x1000)=nil, 0x1000, 0x7, 0x13, r2, 0x0) syz_io_uring_complete(r3) syz_io_uring_submit(r3, r1, &(0x7f0000000080)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1}, 0x6) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r4, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) 11:55:16 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x80000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:16 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0x7, 0x0, 0x1}, {0x9, 0x86, 0x6, 0x80000001}]}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32], 0x178) 11:55:16 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x1000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:16 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:16 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x34000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:25 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x2000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:25 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000040)=0x2, 0x2) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r6 = epoll_create1(0x0) epoll_pwait2(r6, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000240)={0x200b}) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e24, @remote}, 0x10) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$bt_hci(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB="00006168df28d2f58d359340058ddd0025d600"/28, @ANYRESHEX=r6, @ANYBLOB="4ade4e81b3b2f9415b99e5f383506b664eb8785ae7e45a6bb30ad987309e45f25b88263532855c5ce06601ada7b99fe4784c2c99faf3afff802c55429ddb06654f2875834dc1c1076cec1b974f72ad67bb059c465caf67884460fc3270a7f772f09479bfc5cd7e14e7b18419e6ad3329a5c459df5671112e0c3baaa51d4f22eadfff78ba6b58e18ade809742317dc5ad4b70a0d43587788298a448cf8d2690d315", @ANYRES16=r8, @ANYRESDEC=r2, @ANYRESOCT=r7, @ANYBLOB="6fe64bfb01000000000000002ff1b08da8e083b3e6122f60e4", @ANYRESDEC=r1], 0x178) 11:55:25 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x900, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:55:25 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fcntl$dupfd(r0, 0x0, r0) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4, 0x3}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) 11:55:25 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x80000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:25 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:25 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10, 0x0, 0x40800}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close(r0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)={0x40000005}) openat(r0, &(0x7f0000000080)='./file0\x00', 0x10040, 0x8) 11:55:25 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:25 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x100100, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:25 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:25 executing program 7: pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r0, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(0xffffffffffffffff) 11:55:25 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xd00, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:55:25 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) readv(r0, &(0x7f0000001640)=[{&(0x7f0000000040)=""/50, 0x32}, {&(0x7f0000000100)=""/237, 0xed}, {&(0x7f0000000200)=""/150, 0x96}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f0000000080)}, {&(0x7f00000012c0)=""/104, 0x68}, {&(0x7f0000001340)=""/46, 0x2e}, {&(0x7f0000001380)=""/243, 0xf3}, {&(0x7f0000001480)=""/197, 0xc5}, {&(0x7f0000001580)=""/129, 0x81}], 0xa) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000080)={r0, 0xffffffff, 0x81, 0xf65}) read(r1, &(0x7f0000001700)=""/202, 0xca) 11:55:25 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:25 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x3000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:25 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x400300, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:25 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x1100, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:55:25 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff}, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) perf_event_open(&(0x7f0000000080)={0x4, 0x80, 0xff, 0x3, 0x7, 0xe1, 0x0, 0x10001, 0x40, 0xd, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0xff, 0x1, @perf_bp={&(0x7f0000000040), 0x2}, 0x40, 0x3, 0x98, 0x3, 0x9, 0x7f, 0x585, 0x0, 0xff, 0x0, 0xffffffffffffc537}, 0x0, 0x5, 0xffffffffffffffff, 0x3) 11:55:25 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x1000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:36 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x2000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:36 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x7000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:36 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) clock_gettime(0x0, &(0x7f00000051c0)={0x0, 0x0}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) write$bt_hci(r3, &(0x7f0000005280)={0x1, @delete_stored_link_key={{0xc12, 0x7}, {@none, 0x5b}}}, 0xb) recvmmsg(0xffffffffffffffff, &(0x7f0000005080)=[{{&(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000002280)=[{&(0x7f0000005380)=""/4096, 0x1000}, {&(0x7f0000001100)=""/4096, 0x1000}, {&(0x7f0000002100)=""/196, 0xc4}, {&(0x7f0000002200)=""/96, 0x60}], 0x4, &(0x7f00000022c0)=""/242, 0xf2}, 0x5f}, {{&(0x7f00000023c0)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000002640)=[{&(0x7f0000002440)=""/229, 0xe5}, {&(0x7f0000002540)=""/232, 0xe8}], 0x2}, 0xdb7}, {{&(0x7f0000002680)=@alg, 0x80, &(0x7f0000003840)=[{&(0x7f0000002700)=""/99, 0x63}, {&(0x7f0000002780)=""/174, 0xae}, {&(0x7f0000002840)=""/4096, 0x1000}], 0x3, &(0x7f0000003880)=""/225, 0xe1}, 0xe77}, {{&(0x7f0000003980)=@phonet, 0x80, &(0x7f0000003b00)=[{&(0x7f0000003a00)=""/57, 0x39}, {&(0x7f00000052c0)=""/162, 0xa2}], 0x2}, 0x2}, {{&(0x7f0000003b40)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f0000005000)}, 0x5}], 0x5, 0x0, &(0x7f0000005200)={r1, r2+10000000}) ioctl$HCIINQUIRY(r5, 0x800448f0, &(0x7f0000005240)={0x1, 0x31, "f7652c", 0x81, 0x56}) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) 11:55:36 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:36 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYRES64], 0x178) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x8917, &(0x7f0000000080)={'ip_vti0\x00', {0x2, 0x0, @private}}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f00000000c0)) 11:55:36 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:36 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) memfd_secret(0x80000) close(r0) perf_event_open$cgroup(&(0x7f0000000180)={0x2, 0x80, 0x8, 0x7, 0x9, 0x2, 0x0, 0x100000001, 0x0, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x800, 0x0, @perf_bp={&(0x7f0000000080)}, 0x400, 0x3, 0x7249, 0x8, 0x4, 0x5, 0xb1, 0x0, 0x6, 0x0, 0x6}, r2, 0x0, 0xffffffffffffffff, 0x4) 11:55:36 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x2000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:55:36 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x3000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:36 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x8000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:36 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x4000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:36 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000080)=ANY=[@ANYRES32=r0], 0x178) ioctl$sock_bt_hci(r0, 0x400448cc, &(0x7f0000000040)="e951bf69408856896405c6aa2c6ea7efba498e43bef6e6") 11:55:36 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000040)={@in={{0x2, 0x4e22, @broadcast}}, 0x0, 0x0, 0xf, 0x0, "d81fde83de42cc699de2ef831e42462a8f2f1acb3bd762286478ac5fdf757aac3d73a01804fbb1296b2eff30d08427f6e4398bda923fb82dd9a8f949add2ac8f1bbf2d9065c479b8616e6fee027960a7"}, 0xd8) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) 11:55:46 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x800) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x800) syz_io_uring_setup(0x6c32, &(0x7f0000000180)={0x0, 0xbaee, 0x0, 0x2, 0x8, 0x0, r2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f00000000c0), &(0x7f0000000200)) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) 11:55:46 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_bt_hci(r1, 0x800448d3, &(0x7f0000000100)="16c48bb914d79831dd8aa58673e34d332e95d7c6c27d7d2195dfad30ae31f8cd6150c14b1dc780fb0055621a49da7d145003f0d0cfa9c5f602e22b488e16a29d0a3c98d94a732c2e7ec5efd57db81257e1be93734cca5c5276db011b8a01464a163fe6e7ea77720049acef9fb971705f5b1778aced5e1a859b424c517f53a9bd976157ab2be7d7b196537370c9aa") 11:55:46 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:46 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x10}, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000080)="55faca3d4a1b0e1d5c36c66fcd1c15d1", 0x10) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x1, 0x4}, 0x6) r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) 11:55:46 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x5000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:46 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x3a03, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:55:46 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x8100000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:46 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:46 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x9000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:46 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x6000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:46 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0x1ff, 0x4) write$bt_hci(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="386476f3eed025a403"], 0x178) 11:55:46 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4}, 0x1e) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) r2 = socket$inet_tcp(0x2, 0x1, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000100)='vegas\x00', 0x6) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x2400, 0x0) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) fsconfig$FSCONFIG_SET_FLAG(r4, 0x0, &(0x7f0000000140)='nomand\x00', 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$FS_IOC_FSSETXATTR(r6, 0x401c5820, &(0x7f0000000180)={0x3, 0x81, 0x6, 0x1, 0x7}) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000280)=0x4) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x4e22, @loopback}, {0x2, 0x4e20, @broadcast}, {0x2, 0x4e24, @remote}, 0x10, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000040)='bond_slave_1\x00', 0x7812, 0x4, 0x6}) 11:55:46 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000080)) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000500), 0x80001, 0x0) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(r3, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x4c, r4, 0x2, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xfffffffe}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x1f}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xffffff51}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20041050}, 0x40) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x54, r4, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x100}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040002) sendmsg$TIPC_NL_LINK_GET(r1, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0xf4, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}]}, @TIPC_NLA_LINK={0x28, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}]}]}, @TIPC_NLA_MEDIA={0x68, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9575}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffc0000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x319b02be}]}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0x40000c0}, 0x20000004) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) 11:55:46 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xa000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:46 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x3f00, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:55:46 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x8100000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:46 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x208800, 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="a569676e0e04ba1e6202"], 0x178) 11:55:46 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xb000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:55 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x10000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:55 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x4000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:55:55 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x10000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:55 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)={0x200b}) r2 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000280)={0x0, 0xdc3f, 0x10, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000180), &(0x7f0000000140)) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r3) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x0) readv(r5, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) mkdirat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x4) close(r2) 11:55:55 executing program 1: openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r0 = epoll_create1(0x0) r1 = dup(0xffffffffffffffff) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x80000) epoll_pwait2(r0, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:55 executing program 0: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xd00, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:55:55 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) ioctl$sock_bt_hci(r0, 0x800448d4, &(0x7f0000000340)="9ccef4a411ce48c9d7e738f411b10314881a10d2f42e414e6aea072fda2970bee1e6b580c61b4a612d46ca5aa102f29e12911d9e27e571b3b5b3dcb6790868db2ecead60e248bfdd7601cfb9fce4e3361434211db0dd22178b55b5d3acce8b0d9ee4c7295349715316e60190f933c35585628a738937322756beba430b8796a8aa7a7a1cd08fcbf289cd7235e6d7") r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="0137eb1a370483"], 0x7) r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) r3 = getpid() r4 = socket(0x2, 0x2, 0xffffff80) getsockopt$inet_tcp_buf(r4, 0x6, 0x1a, &(0x7f0000000400)=""/217, &(0x7f0000000200)=0xd9) get_robust_list(r3, &(0x7f00000002c0)=0x0, &(0x7f0000000300)) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r6 = epoll_create1(0x0) epoll_pwait2(r6, &(0x7f0000000280), 0x0, 0x0, 0x0, 0x0) r7 = fcntl$dupfd(r5, 0x0, r1) ioctl$sock_TIOCINQ(r7, 0x541b, &(0x7f0000000140)) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000240)={0x200b}) ioctl$HCIINQUIRY(r7, 0x800448f0, &(0x7f0000000080)={0x2, 0x2, "14547f", 0x3}) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x3, 0x0, 0xdd, 0x9, 0x0, 0x1, 0x40400, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9665, 0x0, @perf_bp={&(0x7f0000000180), 0x8}, 0x0, 0x101, 0x800, 0x4, 0xfee, 0x4, 0x8001, 0x0, 0x800000, 0x0, 0x9}, r3, 0xd, r5, 0x8) 11:55:55 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:55:55 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x600, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:55 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0x4, 0x2}, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) write$bt_hci(r3, &(0x7f0000000100)=ANY=[], 0x178) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r1, 0xf504, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc1, 0x3) 11:55:55 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x20000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:55:55 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xc003, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:55:55 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x40000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:55:55 executing program 0: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x300, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:55:55 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xe000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:56:04 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x20100000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:56:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000080)={0x1, @io_capability_neg_reply={{0x434, 0x7}, {@none, 0x3}}}, 0xb) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)={0x1, @link_key_neg_reply={{0x40c, 0x6}, {@none}}}, 0xa) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x0, &(0x7f00000000c0)=0x1, 0x4) 11:56:04 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) ioctl$sock_bt_hci(r0, 0x800448d7, &(0x7f0000000040)="b576b61abdcf5ccbea867114d3b2a67ebaa2cf60aed4cca3f959f64707a43a3d00453e2fe92686026c2f9fd09fa2bb16565f714061ce680392fb129283debba97007") write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02"], 0x178) r1 = openat$incfs(0xffffffffffffffff, &(0x7f0000000140)='.pending_reads\x00', 0x10200, 0x62) syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), r1) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x48440, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000180)={0x0, 0x44e5, "d74f93", 0x0, 0x9}) 11:56:04 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xf400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:56:04 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:56:04 executing program 1: openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r0 = epoll_create1(0x0) r1 = dup(0xffffffffffffffff) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x80000) epoll_pwait2(r0, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:56:04 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/rcu_expedited', 0x8000, 0x4) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f00000000c0)=0xd55) close(r0) 11:56:04 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x8000000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:05 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x10010000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:05 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x40000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:56:05 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x40030000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:05 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) write$bt_hci(r2, &(0x7f0000000040)={0x1, @write_class_of_dev={{0xc24, 0x3}, {"fa3c29"}}}, 0x7) 11:56:05 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x8cffffff, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:56:05 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x6, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:05 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x100000000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:05 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xc0ed0000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:56:05 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x20010, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:56:05 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) write$bt_hci(r0, &(0x7f0000000000)={0x1, @le_set_default_phy={{0x2031, 0x3}, {0x4, 0x37, 0x3}}}, 0x7) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 11:56:05 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x200000000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:05 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xf6ffffff, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 1874.522052] Bluetooth: hci0: command 0x0406 tx timeout [ 1876.570202] Bluetooth: hci0: command 0x0406 tx timeout [ 1878.618080] Bluetooth: hci0: command 0x0406 tx timeout 11:56:14 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10, 0x3}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000080)) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) ioctl$BTRFS_IOC_QGROUP_CREATE(r2, 0x4010942a, &(0x7f00000000c0)={0x0, 0x3ff}) 11:56:14 executing program 1: openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r0 = epoll_create1(0x0) r1 = dup(0xffffffffffffffff) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x80000) epoll_pwait2(r0, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:56:14 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x20200, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:56:14 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xfeff0000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:56:14 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x300000000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:14 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, @in_args={0x2}}, './file0\x00'}) ioctl$sock_bt_hci(r1, 0x800448d4, &(0x7f0000000080)="35e3125a517782882f944953a9653c6d8eb2fe2bbf95af8e8f33762c3b4f03f7bfbda75b6be911b3e00e0905c9568f6d01223dc69b5000662ac1514804aa1f14be5bf988b0d890190c4b6b4be3dca87bdf206408416c3697e77791177cb6f70697df3ff2adaecd8172e726d6420512bbe59d4eb3979dfa61ca0f7f5fc4dec7e20cdbef0908f25b95c14c3d736c4aeead2fca4c7d0b47933f5a016cc7eed09e822920fc38e74b51dbeae78130674e94e000d13640989c3e7fe5308c") bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) recvmmsg(r3, &(0x7f0000001900)=[{{&(0x7f0000000140)=@isdn, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)=""/97, 0x61}, {&(0x7f0000001a80)=""/239, 0xef}, {&(0x7f0000000340)=""/17, 0x11}, {&(0x7f0000000380)=""/135, 0x87}], 0x4, &(0x7f0000000480)=""/10, 0xa}, 0x505d24f0}, {{&(0x7f00000004c0)=@hci, 0x80, &(0x7f0000000980)=[{&(0x7f0000000540)=""/113, 0x71}, {&(0x7f00000005c0)=""/244, 0xf4}, {&(0x7f00000006c0)=""/224, 0xe0}, {&(0x7f0000000800)=""/201, 0xc9}, {&(0x7f0000000900)=""/65, 0x41}], 0x5, &(0x7f0000000a00)=""/64, 0x40}, 0x7}, {{&(0x7f0000000a40)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, 0x80, &(0x7f0000000c00)=[{&(0x7f0000000ac0)=""/131, 0x83}, {&(0x7f0000000b80)=""/114, 0x72}], 0x2}, 0x6}, {{&(0x7f0000000c40)=@in6, 0x80, &(0x7f0000001200)=[{&(0x7f0000000cc0)=""/251, 0xfb}, {&(0x7f0000000dc0)=""/13, 0xd}, {&(0x7f0000000e00)=""/219, 0xdb}, {&(0x7f0000000f00)=""/147, 0x93}, {&(0x7f0000000fc0)=""/110, 0x6e}, {&(0x7f0000001040)=""/240, 0xf0}, {&(0x7f0000001140)=""/174, 0xae}], 0x7, &(0x7f0000001280)=""/17, 0x11}, 0x1}, {{&(0x7f00000012c0)=@l2tp6={0xa, 0x0, 0x0, @private1}, 0x80, &(0x7f0000001780)=[{&(0x7f0000001340)=""/155, 0x9b}, {&(0x7f0000001400)=""/32, 0x20}, {&(0x7f0000001440)=""/70, 0x46}, {&(0x7f00000014c0)=""/105, 0x69}, {&(0x7f0000001540)=""/120, 0x78}, {&(0x7f00000015c0)=""/18, 0x12}, {&(0x7f0000001600)=""/117, 0x75}, {&(0x7f0000001680)=""/156, 0x9c}, {&(0x7f0000001740)=""/10, 0xa}], 0x9, &(0x7f0000001840)=""/163, 0xa3}, 0x1}], 0x5, 0x46, &(0x7f0000001a40)={0x0, 0x3938700}) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) 11:56:14 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:56:14 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x200000000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:14 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, @in_args={0x1}}, './file0\x00'}) write$bt_hci(r1, &(0x7f0000000140)={0x1, @logical_link_cancel={{0x43b, 0x2}, {0xc8, 0x6}}}, 0x6) ioctl$sock_bt_hci(r0, 0x400448de, &(0x7f0000000040)="4f522fd9e603f194031f2e1f1aa1064f9d2887977456e87dd20f5154489a195abe00fd45d17ff0658578f900bd6339a281adfd28fc7b4594150fc1d2a4dcc544fd91dee8bfd9cef8e39af42646ec154e9e0b65e61e37742f643c78e5752744d5c5498e5500c067833ef4d7065cbbe280f694423aa5ca9fd31796459a3a8637019ecb270c0265924d090a6f7c4c83b2b142ce8bdafe0ff6fc3936dc15227f96b6eb284b4c42d236ffadb321e227ba387ede18f79700d159951f36") r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_RESIZE(r4, 0x50009403, &(0x7f0000000200)={{r2}, {@void, @max}}) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r6 = epoll_create1(0x0) epoll_pwait2(r6, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000240)={0x200b}) epoll_pwait(r6, &(0x7f0000000280)=[{}], 0x1, 0x98b, &(0x7f00000002c0)={[0x8]}, 0x8) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) bind$bt_hci(r3, &(0x7f0000000180)={0x1f, 0x2, 0x2}, 0x6) 11:56:14 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x80000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:56:14 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x400000000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:14 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x80000) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:56:14 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xffff0000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:56:14 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x500000000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:25 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xffffff8c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:56:25 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x101000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:56:25 executing program 0: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$FS_IOC_FSGETXATTR(r3, 0x801c581f, &(0x7f0000000180)={0x7fffffff, 0x6, 0x20, 0x9dd, 0x7}) close(r2) ioctl$KDGKBENT(r1, 0x4b46, &(0x7f00000000c0)={0x0, 0x8, 0x7f}) read(r0, &(0x7f0000000080)=""/12, 0xc) 11:56:25 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1, @user_passkey_reply={{0x42e, 0xa}, {@none, 0xd0}}}, 0xe) r3 = getpid() ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000080)=0x0) get_robust_list(r4, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x28) r5 = fcntl$getown(r1, 0x9) r6 = dup(0xffffffffffffffff) kcmp(r3, r5, 0x3, r6, r0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) 11:56:25 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x600000000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:25 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(0xffffffffffffffff, r2, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:56:25 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x0, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:56:25 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x2, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000100), &(0x7f00000000c0)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x6, &(0x7f00000001c0)={0x9, 0x0, &(0x7f0000000180)=[r1]}, 0x1) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r2, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) r3 = syz_open_dev$hidraw(&(0x7f0000000200), 0x10001, 0x105000) r4 = openat$cgroup_freezer_state(r2, &(0x7f0000000140), 0x2, 0x0) dup3(r3, r4, 0x0) 11:56:25 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 11:56:25 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xfffffff6, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:56:25 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x810000000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:25 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x600000000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:25 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x104000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:56:25 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xedc000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:56:25 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x1000000000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:25 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f0000000340)={0x1, @change_conn_link_key={{0x415, 0x2}, {0xc9}}}, 0x6) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) bind$802154_raw(r1, &(0x7f0000000300)={0x24, @long={0x3, 0x1}}, 0x14) ioctl$FIBMAP(r2, 0x1, &(0x7f00000002c0)=0x1) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0xfffffffffffffffb, 0x3, 0x3f, @buffer={0x0, 0xa5, &(0x7f00000000c0)=""/165}, &(0x7f0000000180)='u~e', &(0x7f00000001c0)=""/35, 0x5, 0x10021, 0x1, &(0x7f0000000200)}) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[], 0x178) 11:56:36 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) (fail_nth: 1) 11:56:36 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x4000000000000000, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:36 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x0, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:56:36 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(0xffffffffffffffff, r2, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:56:36 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x401000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:56:36 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f0000000100)=ANY=[@ANYRESHEX], 0x178) getsockopt$inet_tcp_buf(r1, 0x6, 0x1f, &(0x7f0000000040)=""/121, &(0x7f00000000c0)=0x79) 11:56:36 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10, 0x0, 0x4}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$inet_opts(r4, 0x0, 0x1f, &(0x7f0000000180)="d8f636085cecdf9273a90cdc5361438806cc0bb0acb50472e13bb15506c10c9d29df1ea0b8daf3d7256a66c6661b905c205d884326c08254beefa8b64e759f6fc26c9e84c3b9e0b60fcaef", 0x4b) syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd=r0, 0x0, 0x0, 0x800, 0x2, 0x1, {0x0, r3, r4}}, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r5, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) 11:56:36 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x4000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 1904.007016] FAULT_INJECTION: forcing a failure. [ 1904.007016] name failslab, interval 1, probability 0, space 0, times 0 [ 1904.009158] CPU: 1 UID: 0 PID: 15906 Comm: syz-executor.0 Not tainted 6.17.0-next-20251003 #1 PREEMPT(voluntary) [ 1904.009194] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1904.009211] Call Trace: [ 1904.009220] [ 1904.009231] dump_stack_lvl+0xfa/0x120 [ 1904.009270] should_fail_ex+0x4d7/0x5e0 [ 1904.009310] should_failslab+0xc2/0x120 [ 1904.009351] kmem_cache_alloc_node_noprof+0x79/0x6a0 [ 1904.009383] ? lock_release+0xc8/0x290 [ 1904.009415] ? __alloc_skb+0x2ab/0x370 [ 1904.009453] ? __alloc_skb+0x2ab/0x370 [ 1904.009477] __alloc_skb+0x2ab/0x370 [ 1904.009506] ? __pfx___alloc_skb+0x10/0x10 [ 1904.009553] alloc_skb_with_frags+0x8f/0x7c0 [ 1904.009591] ? __pfx_perf_trace_lock+0x10/0x10 [ 1904.009630] sock_alloc_send_pskb+0x7cb/0x950 [ 1904.009657] ? lock_acquire+0x15e/0x2f0 [ 1904.009688] ? avc_has_perm_noaudit+0x59/0x3d0 [ 1904.009732] ? avc_has_perm_noaudit+0x11b/0x3d0 [ 1904.009778] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1904.009808] ? avc_has_perm_noaudit+0x150/0x3d0 [ 1904.009854] ? sock_has_perm+0x21d/0x2b0 [ 1904.009895] ? __pfx_sock_has_perm+0x10/0x10 [ 1904.009943] hci_sock_sendmsg+0x190/0x2270 [ 1904.009996] ? perf_trace_lock+0xb5/0x5d0 [ 1904.010033] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 1904.010088] sock_write_iter+0x57e/0x610 [ 1904.010129] ? __pfx_sock_write_iter+0x10/0x10 [ 1904.010189] ? security_file_permission+0x22/0x90 [ 1904.010236] vfs_write+0xbe9/0x1150 11:56:36 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x8000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 1904.010291] ? __pfx_sock_write_iter+0x10/0x10 [ 1904.010330] ? __fget_files+0x34/0x3b0 [ 1904.010364] ? __pfx_vfs_write+0x10/0x10 11:56:36 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x1000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) [ 1904.010430] ksys_write+0x1ef/0x240 [ 1904.010465] ? __pfx_ksys_write+0x10/0x10 [ 1904.010515] do_syscall_64+0xbf/0x390 [ 1904.010550] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1904.010578] RIP: 0033:0x7fa0c37f9b19 [ 1904.010599] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1904.010625] RSP: 002b:00007fa0c0d6f188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1904.010651] RAX: ffffffffffffffda RBX: 00007fa0c390cf60 RCX: 00007fa0c37f9b19 [ 1904.010669] RDX: 000000000000000b RSI: 00000000200000c0 RDI: 0000000000000004 [ 1904.010686] RBP: 00007fa0c0d6f1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1904.010702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1904.010718] R13: 00007ffd44b2ec3f R14: 00007fa0c0d6f300 R15: 0000000000022000 [ 1904.010760] 11:56:36 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x100000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:56:36 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000001640)={{0x1, 0x1, 0x18, r1, {0x80000001}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000080)={{0x1, 0x1, 0x18, r2}, './file0/file0\x00'}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$bt_hci(r3, &(0x7f0000000040)=ANY=[@ANYRESHEX=r5], 0x178) 11:56:36 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:56:36 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) (fail_nth: 2) 11:56:36 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x200000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:56:36 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x300000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 1906.266209] Bluetooth: hci0: command 0x0406 tx timeout [ 1906.796545] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1906.799489] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1906.802395] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1906.813860] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1906.816547] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1908.890838] Bluetooth: hci6: command tx timeout [ 1910.938236] Bluetooth: hci6: command tx timeout [ 1912.987410] Bluetooth: hci6: command tx timeout [ 1915.034089] Bluetooth: hci6: command tx timeout [ 1924.136458] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1924.137767] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1924.213742] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1924.215731] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 11:57:04 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x2000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:57:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_bt_hci(r0, 0x800448d7, &(0x7f0000000040)="c0f4911b75f1c7eeca1cd8862b5760486328e38ba461b57d536d94b51096158c1a6ad9f4f4b5d389b3928ee442ce43443f4249b2515e2783bd5302b9e4b85a166172f5b4ac13e8c5f2ff47bd881efbc16b8bf621cbdb55d598fd502f6c013b62c9167206ec6c22b61d42947da9e5a531f51a1e288b70927487b448449f42661a7e5fd7f1212026573ed16bdc83e72f0c0b93cc9af74e64304e6f544f4862ee98857136e66a0b482731237d82605a68b8af9e91b70a26a27f9afef7131c0a695285b5c0764e") r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 11:57:04 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x2, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:57:04 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000ff2000/0xe000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) fcntl$dupfd(r3, 0x406, 0xffffffffffffffff) readv(r1, &(0x7f0000001400), 0x0) close(r0) ioctl$CDROMSTART(r2, 0x5308) 11:57:04 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x700000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:04 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(0xffffffffffffffff, r2, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:04 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x0, &(0x7f0000000280)={0x0, 0xb8fc, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:04 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) (fail_nth: 3) 11:57:04 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) (fail_nth: 4) 11:57:04 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x800000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:04 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, r2, {0x100, 0x7fffffff}}, './file0\x00'}) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r3, 0x40047211, &(0x7f00000000c0)) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) r4 = syz_open_dev$vcsn(&(0x7f0000000180), 0x7fff, 0x20640) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$BTRFS_IOC_RESIZE(r4, 0x50009403, &(0x7f00000001c0)={{r5}, {@void, @actul_num={@val=0x2b, 0x100000001, 0x67}}}) close(r0) 11:57:04 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x810000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) write$bt_hci(r1, &(0x7f0000000080)={0x1, @write_ssp_mode={{0xc56, 0x1}, {0x3f}}}, 0x5) r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) 11:57:04 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x3, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 1934.426068] Bluetooth: hci0: command 0x0406 tx timeout 11:57:16 executing program 2: seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000040)) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f00000000c0)={0x10}) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0x4, 0x2}, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$bt_hci(r0, &(0x7f0000000100)=ANY=[@ANYRESOCT=r4], 0x178) 11:57:16 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0xc00) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r2, 0xc018937d, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r2, @ANYBLOB="321bc64371f4462c2847278974f951f1dd15d9ac72c6d13572adf8d4aae95b139d01d880a0681d1e0732ed304c2ccb585a8ba774815f32a3e57c39e5d0cbd47521766cf32d399288bc6875a4c57fc88e2f0c7ba5833d8ee1f9446d3e2be2c2a846732c7633d6384cc925f15ff72a70a40ce8e9c6bd07263ee2c3d44b99bca3660136c4fd45a45b5a2b2baf90cade037cb316e1e26b95e33e59dee13a39c345df76040e00adf22c9f3939e3dbf1004c20d1aab59b2155c553cc"]) ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40086607, &(0x7f00000000c0)=0x3) close(r0) 11:57:16 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, 0xffffffffffffffff, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:16 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x4, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:57:16 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x3000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:57:16 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, 0x0, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:16 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) (fail_nth: 5) 11:57:16 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x900000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 1943.995786] FAULT_INJECTION: forcing a failure. [ 1943.995786] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1943.997623] CPU: 0 UID: 0 PID: 16738 Comm: syz-executor.0 Not tainted 6.17.0-next-20251003 #1 PREEMPT(voluntary) [ 1943.997652] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1943.997665] Call Trace: [ 1943.997672] [ 1943.997680] dump_stack_lvl+0xfa/0x120 [ 1943.997714] should_fail_ex+0x4d7/0x5e0 [ 1943.997747] _copy_from_iter+0x1dc/0x1660 [ 1943.997775] ? lock_acquire+0x15e/0x2f0 [ 1943.997801] ? __virt_addr_valid+0x1c6/0x5d0 [ 1943.997837] ? find_held_lock+0x2b/0x80 [ 1943.997871] ? __pfx__copy_from_iter+0x10/0x10 [ 1943.997895] ? lock_release+0xc8/0x290 [ 1943.997925] ? __virt_addr_valid+0x100/0x5d0 [ 1943.997967] ? __check_object_size+0x57b/0x880 [ 1943.997999] hci_sock_sendmsg+0x402/0x2270 [ 1943.998034] ? perf_trace_lock+0xb5/0x5d0 [ 1943.998064] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 1943.998107] sock_write_iter+0x57e/0x610 [ 1943.998142] ? __pfx_sock_write_iter+0x10/0x10 [ 1943.998188] ? security_file_permission+0x22/0x90 [ 1943.998226] vfs_write+0xbe9/0x1150 [ 1943.998255] ? __pfx_sock_write_iter+0x10/0x10 [ 1943.998285] ? __fget_files+0x34/0x3b0 [ 1943.998312] ? __pfx_vfs_write+0x10/0x10 [ 1943.998364] ksys_write+0x1ef/0x240 [ 1943.998391] ? __pfx_ksys_write+0x10/0x10 [ 1943.998430] do_syscall_64+0xbf/0x390 [ 1943.998459] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1943.998481] RIP: 0033:0x7fa0c37f9b19 [ 1943.998497] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1943.998518] RSP: 002b:00007fa0c0d6f188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1943.998539] RAX: ffffffffffffffda RBX: 00007fa0c390cf60 RCX: 00007fa0c37f9b19 [ 1943.998554] RDX: 000000000000000b RSI: 00000000200000c0 RDI: 0000000000000004 [ 1943.998567] RBP: 00007fa0c0d6f1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1943.998580] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1943.998593] R13: 00007ffd44b2ec3f R14: 00007fa0c0d6f300 R15: 0000000000022000 [ 1943.998625] 11:57:16 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) (fail_nth: 6) 11:57:16 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xa00000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:16 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) close(r0) 11:57:16 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x5, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 1944.177259] FAULT_INJECTION: forcing a failure. [ 1944.177259] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1944.179201] CPU: 0 UID: 0 PID: 16849 Comm: syz-executor.0 Not tainted 6.17.0-next-20251003 #1 PREEMPT(voluntary) [ 1944.179231] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 1944.179244] Call Trace: [ 1944.179252] [ 1944.179260] dump_stack_lvl+0xfa/0x120 [ 1944.179294] should_fail_ex+0x4d7/0x5e0 [ 1944.179326] _copy_to_user+0x32/0xd0 [ 1944.179357] simple_read_from_buffer+0xe0/0x180 [ 1944.179386] proc_fail_nth_read+0x18a/0x240 [ 1944.179419] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1944.179452] ? security_file_permission+0x22/0x90 [ 1944.179485] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1944.179516] vfs_read+0x1eb/0xc70 [ 1944.179551] ? __pfx_vfs_read+0x10/0x10 [ 1944.179581] ? lock_release+0xc8/0x290 [ 1944.179612] ? __fget_files+0x20d/0x3b0 [ 1944.179652] ksys_read+0x121/0x240 [ 1944.179679] ? __pfx_ksys_read+0x10/0x10 [ 1944.179718] do_syscall_64+0xbf/0x390 [ 1944.179747] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1944.179770] RIP: 0033:0x7fa0c37ac69c [ 1944.179786] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1944.179808] RSP: 002b:00007fa0c0d6f170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1944.179829] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007fa0c37ac69c [ 1944.179843] RDX: 000000000000000f RSI: 00007fa0c0d6f1e0 RDI: 0000000000000003 [ 1944.179857] RBP: 00007fa0c0d6f1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1944.179870] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1944.179884] R13: 00007ffd44b2ec3f R14: 00007fa0c0d6f300 R15: 0000000000022000 [ 1944.179917] 11:57:16 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x4000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:57:16 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xb00000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:16 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:57:16 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000003c0), r1) sendmsg$NLBL_MGMT_C_ADD(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000400)={0x24, r2, 0xf1b5a43ca6b9a97, 0x0, 0x0, {}, [@NLBL_MGMT_A_DOMAIN={0xe, 0x2, 'NLBL_MGMT\x00'}]}, 0x24}}, 0x0) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x86eabc486c6229d9}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r2, 0x10, 0x70bd27, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x17}}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20080044}, 0x20048800) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r3, &(0x7f00000007c0)=ANY=[@ANYRES32=r4], 0x178) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000140)={{0x1, 0x1, 0x18, r4, {0x9}}, './file0\x00'}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000014c0), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000004f80)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r8, &(0x7f0000005040)={0x0, 0x0, &(0x7f0000005000)={&(0x7f0000004fc0)={0x1c, r7, 0xd44fcdaefa3b3e37, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_NOACK_MAP(r5, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, r7, 0x1, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x5, 0x3c}}}}, [@NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x14b3}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x9}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x9}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x4040010}, 0x10) [ 1944.374569] netlink: 'syz-executor.2': attribute type 2 has an invalid length. 11:57:16 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x6, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 1946.202069] Bluetooth: hci0: command 0x0406 tx timeout [ 1948.250096] Bluetooth: hci0: command 0x0406 tx timeout 11:57:28 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:57:28 executing program 7: syz_io_uring_setup(0x19be, &(0x7f0000000000)={0x0, 0x20002, 0x10, 0x0, 0x397}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000001500), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) readv(r1, &(0x7f0000001480)=[{&(0x7f0000000180)=""/253, 0xfd}, {&(0x7f00000000c0)=""/35, 0x23}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000000280)=""/72, 0x48}, {&(0x7f0000000300)=""/55, 0x37}, {&(0x7f0000000340)=""/73, 0x49}, {&(0x7f0000001440)=""/63, 0x3f}], 0x7) readv(r0, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) 11:57:28 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, 0x0, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:28 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x8, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:57:28 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x5000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:57:28 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, 0xffffffffffffffff, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:28 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) getsockopt$SO_COOKIE(0xffffffffffffffff, 0x1, 0x39, &(0x7f00000000c0), &(0x7f0000000100)=0x8) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000080)='gre0\x00') bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYRESOCT=r3, @ANYRES64], 0x178) 11:57:28 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x1000000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:28 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0xb, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:57:28 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:57:28 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xfffd}, 0xffffffffffffff3b) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) ioctl$sock_bt_hci(r2, 0x400448e7, &(0x7f0000000040)='<=') write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 11:57:28 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x2000000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:28 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x10, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:57:28 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x2010000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:28 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x2}}}, 0xb) 11:57:28 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x4000000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:28 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000100), &(0x7f0000000080)=0x14) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000140)={{0x1, 0x1, 0x18}, './file0\x00'}) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x5e23, @loopback}, 0x10) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYRES32=r1, @ANYRESOCT=r0], 0x178) [ 1958.106062] Bluetooth: hci0: command 0x0406 tx timeout [ 1960.154088] Bluetooth: hci0: command 0x0406 tx timeout [ 1962.202082] Bluetooth: hci0: command 0x0406 tx timeout 11:57:39 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x300, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:57:39 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, 0xffffffffffffffff, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:39 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, 0x0, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:39 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x6000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:57:39 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x8cffffff00000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:39 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x4}}}, 0xb) 11:57:39 executing program 7: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000180)) r0 = fsmount(0xffffffffffffffff, 0x1, 0x81) openat(0xffffffffffffffff, &(0x7f0000000480)='./file0\x00', 0x72c00, 0x7ade3313ee6241e0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000600)=ANY=[@ANYBLOB="5c00000007000000004782d99b4a079d27a4a403851ae910043da0159bce272d4443cffd5ad8565a548590ffb726b9a2fd4345a241b127ee7b578f7edd6c9f14c1c9898b59f4560dbc62396bdf33d2b4b0e4b7578031f58f58eeb019b2b6248c91d04bafbd85544d4d163453327cd45b0a13b365a7a401f25cfaa6e5093d7b844a1aa6b4bc7a2db9442ff3f01803264cf79ffef18e97cce7d753697ca3000e7f15442dfc45f0bda2"]) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="07000000ffff00002e2f66696c653000"]) dup(r1) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0xfff, &(0x7f0000000240)=0x1) r2 = syz_io_uring_setup(0x1f27, &(0x7f0000000000)={0x0, 0x0, 0x10, 0x0, 0x198}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r3, &(0x7f0000000280)=[{&(0x7f00000007c0)=""/18, 0x12}, {&(0x7f00000006c0)=""/243, 0xf3}, {&(0x7f0000000500)=""/121, 0x79}], 0x3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_GET(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="1100"/17], 0x2c}}, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r3, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYRESHEX=r5, @ANYRES16, @ANYBLOB="f2ff26bd7000ed15df2577711c31080106000200000008000900010000000c0001800800284a030000000c00018008000100", @ANYRES32, @ANYRESDEC], 0x3c}, 0x1, 0x0, 0x0, 0x48840}, 0x4001) r6 = accept$inet(r3, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, &(0x7f00000001c0)=0x10) ioctl$BTRFS_IOC_WAIT_SYNC(r6, 0x40089416, &(0x7f0000000200)) close(r2) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x21, 0x4, &(0x7f0000000300)=0x1) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x24a, 0x3, &(0x7f0000000080)) 11:57:39 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) r3 = getpid() get_robust_list(r3, &(0x7f00000002c0)=0x0, &(0x7f0000000300)) ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f0000000040)=r3) r4 = fsmount(0xffffffffffffffff, 0x0, 0xf3) write$bt_hci(r4, &(0x7f0000000000)={0x1, @disconnect={{0x406, 0x3}, {0xc8, 0x1}}}, 0x7) 11:57:39 executing program 2: ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) bind$802154_raw(r0, &(0x7f0000000080)={0x24, @none={0x0, 0x2}}, 0x14) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r1, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) 11:57:39 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xf6ffffff00000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:39 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000080)={0x0, 0x0, 0x10, 0x0, 0x1}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = openat(r1, &(0x7f0000000380)='./file0\x00', 0x80000, 0x80) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r3, 0x8008f511, &(0x7f0000000540)) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) r4 = openat2(r2, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x402}, 0x18) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000180)=""/168, 0xa8}, {&(0x7f0000000240)=""/58, 0x3a}, {&(0x7f0000000280)=""/28, 0x1c}, {&(0x7f00000002c0)=""/172, 0xac}, {&(0x7f0000000400)=""/136, 0x88}], 0x5) close(r0) 11:57:39 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x5}}}, 0xb) 11:57:39 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x500, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:57:39 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000040)=0x5, 0x2) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x178) 11:57:39 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x600, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:57:39 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xfeff000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:39 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x7000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) [ 1968.602013] Bluetooth: hci0: command 0x0406 tx timeout [ 1970.650117] Bluetooth: hci0: command 0x0406 tx timeout [ 1972.698081] Bluetooth: hci0: command 0x0406 tx timeout [ 1974.746056] Bluetooth: hci0: command 0x0406 tx timeout 11:57:49 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x6}}}, 0xb) 11:57:49 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x9000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:57:49 executing program 7: write$evdev(0xffffffffffffffff, &(0x7f0000000000)=[{{0x77359400}, 0x14, 0xffe0, 0x2}], 0x18) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r0, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) io_uring_setup(0x3afd, &(0x7f0000000080)={0x0, 0x427d, 0x0, 0x1, 0x32b}) close(0xffffffffffffffff) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r1, 0x40189429, &(0x7f0000000040)={0x1, 0x9, 0x9}) 11:57:49 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:49 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0xffff000000000000, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:49 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x1}, 0x6) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {r1}}, './file0\x00'}) copy_file_range(0xffffffffffffffff, &(0x7f00000002c0)=0x5, 0xffffffffffffffff, &(0x7f0000000340)=0x4, 0x7f, 0x0) write$P9_RREAD(r3, &(0x7f0000000180)={0x1e, 0x75, 0x2, {0x13, "0451ccc0eee0e1cd7f7de1c915a37f3852f0cb"}}, 0x1e) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r5, &(0x7f0000000280)={0x1}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r4, &(0x7f0000000100)={0x8000000}) socket$inet_tcp(0x2, 0x1, 0x0) r6 = socket$inet_icmp(0x2, 0x2, 0x1) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r6, &(0x7f0000000040)={0x90000002}) r7 = socket$inet_tcp(0x2, 0x1, 0x0) clock_nanosleep(0x0, 0x1, &(0x7f0000000200), 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r7], 0x178) 11:57:49 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x2, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:49 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x810, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:57:50 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) epoll_create1(0x0) r1 = dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x0) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:50 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x3c2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:50 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) epoll_create1(0x0) r1 = dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x0) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:50 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x8}}}, 0xb) 11:57:50 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:50 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x1008, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 1979.546078] Bluetooth: hci0: command 0x0406 tx timeout [ 1981.594047] Bluetooth: hci0: command 0x0406 tx timeout [ 1983.642190] Bluetooth: hci0: command 0x0406 tx timeout 11:57:59 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0xa}}}, 0xb) 11:57:59 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/195, 0xc3}], 0x1) pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x80000) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) 11:57:59 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x4000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:57:59 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x48) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f00000000c0)={'team_slave_1\x00'}) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000080)={0x1, 0x7, "fcedc6", 0x3, 0x3}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) 11:57:59 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x3, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:59 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xd000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:57:59 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) epoll_create1(0x0) r1 = dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x0) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:59 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 11:57:59 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:57:59 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x11000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:57:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x1, 0x4}, 0x6) recvmmsg$unix(r1, &(0x7f0000000d40)=[{{&(0x7f0000000180), 0x6e, &(0x7f0000000480)=[{&(0x7f0000000200)=""/57, 0x39}, {&(0x7f0000000240)=""/45, 0x2d}, {&(0x7f0000000280)=""/96, 0x60}, {&(0x7f0000000300)=""/233, 0xe9}, {&(0x7f0000000400)=""/96, 0x60}], 0x5}}, {{&(0x7f0000000500), 0x6e, &(0x7f0000000880)=[{&(0x7f0000000580)=""/168, 0xa8}, {&(0x7f0000000640)=""/33, 0x21}, {&(0x7f0000000680)=""/128, 0x80}, {&(0x7f0000000700)=""/89, 0x59}, {&(0x7f0000000780)=""/64, 0x40}, {&(0x7f0000000800)=""/22, 0x16}, {&(0x7f0000000840)=""/60, 0x3c}], 0x7, &(0x7f0000000900)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x18}}, {{&(0x7f0000000940), 0x6e, &(0x7f0000000cc0)=[{&(0x7f00000009c0)=""/46, 0x2e}, {&(0x7f0000000a00)=""/238, 0xee}, {&(0x7f0000000b00)=""/154, 0x9a}, {&(0x7f0000000bc0)=""/255, 0xff}], 0x4, &(0x7f0000000d00)=[@cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0x0}}}], 0x40}}], 0x3, 0x162, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r1, 0xc018937b, &(0x7f0000000e00)={{0x1, 0x1, 0x18, r1, {0xffffffffffffffff, r2}}, './file0\x00'}) write$bt_hci(r1, &(0x7f0000000080)={0x1, @le_conn_update={{0x2013, 0xe}, {0xc8, 0x1f, 0x9, 0xeaac, 0x100, 0x9988, 0x9}}}, 0x12) r3 = syz_open_dev$vcsa(&(0x7f0000000100), 0x4, 0x40100) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f0000000140)={0xffffffffffffffff, 0xffff, "8b1cfb", 0x4, 0x8}) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) read$hiddev(r4, &(0x7f0000000e40)=""/161, 0xa1) socket$inet_tcp(0x2, 0x1, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r6], 0x178) 11:57:59 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x500}}}, 0xb) 11:57:59 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x4, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:57:59 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 11:57:59 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x10000200, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:57:59 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x34000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 1989.146212] Bluetooth: hci0: command 0x0406 tx timeout [ 1991.194017] Bluetooth: hci0: command 0x0406 tx timeout [ 1993.242164] Bluetooth: hci0: command 0x0406 tx timeout [ 1995.290183] Bluetooth: hci0: command 0x0406 tx timeout 11:58:10 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:58:10 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x600}}}, 0xb) 11:58:10 executing program 7: r0 = syz_io_uring_setup(0xfffefffa, &(0x7f0000000180)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x10100) ioctl$AUTOFS_IOC_SETTIMEOUT(r2, 0x80049367, &(0x7f0000000000)=0x101) io_uring_register$IORING_UNREGISTER_FILES(r3, 0x3, 0x0, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) 11:58:10 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x7, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:58:10 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x11000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:58:10 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 11:58:10 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x80000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:58:10 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f0000000040)=ANY=[], 0x39) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000080)=""/233, 0xe9}, {&(0x7f0000000180)=""/7, 0x7}, {&(0x7f00000001c0)=""/33, 0x21}, {&(0x7f0000000340)=""/34, 0x22}, {&(0x7f0000000240)=""/203, 0xcb}, {&(0x7f0000000440)=""/109, 0x6d}, {&(0x7f00000004c0)=""/144, 0x90}, {&(0x7f0000000580)=""/219, 0xdb}, {&(0x7f0000000680)=""/132, 0x84}], 0x9, &(0x7f00000003c0)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x28}, 0x120) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0xb) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000040)=0x1240, 0x4) 11:58:10 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0xa00}}}, 0xb) 11:58:10 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) 11:58:10 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='blkio.bfq.idle_time\x00', 0x0, 0x0) write$bt_hci(r1, &(0x7f0000000080)={0x1, @le_set_scan_rsp_data={{0x2009, 0x20}, {0x1, "6150e6111915207254662c9618e2393739ea42302016bc6384b2fdbe983c86"}}}, 0x24) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) fsetxattr$trusted_overlay_origin(r3, &(0x7f00000000c0), &(0x7f0000000100), 0x2, 0x1) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$sock_SIOCADDDLCI(r4, 0x8980, &(0x7f0000000140)={'macvlan1\x00', 0xfffb}) 11:58:10 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x8, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:58:10 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x100100, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:58:10 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:10 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) 11:58:10 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='hugetlb.1GB.usage_in_bytes\x00', 0x0, 0x0) write$bt_hci(r1, &(0x7f0000000080)={0x1, @reject_conn_req={{0x40a, 0x7}, {@none, 0x81}}}, 0xb) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) [ 1999.962090] Bluetooth: hci0: command 0x0406 tx timeout [ 2002.010053] Bluetooth: hci0: command 0x0406 tx timeout [ 2004.058071] Bluetooth: hci0: command 0x0406 tx timeout [ 2006.106069] Bluetooth: hci0: command 0x0406 tx timeout [ 2008.154012] Bluetooth: hci0: command 0x0406 tx timeout [ 2010.202036] Bluetooth: hci0: command 0x0406 tx timeout 11:58:24 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x2}}}, 0xb) 11:58:24 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x1fffefff, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:58:24 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x0, &(0x7f0000000300)) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:58:24 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10, 0x0, 0x10000}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) 11:58:24 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x400300, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:58:24 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) 11:58:24 executing program 2: fdatasync(0xffffffffffffffff) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000040)={0x1, @disconn_phy_link={{0x437, 0x2}, {0xc8, 0x74}}}, 0x6) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xffffffffffffffbb}}, './file0\x00'}) bind$bt_hci(r2, &(0x7f0000000100)={0x1f, 0x4, 0x4}, 0x6) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000080)={0x2, 0x8, "dbe066", 0x3, 0x9}) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r3], 0x178) 11:58:24 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x9, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:58:24 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:24 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x20000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:58:24 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:24 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:24 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xa, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 2012.514314] Bluetooth: hci2: Opcode 0x0401 failed: -4 [ 2012.517218] Bluetooth: hci2: Opcode 0x0401 failed: -4 [ 2013.722035] Bluetooth: hci0: command 0x0406 tx timeout 11:58:35 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0xc9f8, 0x8}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) r2 = accept$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) getsockopt$sock_timeval(r2, 0x1, 0x42, &(0x7f0000000180), &(0x7f00000001c0)=0x10) 11:58:35 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:58:35 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:35 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x3a030000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:58:35 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x1000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:58:35 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x4}}}, 0xb) 11:58:35 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xb, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:58:35 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe(&(0x7f0000000400)={0xffffffffffffffff}) ioctl$sock_bt_hci(r1, 0x400448dd, &(0x7f0000000440)="6ee96c170a662b90465a9607a0976dcdba1dc21ffe86c4749316805f87cf608a3274b690eb13339790638847ceb4a7b00a197a6f7f2612ea5c49f4bcff4c5fdd2aeac66b27b9977a6a03642b4f1133ec140fb13750c03e098bdadcf32149170faaa5c3e71e510a7bb3c1b3eba8fdd6cf257ad576de1abc27270bd5c454f2874fadabd108a03566347ebd74c6c92183f9b3a241751c531ffc69de36e3e647be0ba90f38ea42eb1704") bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r3 = syz_open_dev$vcsu(&(0x7f0000000500), 0x40, 0x8c02) getsockopt$ARPT_SO_GET_INFO(r3, 0x0, 0x60, &(0x7f0000000540)={'filter\x00', 0x0, [0x1]}, &(0x7f00000005c0)=0x44) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000040)={0xb7, {{0x2, 0x4e20, @broadcast}}, 0x1, 0x3, [{{0x2, 0x4e22, @rand_addr=0x64010102}}, {{0x2, 0x4e24, @empty}}, {{0x2, 0x4e21, @broadcast}}]}, 0x210) r4 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r4], 0x178) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r5, 0x8008f512, &(0x7f0000000600)) getsockopt$inet_tcp_buf(r2, 0x6, 0xb, &(0x7f0000000280)=""/176, &(0x7f0000000340)=0xb0) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000380)={0x0, @empty, @broadcast}, &(0x7f00000003c0)=0xc) 11:58:35 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f00000000c0)=0x9, 0x4) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000080)={0x1, 0xff, "eda4c0", 0x1, 0xe0}) write$bt_hci(r0, &(0x7f0000000040)={0x1, @setup_sync_conn={{0x428, 0x11}, {0xc8, 0x1, 0x0, 0xff00, 0x69, 0x2, 0x7}}}, 0x15) r4 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r4], 0x178) 11:58:35 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:35 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x10, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:58:35 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x2000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:58:35 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x5}}}, 0xb) 11:58:35 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x3f000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:58:35 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:35 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x300, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 2024.794100] Bluetooth: hci0: command 0x0406 tx timeout [ 2026.842069] Bluetooth: hci0: command 0x0406 tx timeout [ 2028.892667] Bluetooth: hci0: command 0x0406 tx timeout [ 2030.938803] Bluetooth: hci6: command 0x0406 tx timeout [ 2030.938823] Bluetooth: hci0: command 0x0406 tx timeout 11:58:45 executing program 3: bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:45 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYRES32=r1], 0x178) 11:58:45 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x6}}}, 0xb) 11:58:45 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x3000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:58:45 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x700, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:58:45 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:58:45 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r2 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) io_uring_register$IORING_REGISTER_FILES_UPDATE(r0, 0x6, &(0x7f00000000c0)={0xfffffffc, 0x0, &(0x7f0000000080)=[r1, r0, r2, r0, 0xffffffffffffffff, r0, r0]}, 0x7) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r3, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) fsetxattr$security_ima(r1, &(0x7f0000000180), &(0x7f00000001c0)=@sha1={0x1, "0b1b3c546bad1a81159f5db56408be410f39b7fa"}, 0x15, 0x2) close(r0) r4 = pidfd_open(0xffffffffffffffff, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000400)={@in={{0x2, 0x4e23, @multicast1}}, 0x0, 0x0, 0x13, 0x0, "65cb5494161e36fdac24981e94f95ac580c7dd57cca504fbc562704de147749bc8296c2a6fa9d9e4e400350e16bae0d7717446b04b9a11b2ea464feaa2b08fb532fe77599eee689a76ef023d9b1234b6"}, 0xd8) r6 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000200), 0x10000, 0x0) ppoll(&(0x7f0000000240)=[{r4, 0x400}, {r1}, {r0, 0x8000}, {r1, 0x4001}, {r5, 0x4204}, {r6, 0x2000}], 0x6, &(0x7f0000000280)={0x77359400}, &(0x7f00000002c0)={[0xffffffffffffffff]}, 0x8) 11:58:45 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x40000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:58:45 executing program 3: bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:46 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0xa}}}, 0xb) 11:58:46 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000002980), 0x4, 0x100) bind$bt_hci(r2, &(0x7f00000029c0)={0x1f, 0x4, 0x2}, 0x6) r3 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r3], 0x178) recvmmsg(r1, &(0x7f0000002840)=[{{&(0x7f0000000040)=@caif=@util, 0x80, &(0x7f0000000340)=[{&(0x7f00000000c0)=""/100, 0x64}, {&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000000140)=""/195, 0xc3}, {&(0x7f0000000240)=""/151, 0x97}, {&(0x7f0000000300)=""/21, 0x15}], 0x5}, 0x1}, {{&(0x7f00000003c0)=@generic, 0x80, &(0x7f0000000480)=[{&(0x7f0000000440)=""/20, 0x14}], 0x1}, 0x7}, {{&(0x7f00000004c0)=@sco={0x1f, @fixed}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000540)=""/125, 0x7d}], 0x1, &(0x7f0000000600)=""/231, 0xe7}, 0xffffffba}, {{&(0x7f0000000700)=@l2tp={0x2, 0x0, @private}, 0x80, &(0x7f0000002800)=[{&(0x7f0000001800)=""/4096, 0x1000}, {&(0x7f0000000780)=""/19, 0x13}], 0x2}, 0x80000001}], 0x4, 0x0, &(0x7f0000002940)={0x0, 0x989680}) 11:58:46 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x810, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:58:46 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x4000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:58:46 executing program 3: bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:46 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:46 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:46 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x5000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:58:46 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x7bffffff, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:58:46 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x900, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:58:46 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) ioctl$sock_bt_hci(r2, 0x800448d5, &(0x7f0000000040)="37123046e05859a99b036d16995e352273b9e36281973cc0326449d8ec1a42f082bc9b5c0a3904328fdce421f1ad3816ab673bf198db8c7146ff36537d5e4fb161ba67847ed0c017f33c9bfa507bb57c489fa2790831239db3c01fc808596c5aeda04a445d3af80f79fc8fd4c0cc87a4d7a1fbbb77825392e1ea5f12b0746175ed2fafb66a53dbe7372b4d30b9ef56afa0a68e6cb84a755207b959e275d50d586ed23988336bb0e70b702447f03c55fea0bb2a6f0ce620e66a185a504d49f1f5efc3c84fa7554f1ce853dea65866413c794a7ca11e70df43674feae4257e6bc10137f2a6d4d507") [ 2035.418107] Bluetooth: hci0: command 0x0406 tx timeout [ 2037.466100] Bluetooth: hci0: command 0x0406 tx timeout [ 2039.514093] Bluetooth: hci0: command 0x0406 tx timeout [ 2041.562077] Bluetooth: hci0: command 0x0406 tx timeout 11:58:55 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x2}}}, 0xb) 11:58:55 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), 0x0) dup3(r2, r3, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:58:55 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000080)={0x0, 0x47f0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) 11:58:55 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x6000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:58:55 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xc0030000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:58:55 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:55 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xa00, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:58:55 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3}, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) sendto$inet(r4, &(0x7f0000000100)="f3ca0c8f5321641f09c3946111d650191bf3a3e1599bb5df", 0x18, 0x10, &(0x7f0000000140)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) ioctl$sock_SIOCADDDLCI(r3, 0x8980, &(0x7f00000000c0)={'veth1\x00'}) ioctl$sock_inet_SIOCGIFDSTADDR(r2, 0x8917, &(0x7f0000000040)={'team_slave_0\x00', {0x2, 0x0, @remote}}) 11:58:55 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e6, &(0x7f0000000040)="19893adbd845ba0c52b5d5cb8eb321eaf8d36e6e765e20580c1af82ae268ddfd231467f99d53a0082de17fd3cac920f717446368766f886b395fc8e94ab5c2a8289f7be652ff5751f9569ec3d38d1c542cbe463a43eceb20699c09ee614aff749e8d0e60689a9c87940bec3e4380e15eda158e4b4e0a34a7a240be26b7a180b3f3b34827b51f34d9456d7ab501dce2b9fd00891df499f8820b84b3") r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) fchdir(r1) 11:58:55 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:55 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xb00, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:58:55 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x8100000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:58:55 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:55 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xe0000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:58:55 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x4}}}, 0xb) 11:58:56 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:58:56 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000040)=@FILEID_BTRFS_WITH_PARENT_ROOT={0x28, 0x4e, {0x8, 0x3f80000, 0x3, 0x1f, 0x80, 0x80000000}}, 0x100) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) [ 2043.611388] Bluetooth: hci0: command 0x0406 tx timeout [ 2045.658210] Bluetooth: hci0: command 0x0406 tx timeout [ 2047.706157] Bluetooth: hci0: command 0x0406 tx timeout [ 2049.754125] Bluetooth: hci0: command 0x0406 tx timeout 11:59:06 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x5}}}, 0xb) 11:59:06 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)}, {&(0x7f0000000400)=""/4096, 0x1000}], 0x2) r2 = openat$cgroup(r1, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) tee(r0, r2, 0x3ff, 0xb) close(r0) 11:59:06 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(0xffffffffffffffff, r2, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:59:06 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:59:06 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/snd_hda_codec', 0x4080, 0x22) setsockopt$IP_VS_SO_SET_EDITDEST(r2, 0x0, 0x489, &(0x7f0000000080)={{0x11, @empty, 0x4e21, 0x1, 'lblcr\x00', 0xc, 0x80000000, 0x80}, {@multicast1, 0x4e20, 0x4, 0x1, 0x7, 0x4a27}}, 0x44) 11:59:06 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xf0ffffff, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:59:06 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x10000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:59:06 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x1008, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:59:06 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:59:06 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) readv(r0, &(0x7f0000000180)=[{&(0x7f0000000040)=""/42, 0x2a}, {&(0x7f0000000080)=""/96, 0x60}, {&(0x7f0000000100)=""/75, 0x4b}], 0x3) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 11:59:06 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x1020, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:59:06 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x6}}}, 0xb) 11:59:06 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x40000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:59:06 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xf4000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:59:06 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x8}}}, 0xb) 11:59:06 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:59:06 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:59:07 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:59:07 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000200)={r0, 0x6, 0x401, 0x8}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000002440)=[{&(0x7f0000000240)=""/115, 0x73}, {&(0x7f0000001440)=""/4096, 0x1000}, {&(0x7f00000002c0)=""/101, 0x65}, {&(0x7f0000000340)=""/97, 0x61}], 0x4) ioctl$PTP_PIN_GETFUNC(r2, 0xc0603d06, &(0x7f0000000080)={'\x00', 0x80000001, 0x3, 0xc1a5}) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r0, 0x40049366, &(0x7f00000001c0)) mq_timedreceive(r1, &(0x7f0000000400)=""/4096, 0x1000, 0x5, &(0x7f0000000180)={0x77359400}) 11:59:07 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x2, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:59:07 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xf5ffffff, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:59:07 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:59:07 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0xa}}}, 0xb) 11:59:07 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(0xffffffffffffffff, r2, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:59:07 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, 0x0, 0x0) [ 2055.834110] Bluetooth: hci0: command 0x0406 tx timeout [ 2057.882058] Bluetooth: hci0: command 0x0406 tx timeout [ 2059.930068] Bluetooth: hci0: command 0x0406 tx timeout [ 2061.978072] Bluetooth: hci0: command 0x0406 tx timeout [ 2064.026062] Bluetooth: hci0: command 0x0406 tx timeout [ 2066.074070] Bluetooth: hci0: command 0x0406 tx timeout 11:59:19 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2010, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:59:19 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x500}}}, 0xb) 11:59:19 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x3, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:59:19 executing program 2: bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, 0x1}, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(0xffffffffffffffff, &(0x7f00000007c0)=ANY=[@ANYRES32=r0], 0x178) 11:59:19 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, 0x0, 0x0) 11:59:19 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xfbffffff, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:59:19 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(0xffffffffffffffff, r2, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:59:19 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) getsockopt$WPAN_SECURITY_LEVEL(r2, 0x0, 0x2, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 11:59:19 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f0000000080)={0x1, @inquiry={{0x401, 0x5}, {"e00525", 0x5, 0x90}}}, 0x9) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x4}, 0x6) r3 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r3], 0x178) 11:59:19 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x600}}}, 0xb) 11:59:19 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x4, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2068.122235] Bluetooth: hci0: command 0x0406 tx timeout [ 2070.170024] Bluetooth: hci0: command 0x0406 tx timeout [ 2072.218149] Bluetooth: hci0: command 0x0406 tx timeout [ 2074.266132] Bluetooth: hci0: command 0x0406 tx timeout [ 2076.314098] Bluetooth: hci0: command 0x0406 tx timeout 11:59:30 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xffefff1f, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:59:30 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x4000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:59:30 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, 0x0, 0x0) 11:59:30 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x5, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:59:30 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0xa00}}}, 0xb) 11:59:30 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)={0x200b}) sendmsg$NL80211_CMD_DEAUTHENTICATE(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00082dbd7000ffdbdf25270000000800030025ae32a8610cd77a948d8029ba", @ANYRES32=0x0, @ANYBLOB="060036000100000004005f0004005f00"], 0x2c}, 0x1, 0x0, 0x0, 0x4000040}, 0x8000) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x2) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$F2FS_IOC_SET_PIN_FILE(r3, 0x4004f50d, &(0x7f0000000040)) r4 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r2, &(0x7f00000007c0)=ANY=[@ANYRES32=r4], 0x178) 11:59:30 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) pipe2(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000000280), 0x2) io_uring_register$IORING_UNREGISTER_FILES(0xffffffffffffffff, 0x3, 0x0, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) syz_io_uring_setup(0x10ab, &(0x7f0000000180)={0x0, 0x54, 0x0, 0x3, 0x348, 0x0, r0}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000200)) close(r0) 11:59:30 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, 0xffffffffffffffff, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:59:30 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xedc0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:59:30 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x6, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:59:30 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x4, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:59:30 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xfeff, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:59:30 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 11:59:30 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xffffff7b, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) [ 2078.362071] Bluetooth: hci0: command 0x0406 tx timeout [ 2080.410062] Bluetooth: hci0: command 0x0406 tx timeout [ 2082.458111] Bluetooth: hci0: command 0x0406 tx timeout [ 2084.506033] Bluetooth: hci0: command 0x0406 tx timeout [ 2086.554071] Bluetooth: hci0: command 0x0406 tx timeout 11:59:41 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xfffe, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 11:59:41 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) r3 = open_tree(r2, &(0x7f0000000080)='./file0\x00', 0x1) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000440)) r4 = syz_open_procfs$userns(0x0, &(0x7f0000000240)) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000002c0)={0x2, &(0x7f0000000280)=[{0x3f, 0x8, 0x7, 0x3ec00000}, {0x8, 0x1f, 0x9a, 0x3ff}]}) r6 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) ppoll(&(0x7f0000000340)=[{r3, 0x400}, {r4, 0x4634}, {r5, 0x2}, {r3, 0x10}, {r1, 0x4000}, {r6, 0xa044}], 0x6, &(0x7f0000000380)={0x0, 0x3938700}, &(0x7f0000000400)={[0x8]}, 0x8) syz_io_uring_setup(0x391d, &(0x7f0000000180)={0x0, 0x9438, 0x4, 0x2, 0x3e, 0x0, r3}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f00000000c0), &(0x7f0000000200)) close(r0) 11:59:41 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, 0xffffffffffffffff, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 11:59:41 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x2}}}, 0xb) 11:59:41 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:59:41 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xfffffff0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 11:59:41 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x8, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:59:41 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f0000006540)={{0x2, 0x4e24, @remote}, {0x1, @multicast}, 0x4, {0x2, 0x4e21, @empty}, 'team_slave_1\x00'}) bind$inet6(0xffffffffffffffff, &(0x7f0000002840)={0xa, 0x4e22, 0x401, @remote, 0x40000}, 0x1c) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000240)={0x200b}) write$bt_hci(0xffffffffffffffff, &(0x7f000000d340)={0x1, @le_set_data_len={{0x2022, 0x6}, {0xc8, 0x4000, 0x1000}}}, 0xa) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000180)={@empty, @ipv4={'\x00', '\xff\xff', @dev}, @private0={0xfc, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00006, r5}) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCDELRT(r6, 0x890c, &(0x7f00000000c0)={@loopback, @dev, @mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5}) sendmmsg(r1, &(0x7f000000d180)=[{{&(0x7f00000065c0)=@ll={0x11, 0x8, 0x0, 0x1, 0x12}, 0x80, &(0x7f0000006700)=[{&(0x7f0000006640)="84ecb9f8810c6ae08c2aa5736662c73c77a9799cd227e826b2f34e833881162a3068ebce19b8ae36de3bb929d27d4a0987a9f68e0005f85fbb3d023760bbb02972ac489396219cec63fd756b459d3cb0cdd3cadb2a49d3f68f2fc321ea47e508fa76a73cd3b90fbf289996023334e9974852ec52175cb05bcae63ec24d274c287a6c3fb69d8066831f5ecfefb947a0261b0fcf2c66d7c0ceabfacad25fc7cf6678b5045ab037e57e6a4504b942fa40480c87dcc4a809e5ebd0268301c5f04d3e", 0xc0}], 0x1, &(0x7f0000006740)=[{0xa8, 0x107, 0xffffffe1, "e858c69c247c63c21e6e096614ae0f6ffd4f3af0f73f74098633473cf6c4219f4b602e04dc2e143032b47b4efe7f1edf0c84d2151ad5996b31c0e624dd73d11965651780a13f547627d8ae94c5dd95a74db8b565d4fb2efd5a76014bcee499ced8ba4fa69da984b90bf7fcc3b79a3a47989dea97a3f54fba6e869445121596545e84ebf697c4f3706efc0c9f0e08960a7acc9c"}, {0x48, 0x103, 0x5, "089b1f99ab6c74b6662c70e88f945912e71f92350f1381eea84dc9674f0f012ae6befd633a3ea7dc45ec39cd7ce7aa74a3"}], 0xf0}}, {{&(0x7f0000006840)=@un=@abs={0x0, 0x0, 0x4e20}, 0x80, &(0x7f0000007d00)=[{&(0x7f00000068c0)="b6f1b8b798017836cf3d3b803a12dacca4cc75fd49e71630dff246b4a7bf72fd8d6cde36aec4a0058682c1ddb64361819b25b326b325226d1a6260f1935991cb4eb55fc85653920fc7598727545181b40e048100adf6d6e0353956846ddb85eadd8f49d4f4f08f2c44ca690cf8bee365dac23a2c066573e9de8c", 0x7a}, {&(0x7f0000006940)="19509fe22eef340f9f91c162734f19a0a446493f9d3f1a335c27afdde4d7070361cfc34ea26d0a71d51a41187c6d0302a4809a146f7301d6450eb3f3696e8007a02b8fb85d4d58ace69af867094ac1495578e7259e89e3767a", 0x59}, {&(0x7f00000069c0)="e712ec17f1f14d15b94f64fdf3d9fc5795c1075be9c738b41221e229e99a4fb1859feda392bb26ea364fd2714d22bb6fac5b396222a0e511b924eca03049ca222254973196dcc10a671a9d497261826f9590c71a2adfd0cd7c2626d6d4dfb0d5b2e8989e84ef5b4c6d847bf61a9ed871741297d611c4d6d008f75a089f5f1aeb8b01910d3f22a83710c9", 0x8a}, {&(0x7f0000006a80)="dc09c61d061ff79c1c0932c6caca6f87d9e8f3e1efe56fbadc516f41d6e83c7662c223ce839a67629f83e71e25b355aeeaf1ef664f7e2dd1d6fac48e9cbf391368ac81f3feaca16f938faa727fe1db8a3b8058981eac5879cb5848a93550967d93c669593d6aae04faa190032c31f17abf55470da7f44502616fe4e956231ebd120c23228b083cd25f77e15bcb64fa52515de74e2c85fbcb58c34553212a79336466ec0aa419663efb953bc1cc0c3c01c95ded78487ad30e8e159c77e594d430c4a3dd0a41e6cc40a95eb0b3b4e304998163ad56548d2b556986ac12685ff353bb8a24798183c495ab03c0d7fac9a33be30e60f1c87610228c7ac788bf905b80d52f57260c3ca3e80bc674ac0e1259631cbbfb0dd1adde6a9aaa7611fc788e0f8d5f6ab4bfa529d03c787722678a0e5ee37d2483bf16f3f82eee3846e77b07e8bdb14b778ea3d0af85e5fe468e49b50ff39de6d7776c872659711ff34673d26bb7804bc1a4166b3cdea61a83d53bb50a667152c44c9684fea4ddd080383bd0833c22c8972747988c4ca10d23048a80456cf0f1fb298e6a0b95ad1a4f653d3a159369da55522f2a7b666d33b855f76f87e758cf5b8aabb991cdb3f2881a78f3d7f93167373a92d04bf5b4b4255b5b0f43694f8bf0f658d8be8dbf17ff17b2d6de95d9f86e5daf77f28e1e99cdf492498ea26d0fc46625157fbc96390fa96c17c6f752babb2a2a98b0089d33ec7460c0a44bf851acbe3ed27fa9162d8f495785bbe68c508cd4ecd8be3a67269c37d34c6ec06211524d5d2a192c88e5fb9d5da5ac3755f1371b9628b8cffef730a0ef1b6703a93d4c089be3f257bdf6c7b9db369118babaecf76f09a42f8b37e9beb6faab53ab613aa714d1478e4ee7f16c11b218cc8a3fd55fb3f924828bfcf5348de9bb752b88181654186f86102fa9e23d9de8f2eee3f0a8cafdfd9b3f20993041c87695eb02f901aba9f6d3af166808ec75024d50b10dc539b0b4335eb61fba0bf3b22c413f0e2c809532bada9e0a49791821508d7116f8322a38356f1ae3641104283c7d2825f4587bcfb6d371bbf76dc5adf48f77b4ddcc631114f758051be56ee124e4cb0336fd3927c6a515188148908548280292938b7e7cdd5ac9e2724ef1071e94e2a519ff414245e6798ffc2b2608f9e4db93d611f3d51ced5fe0c5419988ba9846b9ad2bb9b4329786b6c0fc70f0965bd04a89ac83eeb8cc6a04da123f524c14c78c99d5d9a44ea69d33614dc6880bbd6020e0d1e40dc005714e7c7a709695f10dffec53ac2713bbd2e3703b76a76dc0a317bce6049e548457bdf3984d9186d8c65b5d30f1576eba33660c02ac80f6e1ada6106ce8889dee32eca4bef6db749f15fda34a38549203deee5a8b8e2fd4f5d86655c40ce1d3c8fda294c9bf851142899ba5623ec0e550be80219f27989116d27b541fd3e13de98cc6b267f4ad05c4ea025f975e31c40780727e0ebc68128b1c059507492fdb7acb7074908cf9d4d319f9eb6b490c3bf559e094492c87e116033f5490f2d060deb46d2145b9c97508a942b9ec91af6c56fc084cdd0890db755371e446dcc2526683fa1681a0bbe9e8078f885c2b2d04e65bb35c5fce26df9da19c787293140b7543d507aebc86ea1d10ad7e0aea1195a6010eac2126a8eb87292996140b7b260aeb73d28ba27950aa0cabb29fd85c5c4a4c11992929664b41c4bdcb66d521e2a6a3f11d07ae002c581c54bae1b476d684e09efd57d6c365b47574b19c6ebae08ef8127c4346035a5d0eeebb6e3392f20371e0df32b2b173f5323166a260d90006e9eec2e915bd839310d426fd16a791535294b2276a41feb6d1b03b104b918f7b263a7e71c1e9a9519948862a3a0309798514ea8cb1dd8645ea112c16a37f7c56d8bef299716804093bf898d060a8a3d29aacdbe7f2ae58edbd860f1cfda5a7c45c18eebabf2c74a6788a6f1d6da367677f0443a706e9e4ec7a9a1a07d80987cec8ce014d66ecbac142ba9cbab5d8fa85053f002eb6b56bc6b1e6bf71e007fef586c75045a9e1403241d75550c83d12acc1ac6f427c39d421f59657368e9128c64e2623d97b767b13cd5e93a40a24c780da043ee390b9be8c78fc259fee757c47d35c186eed6bb473b461c75dc48175b371684df2ebb3c3fe74cad5bf0d881749c064782dc339893a508f6257f9cf93336df6f16e6a0c9e313a20410f86b396c33ff752a903dee113b475fa7465dd946e6a80c50da096de82b8ef0d920b0dcb061c1adea911c31f0fe18f746bd689cf3ad7fa5d1931037fd78590176cb19d922f994c13cf94f77343ef1c1d6d4ec2ad2736da27aa22d2b791ac0d92b84d491e33d8f394d0a0dbbdfde66606641413ffe1ae5d172dd44703be01974b8e8a15b7aff32685baf72cbd14086ad251214c5dfbfed2a458d6845794a4251d32131aa495a7d82e10fe6621dcb07df2836493788479ab86f2ff5b131cb046d027b916990a55e1b3fa697ad6ce3af70710b1841b7d567f7d3f16d9f3de9c4b76d2d9eb8c602644f4f06c3b5ed0aa276aae1b69d2635a5a8ea1930f7a4ef71bf53878dc7536258afe9f6e9664ba85f401f6855c3776623d4e296c699357876512692e456c8c80e7c40c11fbf3ec71735d4024fd113de7fc4c915b85b851414732d444d68fb92999e373d6b5978fabac8e2e1342f1e5c44c747d1192ae45f32b2d69fedd3dd362b54be894cc2351d93237ccbc56c3a347c28046ae2721a70f137ca9e49069d89fa0f78896d9513fb69967ac372ee8515bce0e776950197a9a1886d0f7c911b914ec8d63844b2bcf1f13438bd57b82239aeb7f35f9e2539c77cb85ca8dec6141537bf8eddfba1c56d74c018500b39b9f49560f6aafd44187b5fa69e817af79a144a7c52721570c34b5f29b3f10ec974d0d96877129405d5367015ef83f442f218a7e3309180f2248ac8bc0005c405c4f3b636d8e592d22ddb7ab94ef6b01a40bd37aac3c9520dc47b94fc3d6eaa3f9def5ced9afc0d5f968b746326bc83b47d1a25f290fcae5c009e0a49e2ca4d80afcaf1b074e7f75e6d1afecbb14e1aa0631dc17f5785cf3a563baee9f9246934ba85427c2eb7f734edb40e6c443da885ddfbe266c920acd370237837e5333b3cb40d2fdb9288c15b0d6d0ce05194aca5d819e6f9ea26fdd930897b785d592a4f148933b97b0363cdcd7ddb1cc90d4f4ae5a172fbc2010b7e039037d3099de8ccd0f9f6aa9cd35e2781eed23db8b9bb7638ec5cf1107966de84af1884b8a3574ab7774e9ff9bab78ebb059d324af59b4823f263ba686d74b1d0ed15985c28bb7c9a9cd107033642b2bd38f7db27916f64ab231ef5ed70930fb5dd5bfbc4574867ffa8b51bac31688ff79922f229dc277042022eabe45eb1ea6a39021f44ed49b9fa12c3001bd1f4533b725d6dc1708190f2f87adbb76e4e4306cc6b1e240711920686e2b4061e1ef4a2dc8cc57cdd8b21fcc8f1934d4e77360bf4f9e27e940ebc544db0ab7c817c31f79496958c32ac36df5dab67090de23a45c825ffc195c3baf21ce13ecaf341e228734c52084b2d07853fddf242b7c598db50a157d88e79898f61d97766a47315eef4c7f27142948646db096f33fa787222fb755cf12b98409be5dd4467b58afe8826278584254462ec064024d84e6d6470ac39d5ffa2adcd81c2ba570a0692be894d9562413aeecf91c24c6fe4fed8181031f9003b22db295940841590eab4ab7b1573ea8d3f4ed28c3a15078db1a22bcb56c2e6e328959c411b6aa5be88648720da5ee19349203bd2a205f3a19cd428edf43e6d7385765694b93f53b14a307c2e8185aa14e421524f4e31a68d682be37047d8ca34271d190159a69c9f4a9e0db17058209f02587bd68a4051a81add7cd001de895fc9b34c01c10e104f006c4f454493d74ddc3636c8b39c38b49a3da81dd75d3576717fe78cd7bc0cba49fcb35ce9cce5858114477561c8a2980377f339673cbd25bc8f589376a6abf7f54575df3fdbd6e1adc1706a82dfb76b658ecb8803ae84debe7458fc1fcfbb283c1c2ae25bb8f2e34eed836ef4be7c580574964eb1209ef02a07cfc9887cd943332669f6f26fa1b9f6a91415a631948f07b9495a939a2c9dd47a0659cada1ec245305d2168890ddc8e70b99ea4c5d303334a35644662bb1a5ec5cac8b3b91929f45f8151d5df560ee2ea2179a3af1cc45449f6497a7d49f15d4c110b0459ede7e5e8137ca349f2965b976f1b3ff59aeb4134f846c39fad0de8bc429e998a5c339c7e08ff2d6fa009e16aa6447cacc58e9d53630ba052c7ee5f7e4cbdbb77a256d39ee084aa9cca12f1a37cb07e6af94b217ff8a856cc3b79943d7895360d452414457f87d00cb8efd1e35ea63eddafb9da3f9b4e052f9d7cb568b39d4bb1aaaabd47a73ec455b6c00bb5f988ca120272edd4e78b83a391815cc86cf5487c2510db1b638b16b391e194b05e9ac2e7b0d3bba559557c4f60dd52373509e2eaa94a1a06417f82292e51d247660c99efa26d2fb9b1096b3e88b08a4c028c490bcfe995e1d38309a8b3e5f91e578d15139e18020c7fb34ae60a78ea0c33720db94ff778ffc50bcd650a79402fc85b200be79f8a01a36a3f9a3d2b3bf7d87a85e5b4235fd865c295a532e63e149ef4a49d2bf907b55c0d2d8ad3258047ff5f73c06e1fbf0971e4814a77ac0fb1cd8aff61f50a72b70f285d64d0e1301aa4c6570b0a43e93f317900775b3dd20013f2d597a5600191157166695c82931de52fb45f1cb0161974efd1ec7d79a2ec317729847644d865657e9c09dc383ff342c144d6cc5c6f9131c148793922a5a44ddebdfb042898ce54dab7c3e95e60ed43c5417edfb6293184893153310eaec291b7e99a560ed8d58e451e0707dcc62b3375cc5507ee795a9c0cc26e21c7ae0dbb074ac563d56e3c3084a3a8a8ededc8e7d009fe56d13e6c036222fca00111fe21e9a3a24847b0c25a68a5f9f2eef3467993253ece2cdfe7230bf34d76bbabe5968d4058f8e77d954cac3550bf81bbf8ed42adbdb71048990731dc8399c61fa1b1a30e9084b269b552fc61db3bc4f810bcc1e4dd49dae29633b262500b3c889f35e4cbf1f64b78d175f508bd7533fa14aead7d31cb41de0a8032e106734ded496261cc89ddaa037925254299cadce7ffa9eceecbdb59d3c8ea001b661cdddbbca3b13c3e21edcc5849889d73f2cd601e3983dbf32f186e084634d770a3bb31cf937292e128a9e5c47f89b8cecff667625fed7994450356801452aad4c71392cfb40d87dec7f5b360d62fb063ef7e801af303736fe63ef0d1c74738458a4d9e3c53bac7bac2027697c18fb183c9f23856f804d45cec624df231dc91c44bc52659531372d7abfde680e09e4a7bfdf107be61ef9910428ed941285654f936b8a0038602563bc5b92cc85c5217e6fc73c25323cf6c4e980db23eb110516c447bf4b06bdccddc6cc3ec95f0734c9f8b37346119bbca70155623dea41b9a3ba3b3588919434aa92ad3072a07bdcdc43bf385eca8e6222a999cb3755db66fba45da8ea58a995ee3c65e00e2e14774fc574ce870830acc36720b1cfdc159fff8a1c4dd74010f1b816320a97389acae33f346c926ef57d1bf913ec36aa45176364872d298d98961ffd92d68bc0ea05c771d0716d580f8e4542b3796e5322e98f9868512cde9b0fe77988efd55ac7f1b1193fb3ae1f1a5299760fb340b20f2d2f28278c4da1ed1af3a6bc537dc475fd3a9a101f069df2f688ab61558829", 0x1000}, {&(0x7f0000007a80)="c43abfec2b5bca4fce5a0cb09c5cbfefdd7247197e38ff0bd0d0425303a7f5eb7e81e61e44cc761b49658c00c97570a444b37c27e43911b9bf94cbb1fa1f3b0b35b372ccaee5a14b36792fb707ae96c59cd5fac45dbb6f0f1b9736c0e6be441578a5ba5479fa776b6dcf3420671cf81ab7f3deb4b776f6698beb8e4449553978038dfec1e654f0cc281fadc92e2da07753cabe97c218e30e6d3312b39b66ab31171e0803b88abd1af5994a7e88fe6fb310320627c85c8554d49ace652cc1a167944e8b3ba96c", 0xc6}, {&(0x7f0000007b80)="1f79fe07dcf928bb6e6a35c41c5b41d9ff697438a73ffbedcd5bace649486424156bfb394d9c1a2e8f9db24b78865e44db2455c3ef2249abd33c1a47766fe208079763ea25e16dbeac3b6f1d6291c9b2be67282510e11893b6550d542ab4ac2bf839bf", 0x63}, {&(0x7f0000007c00)="328ba207569f921245e16e45b01d9392b461971911581c668b799efcdabadec7fbea462e59eba877a574230d413c6dfd2a3027d53225831e2c6bae63bb86073cb4ddb4caec906fbf61ec49f31f326c32bc61763ee5718353bc36c9b4ee4b7d1e322b76d30f5da2fcf2228b5c980ae8d15ab288534f2bf6c276bb9da6b32f7842eef04f7dd3911bad67b3c1d1a059eefa1311b81d5fd05d4ac1b9b5a9fd79a31166dc63d6936c56303a9015ee5513a6db84440946aa45b6d47173e397a10f03", 0xbf}, {&(0x7f0000007cc0)="595fc9a263644277104b164050b000a25bb92b4ae29784f11b67e440c8b6941a1c41952ad5bbb2968276eb85d3b479d6", 0x30}], 0x8, &(0x7f0000007d80)=[{0x1010, 0x333, 0x8, "44b986b80135eb09251acd2cc5809eb6034ea512edce2626b5e9a58b35aa3259b4b5f7460080d4aa9efb5cdb9c7740546b248eeffcae0166627bf2bb35c4d30fb9068b08c67949bc95a2117770de9d231e833d1350017aae0e878854e59e4382f4ffed326b51426446a1ad6d2fad4db00a9b06de0df15e8c72738eba93aaa3f6cd08861b37e7e138bc5209b106ef6cd4d5c6c7d6ad48f9f252b31b15f3da25bce85c22595a3ede1d83b41e2e4f03a009c329c442a586973308ba34a19c395d1754607d5adcc18ed315af04c133a9838187cf366b1fbf8093a6e1304be2a658ea02fd461fd10f807dc77ffc6fe840459e35676e230aba17cc692f12afc7b2f34abe700ae84027da72396bb45c77f6c93b20cb18ca94258aaef9486479ff029be52d7331ad1a8532104b96576337701a4fbc457faa0467a8f9ba7f13f091f185947e1fd1bae8366d6d6521ad7d5d3c1a72a2cb4b6c760b2966502757720e8aeff640850fb7b24ddc348cd582739a13f72e2a6ba5615678937ed144cbdd9405e0723429c8728d71ace494af276b6f5e9734668d6a73642a0713a5ee0f6a2845d5de582983fda06136446f71e6478bc6ea825ee44e45e4b6d6e905540ed0b7a252cc00869f7fdf4b3ac6ac4aa824f11a0cee3201c7301bae62e8c20fc31579510854dfd291ef21c8bcfa37b7470daeb939c4413238d634c0659424a30441792feb8a540ad8e207a25b26cff3ad4209277c96ae22b381f88b3d1bc2ea6c56b83021141db84f0ae5fb0aca77afdc7f964098c5bbe825c72f9170b7e400102e73118a257c0750d04d972998107d7a6b37f666ad3a424a8d9921223c06940906954de45f2c28844da162154e811e531df3ac41f344e598fc86d874911e3260b81dcd6dace422b1a5e12a22317a2e1f6755d5594b97c319c4208ed80f5f876a5d30436e503af19531ecade79cb6b6657f48c669f462963dd4ff1b0f44cbf8c5cbe6cf49de824c16b996271b1d8ab2c23e7d05535c680664ad713dd8ac3a3a053ccf9510d9f7b91cff17fde71e3acbc1ca05e626de1aa6a93e371aba0fae53cd3ae8d4752120648c921513dde84843d153441938afb3194c7d699ed663e003954a7c663ed0f62b7c8f43875f52cbc7aba0003cb1a9e353246ec9668fb0aba8fbbe25ee2b9ac30208f7d6b00f3737e170f96eb8afbf8ceb2b5a8a646492c7222c411d2b41251d452a8ab474935ca8baf180fc5e88052a45f318722c110e96e697531f8e926e667692b281b8e9c02775959829371d2af263ccb60d8a23ddb08d1eb159db69d76a687d01fb8dfc3e300d05c89a4bb6101c865e0c3c161437c30d29740a38bca97a714def22db509c1a4e6c60deddfd734a27ad6c3129a5ed61559057435d7787863078f21f1e216c5b62a6759a67c97766612c80291f118c0d4936e90fdac57f089ea4499f6e5f2a80949a5801d257d4066fa97049ebfce33c571389f596e6383553992bc9a46582ae89288664885471d1be5b983ea66f22628edc25f10890917c744345368661c768f3b5aa775eb36ccdfbd93cb83b4533db3b22e9285a4304ca65ce32fde68a3485756536689ac1ef47d0c72216f29056461411a9b01e72a6bd794fd9137cf689be73652e94b8544e578c3ec243f16fcec038a309aab35d9a314233194e3623345a2af856a8c088a41ab5f617231dca02d23a139a157faae239a0d3006f52649556172a1c204b2c018e126dd3c8976d6ecf7b06892d4c8ae296fccc8f96545b1f1b80bde62c9ca90f4b9ff59881f72d81f3c6c0d6b808b70468fc92192e10bbc74373c97faf79cf27154573a465afb32b23455f81284bb0d9201c283f9764088696fe95918e49f34e3f9a000a68a1509fbcb4c5f81c75624c2aeebd739525c4a9ed2358e10c18e6ab3726b37b60f0960f1a352d9d7eed80d4d05a8eee4f96248d76ad8f6602610af71d16e237d1d34a6b371bc0e19ca76ab81bc4600ba976455b1ef2b411e662c856fae1e7193fa32da232ba318a1dbf5317505f8415735229a7af303112c25973ea855d9dbe7db2c8ea57876c1681e9e5a5e94440ab8cb77a72bdc3bb10f99d85d4282cb8462c8161fb7ced6a4aaab3ba927721c5ef8bb15795e364142fc14a767c4562b2da1aba310bad3a3116c195741478c9a0f0267d365e8ef88e5b216f19d48bc709cf2f42487fd46ce7d3b86c23499863359680b54ccd7a8fa63e5f26bffb00ce895a693d526adc2655d8ef06d0797fb78c1f298a0dac026329605fe6ecc9ad576ee793a6b2d1f3230d68bcd197ef49dc7053eac01b16a3b58e2f6fd5c1864379cad7da4b7960e58a3684fde99a3f4ab642acdb3655f8f560a2256af1183c77775d9fb11998a8eafa18a61a76f344cb3d271ea0a16a9595e764a9e9d02c2113299c3c51b88604e2d2195a6d065d3d4f538f9ba508e64e60bcbdd5b043d92d76b067579e1c0ec186ce6d6c2f6c44424e7705ccc3230a206ee11bfe02ff01111fb5e408e1fb8017cd876ebee31fe4a8bf797c01103def8c36a690dad649398fc96ee0c40ef07f0899a292a3dacc5152745fc7782294d89e96ff88081fe46db15b0536fd2ded231b488019d38ae90855f8cd5d20aec45d6dea990c817598151c1874500d17560b0073c239e26817eb55c540709df84e6df545bca3bde28bf8ad34bd81d5039deb3e5c0336b67a20afe2a36cb9623ce3d20f5f7a1cc5cef038d9d94bc1ab4d2cd612adba59be9acc3d432a35ebf2c475c386cb43dc24bf01212b6a7eb9870e36b084cac385e3976aa5fd7ba117ebd27546fdb271391cbb77fd7b54328b606eef741e6a209e5a7c1bfbf4f2d7bb11cde3782cb43be053cef7c23e2436914570f0c53cdaa06b39be56165170a4cb575b0aa23048ff99301856096a055c38fab3d9284613a3bc12c4bbef22d30a1a6d7b88633dcc54b38b4160a17a7e2da5f4fa8490548c004933bbd977e4d320f5c2ae848207805db0da1e01654eb7aba877dae0d00aa81cafce17eaac8ee5b964768a4db59af9011d5b5181ec761ccf10a0e040cd42622c905b2905d591106954018a4f6a66cd024295dc391cb0b02cc623a08e4dae36b5530bcb9f6ab790666bea365ad9d875d61ab9a58695eb9b991c7e997747b6aad8ac99f656f06b08dad2a3472a4c543a59f3f5b959f1e9774678f2374cd62b88e8f6370655b6473197de6697c4e7697f0c45084b9558726c4f766c2a668b6326cce2facac23b8d7b4c5431e6da865b243f4a5409ea77297a0ce01c10e20f850262590736769459bd95f7dd039a288803d0786d559de865d33b61b88a894aea0c39c0e2f785a3eff184f9691704a4fe35a8fe4c32bdea969ab829d6be2f9c4f8fef1b94fa03a924c834acb8b5c96c07b139f68617507976fdc67d73670a564e3c8ba5f827a3d460d5e4483234b8de6341eb35af3f96b73097476681eeae6bb3e7e6d6cd7ee58f147e0e4c75e8fdfc38484337c9a4e1bb822be1738240415b4c9bafb983d190db5b2c0b3614cc076c8c734d958e25ef04242989afd5403368a858700f6d16683b945530a9b5d50a5c36a5a4adc4273e2f9093f3422c936dd69424d9cbe0d489d982a757423be2edec57a703f1a1fbebeda60c35d36367975f511eaa22e1beaee7f3cb92f8b39156dfc1f73c7e157e34f1e98c48f566cc77b992a9a12af5895192da3d8e4c2f9b03b6fe26ec8d8ed9bac4c82582ca695add417f9fa1e1bca3490e5b3a650f85e0615fe54f291f34ea046eaf81002e6092dd1080aa6e4bba4106734d811733f9fccb4723a2f017e758c81d528d7bd842b6c40d6b638b1ef188b67b8b518c0a150671b6ec1097c1f4cee43347bf26862756b808a554f7114eb35170a03b9058fed0f6dc544eb80a0a05bd06f82a3cac17549949cfb903a8be94fa80158e7d8a3a24ab9936ab9a05eca73218ebc11c54494422b892ebf8af796391f5c0f6fedd78866c464c6b3e9370666a74741cc4d5dbb229a49630539ce7f8ec57f680ded81b8db4ec99aa129fdb3aaf985e39448430ff688168aaed73846b357c23806baf8d2ab4e0389fefaa768ae1c3fe2ab3fb77952766ddca08e757511548401479b4b144e03966bee9f6eaa71b7389681b811f67f0e66247a93056aa7f5e2c4479de31fabb66135022dba1582a6c4788e2cfbe8346b5535d62d20f6dfcb80fd787e4f0475bc3431362d851ae724d15437a62c844a3c145db2c2cbcf87809fb7b6cdf3bf1c2bfb9de4b7d299f2dc86d66b903bf08264419e0f4b132aed91edcdc726ee0cf33fd8bbaefb2e8554b2a175cf4fe79e8905f801d816784d1364796fa0e923c47405a01d623c2545b1e1420a169801ebae2b8e1fb24c2640042c5a18053d8a1e31fb617e3c5e2c1d6fd10807f30b3194ef55d4409b980b6437544ed8fe2f9593a5b9e270c58b29bc29ac50f16c39742fb014904126acf7fff64646b566ceedd65817f0de0bbaae3433fbc5475e7dc1b48a3315810e0cbb4998f0e3e1c61ce137547b2dd9ec6beae8a9c69ea753adfaaa9b44e0fb57b1765f2eb05a9d5d5126bc13944db40eaf1acca31c4de92a1f13ece89da62e4f41f7b9abdce877b52004329a488106efb6017c066278bfcaacc7218014269272a06bf2f137b49849ab3ff8b5049e609f8db0afbcc2cac57b4b425a5dd9f6117d9e03b9ed0d67ca4660a05ea9f7c6f18df763569057e06bc8035e8f550e5aff8e87176a5cbbf50b0f96851149737079a052fc722073aefdd2c6a2d3b2dee701b8c8476bb57129ffd0a6bd8c5e82c08de0fa627e85c61050ae42c3e7cf3ee8a20bcd1162db85abb0df33c1eaf414eb543a5da36e974d8802f2b48a1070a18af617da3a3cf9a353c334e036ad0353ddb6ab0bb056432ed4883a191ce7cf7af5dcb114b2ae406bfe95524c70a5f89ededff5ff2a247b6ea2f5dd14da79328160ee4284242c21271d8584653351f07ef984cdadfc7960e4736a3fd7267340f06cfb99f510a961e936b04dadbc72d7e14938c03cb5fe99c5a032b5358364540a3a749dc084906b3db04333ba4fc806820b2c4f02a8faeebe519f7062f4fa8ace4589c449b6fae7200f9739cbb27aab509c4fa761111a36d38250ab4b9707858b017fb4b38dea040e316624c0d3a6139b8a95fce74dac1e66f6e93fc8453692469498a4594775e2ff35c149c21747ed6f4c4ade2102c3541d8fc258e12f700682349da0509db78ae1559d408cd2bc0be21fc75433e7aa0e01bb56de76852602d794695ea66ff7ba91f7d2b7cfbcb2a1a1ebbb57eac0ec5a916d6aded67c30ca98eff57cedff106ab21409b4cafb2291236f6ca8e0b85817e67e7c035629cd9505f0079178f7956a54c63977110e8afe6eda495784edca6ff0908a6e484857b7b8dc90fa369bd4bee4630d93dbe1a6f8a1be4913b88d27aca926ea6257a72855bcb05a7e36bc54c7c73616cf74958f331bc5353fc5b5bd6d5fdfca33f0ed328ed1f31ee013641251eb6bcc0bdb344c0c23fb910d65533aacdec3acb1671b217009ad082400913aa976213d59e026ff2e6948129007bfd7ddc36b0dc498417c46485edac1e58b6f7f49289f58ddf268e376fbd4f0acd2ce2b39ef3853e360858ae2e3c88fab9fad1b27f19c0d8c02d3a8c3558563b124f5cddaf296157ba77bf18a43e788694d9c6206523cae90b16045a5ed2a43205c866df2c516be3edb6bc41c197746e32da20b7bb9b35c39f32d1162cc9b0341df4ab43edcf0529408ddf5e43b8b6e0a232e366e95e"}, {0x18, 0x11, 0x0, 'F'}, {0x1010, 0x101, 0x1f, "000cd47d4be5eca2eab5f95b997a74f318df87ab02d394b3165ede5e7d68fa0075f2a407f27a694102d67f063b523d81ac35b96120dd7f22e21018f3f98464698996191f5ce785d120767012f21b37b35ec0adcfb7ff90b1591904eeaa1bd73e30c6c46f2a707dd6a94c97712fccce288064be30fb23301a9c3daefe577f3e4f6a0987e86e6cc6ca003f9379974111578d0afdd47be140211315442c2951a3d6bf9eebb3717f4f39c3c582cb394eb3dd512088b3c91b9e1c8bb2dce00b7e28a339d8ae0d7e777c38005a380ead74de3d37dbb3e8d2bb3b6c28829d15ff604a5dc1b41734989dcbc1184c00f56aa7fe1af83663ee68dbf93c964c9430fa8d9d68c05b08f34c5c9576b9efb1d90e64787d638e175affc94dd3631f189535ead9746c2f6f0001a820f74b886fc70d64559e96ee4080aef28371e7e65b0482b7e00791509e76ac0f23b0fc20cf326383a048fac41eeb9a2679f47746f1e3974de73d5a422c731c3473f11d51635de1dbd82a912c222045006e7a7ae95a6b991decff16829aff551adaecda59f0f3be19bff85f415fba923b59019517b1469098dce1dace14117e134453f6b117b41f0fe525ffc019e8304eb5ff150d4a9a909ed3a08a70783fabbead27121992036f42ede6f243a5daf031156fbe3f9041675ca31bc63194adb9853a552c0143cb508b95a2b4fdc66690764df523700777b4824b3c927fcb3db589411d068057aa3554ec6f0cf361d15a2b88e6e29ddd6796502510f1d1c0f27ab784e80926bf4b664b16a325a14d64ac4595f0fc74c8fca66ca80e557791726414dbe29e55d54013eb206d3093964eeae22dc7b222052175ea1ca055ce426ad186c963a970a18a5d0c41ff1ce1ed2f46b0e88a4ffcafe1c5dcdc4d1d3633149aae417050f9f096bdd79f9834d0e3badcd53dbcfdf34dea772382498f7861bba1180d7977052aa362c84b3ba2889ecc100fc49d6dfb9fc2cff74e16ecc4304459ae245f4bad7e79665ec6540548a07463dbd94a64c117e983ae9158ef7a2b1447b7fb16ae51b8288378b43126c4050f8ffaa64d6a712d6c1cf46255409fb138e5dfaf10bba63c41c6685f9d5d1b33955853a6cccfe36162295ef82547bb01df48d66389401aac8adc748e5deba4ba93adb623ad6ba63cbeabb1a9d8573cd6e6027706ae3dfd6933a3a586a145b866f94e5d51722e3286cfcdb053e1c93987e2ab7f58e7b663fc1485ee67802f6d2942331e5a2c83c105d6753781ae2f8ce2eed767a83313bfc3bd461b7b723b5db7e1061d202957acfe734d9dde30e8d34690ca008639ddcc26b16d186c7d0ead64fce21b0c84c068e8c2f14905a67dcefbba008400e2eed058819ea722df420ee47644c7289e49a6181896535dddd69f47f68f3dc8b4a455b4d60343a7f19a4e35bd50a0b8902d5f9849c0605a8eff3ad58422d34d9dff82254d7c021a62165a87e2869bdec51e0540ccdf9909ea0dd65ade53067bb8e561e6d0a51744eb69ed96f1105e4521c9d05c13e68090558e7f527418e80b50aeae718d4a41535dd61ea3665c4f6d291e44751eb5efe2192110f51b828f7a58f285ddbc24ba2060d42a0ae10e33663a8493cb9265abfe5852f05fa4f9b8066353420c6c228cdaa64f7cf08f346d57a5a7dbbb6a29ee29d0eacdd01bf6e2ffbe7f2cec115e6e0a0fc47f213172f7c7385be2ee9b9b89b8c14c50173683ab7fb6f561f346ce324922886bfd426be80e50de9eb21d5e7af53f1676237f25863879983a3cd6ef35ec92adba5a24ccccfac5a7f13f2bf9868c366afc0ad7d55d1a2f965703fa110c9bfc169d06e693e771bb989f44f544cb190626479ee190abfb2a739c7ea72aa6ee0e32ae4bbdba2d50e079fd4b6a7e376f33659401dea90c74f47381f8e08c9bb1b619938fe16ebf3576c1dc1a8e81ac9794fd875688460c6028d05a863b86158c3f3454a64e6e295c493b53e7061a1de0681cd60952b871bda655301ea807f408e9fd0c830d5a1d65710a8f01b81dcc6432e32563f2073a1b94a3110e5f0fb08f6f8850c61f7847542ef005fcbac2b150d3484b61cdb0cbde7e9c58f7738a0209e72e75934b54ddd70278fb38687d4fe079af6b5ad5a9141c2110a15cf838d9ed319dcd58299c45af8f2696ad8a73ce66d565f44b24245205d792cea3ac4465039ae4cef8ecf2e2e1da987f19f44417b319cb1258076a94c9608bf121e39d66ab5b150bbde3a8b84a44d08cb515fa8883c5ad79a5dbfb82e1f5352dd44ead25280a829a52517f619da1540bcbb940e629b0f1ee18b2b4bc5c35f9e72a97919c0eadef856add2425d27e2d102666d58fff9a168f33f954eae142ab22248d1d5e084955b2c81ab1fe938677b2440528974996694f809cf6666d141f7b1c4bf971293b50868cbf42746439d9182fc44ff1c9b1807d6b49aff39f46b3cec12174e21125fe522d6f001706631268ea5c1f885b5bd88e198c035b412a4585675af457f630f69ffa8e4201b9c4fdcb0c86e762a9d8fe6ee84e0b9c032fbc12a80bf87edd2a548725be1bec8b61ba806a3e36fc2750ebfc047b977198d63c8bc6e7278e3a3b84c954c3f079e4a7fe3e0e7f5e93a6c1d2388ae269e132e27e0d62a44be71a317f089e71a7f54889e67559cdd5395b92068c7228af9a9134f95706ddc5dbe3404df8d5ab9a2677f5d43edd6e62aaa235f48d66fa881f50451bacb7510cc39d3149614ded27a5ca5a40f68ca2c48d926edd5790712725f207087092d0a0d94d632af931ef5b2cdd2ff13a0a9ef8900626c3a70fd3cca29c34946053b6dadc31fe0526ccda720b3ddb9a9bd4dc3e554b2dfb08a5e5e1bebe5b933010f150277258685b9c74aa69cd4bba473d85265989d956599201c95d965cd60c2b1c3777d13228c58d619660caf434b9cd6abc48522676b654d689fa6b27b9b1f4f44140e456c67e4759596f7410d174f443370807e9a7de9efed80d9bf4495b3747584bc5438e2a622727197058792c97d672b1bd7f25ca2cc3c3adcdda5789219d33d9d44061fe78640a907529b3124b4af479f4ae52a5ff3f3f638603e6f5217ad50d06b840b2700eb3d26420d1d0c1b2d990884babee3c486f089aff8814453ac8ed97140930a910d2c4c74612d32ad2b7ca8a3e5242ace5abb761d6171cd29b3a073df5ab2d8433f89e21ca45bac62845d976488d382020c5544ee8febe28f13b479ea0e0c32256e37544350ed83639899abedba7e8f792db187eedc7d79336f65094da5fe319d4762d96707506d17a0d002851b0940f3c5435a67ec2f6da414dce6d5078a32655ee8f5d7d90a40e137c9c9cbce4e00b4bb49a9ab99639cee99b2d38fe88a16de0ff92d198c056e11eaa0224c3b177796ec32b482d6b21378f5450dc12074b8848af4f0f875bc2c8589a5b29bf3c667a10d5a367b1b579fa72d92eb47977a769f0b9240b8541f5747f0e7bcfd8f0ca94daefe5b5e32d33750d9af4c10853495fe43eb8918174e1e21a74247f9da07b5858aa64f8c09e19b0f0ae9a0ad83727ed460c22ac3614f48b3546dd3d328312270c5348e33c76fc0cd2ece30bbfaada2647c68fae8edf8b61ed7fcdb57cf77134497bd67c4ca6a0a9d613d7fde9d5d9d752beb8476f27d1758bc6fd7757816fb6e57612622ad0c9bcab563ffe2d787c6f81489111411996d2199798fc68581d890713acebf1aea1965f3beef404188154b5b482e55501d3bef54224078f571aa3363d96efa7a5ec7218957c344c893ed90fce8e207de6388cf4d8a77653c85b2212421a76c9394fb709997eb1ef3e83c0d37f49b33926aabd317be0185c5815a541fd541955e0783ccdcbd3bf5e0353f1bcf3603e2e0fc50ae8bf5774e6d2800d23920b92e90b967f16f34864e19b19df62e91f8eacd2e964a569a2485d7e36672daa9225932b356f60434c957de4f320dbdeb769b40d38afe662742eb7ade723954f608f37a324c52ada16e2beaca181070e431c8f20d07360a09d164f2b81bf830a208e5e8bfa6daf9304f2238505a2af8397dda7e597f20285cd878c66989d34d6967a0fff41880e603539dd2c7b746c7c57e1f9c9e4da1ffaf9ca9ced0f1330cd326fac2c9409b545d7ff677270ef1a64d40664ad76668019bdcee4e1987b2e45750ce273c07adac246f8eff7eeb010a2a098076e486233a5353b95d049ce756e1a034973f593585fb3dea0fdc5f6a5d3ceecd9abc296e7cfef9770d67cc1b5e83b8da95046555f389c697b325bc8bc72a193edacd3ef19711d07a0481629b40550d14426cd5c3dd41d1bc005e8272051b5176788a0b57ddc1224864879ce10c1939b97e8824549da247c82010dcb614de1e20418853f394f59b3833905f92b6b0603baa8d0c022fbab764d7719c7cba5b756a353172fb38dd0377535ad11f6f866d453a4f269dee5918c32668cdf63c38425599a612e08db15b2314e61c5ef42f9a4889a72bbeef7f7e29f75c562d2e815a2977ea11fd0b2bd2f80d62855652dc6ffd72d6a21bdbf18eb4661511ac3c056b6267946d91173bfaf510d80f6c3bc8d9146a804a79d229a3a531724ff83f7536f041d31ead57d664236bba1fc333cc37691c51ddb2c63043c20afaf8b904408b873e1dd3b2d06afef32d6546e0bd7e96bcd3d63dc8898220d462408e9a9feb98af7eee3ffd71eec7973d5ab2924746a0bf8e0c56e80519b7027d93a35c171ffc2aa5cf26a05a14e0b4f020e305e6de0cbed9a979b3381b33b4f9c1967e24bf9b2d6a40d7629c44309f484de47715dcb4a82d9c27772ff224d1c695688f0ae621be28c53d8cc5214493a1989222fc453bcc87e608b091ebdd45ed2d068d3335f88c5590ed35c8b0d470e2134486cf377742e91eb51b3d5a4e0b48679d8d8fd0a6ee56e1f6ca78a47a451dffe85f0593a66b56802543947ac9ddbcc81ed731b9e875b2b8224a197ed3727632a54cdb666009b9827e730ac7cceb5a6aabb6008432723082c9ef5ea32e91eb92aded00550eb2c345cb7fd74fe9ee620866410ab6ff0d9159f9782bed3b8dd8ff37d57c40103fdec823b5f8bfd8c7739cb50fdf36044b7bb77ac3e70e80c47a49bef1efdffa912f1b151a3a10ac93dabcbcba20001ce77c18ab10d5089548365c6ce6d331c3dd9a3014a4a47e0040fdcabfe98277533d2238e40548524a996953767498449f90364d29db2f1cf974a47e5eb7010a657d44dbe99da63d1410d64cbfcd3da361a31951930ce07015abe28e900ee234a1ac845c19ede830d1a1561976fd03fd25e12d7d8fd523816790bdebe6149757e940117960a304ff9deec3c91712f6cc02622cde6701b997a8dadedc5fd3de359fe7e3db8f89aeddbfda4defc10e927081a558d2ae95e0dd5784a6fd3ed9e27bb7664720e6d2bbd234fab66164a219d3db598debd3db91df826cf028f7674ab3306212fd657b8c5ce33481935ff8cc06af20ad597a31042ac09bcf62f2b3326b6728bef2cdf5853903ca09219d6a28b6bce0bda9e1249305dcf798b4f70cc27bd132cbca3d96836c154d9ba06d07203336e1397910e91f0f54c82d0cbf9d84946f456f6cfd73e01fc1e9a5977435851db94f26ce9f11b8e9e21dd27cbae47cd8d0dbf3e0b43f51211f6de9d6f5a5dba6eccf48abd339e00d129836ce9881d325ab4ea65afa550678151939500ee259c31471361a2a029ed2358b0bca565a48ff4858030a142fc29e189aee23531f1b557878f6a8e6bce3fce90831db6d50df395ed8974fad173a5b22757"}, {0xd8, 0x10b, 0x2, "47b4d85aff1c2c538a66bf2598e11b025ed5a7541f8afa565c2ddbaccf9e48170704359483daf2d59608d0e88dfb36738c8d422bcac2e6d500308411e3a7e7a72a5356f1765d27f72982117b44e4ab7120d01ce93b5f6c09a634ce2bbbffaef7026466c2398ea50b04c4d348ea298b44cf7e7afc3df01ec0e9f6d7f258e60848737849ca39c965251943591f53557c1ef741a5e22286a4f539e1640b66b1c088568bd61620d28a9b0882d3ed40ef82cb11b8c2a968bfbad3330c672c5e19bc02629620fecc9878"}, {0x90, 0x108, 0x2, "03fb2f31bc7cb9793fdaaa261b99616f4afe83a0b197e223553bd01fcd50096cefdb59e4f11b8d8714e051a7c562724c098a1fbd0516a93f39c56e8e887571f797adb6463bad9e83f626e64766c78c1ef84f34010c4ff8944086d92b0d5740b1f4e0323861d703bebd10ea3d1b2520d19963bb753a96d47327ecfb76"}, {0x88, 0x105, 0x8, "7118c6bfc71423a1e92b3dc943b93defe37d5268d44cebd605b0c8339a0b53c3a598c42ec652bfc12e54122b83b8341f49f410ad4a7d4813e8a0c608866bcbe33cc7a5af282b2df38f67279f755badd514c2619f773722549af18c4c2bf0dbd85a0d0cb64101d881915c02ae0e2c388bb3ab7c52"}, {0xa8, 0x119, 0x4, "2610bbd9c2db61e6737ec2170ba11c0d58882b0046cce7696426dd57825bf4623d21f240ddc307c4aa8b84a76dc105dc50dba3aaba6f943b0d7407c3b38bdbb3520605cfdc6b0d81f02b159be5ba056703e0134213ebab6677070a8947dad9e2e44281ea49970d69959bc30ef1c371b55618ac11b252fe74b215f693774c8a13be2f5a1b4db55edadd1dfd09aa4376c2ca31fed7d8eb57a8"}, {0x20, 0x112, 0x10000, "59ff37739402dd0ae55cb674fe2859ae"}, {0x50, 0x102, 0x9, "f6459f09207a782290f265ef3d3cf6b87fe392c30cbed920f40cd79e145f8410dad5c8b77c48908c5b77e51956fe574f86b995e6dc1ee154a06b8c1c51"}, {0x58, 0x116, 0x0, "8b9d5c0c8a2ecc09fe4b2aff33e12eb662917504bdedc3a3b14ec10d655132992aed7d682d987cc7ecd92a7513cb04f746759d3d691729c497230eaf12e6cdaef810"}], 0x2398}}, {{0x0, 0x0, &(0x7f000000b500)=[{&(0x7f000000a140)="2bd377049cd072a153eca8189614ebc1e4bc5a521dbd11c600d9775487cb7a8a7ac666d72519b7dbba9f08b3ea4aa762d1e39fc0f103fac3d62462001d9709902a686e94e1bc44e7504f1494b7618ab27068b5f5febf32bd70bc44f80e0694f51dad288c96322a44cad5b4d2eb1894184b01e717", 0x74}, {&(0x7f000000a1c0)="d8e6a904e72052b330dc737d47677498e6a7bac226b39d555d5803dbd27ea03417adc0c95229c7ca18c4ab34cfb065d8464debca1f32f15ad97d3b7fa14da7a7602dbb70633b5ab7201e94ec8558ceecf355733d2314109998ec3a13cfae5b0d5baaf1f99da333497178c51023addc8854edc4de09b55888589f47e6362b55ccdc78d7d29fec7844624f4bcf8a026d6922978c513a30224b7f84e7ad39dffdb6e5201604b3bab221444a0fbda01e052675edde30f9b07c2db8ac6c06439b2ddd62663e467674ef27f73e748e5930863f0838dde8168cf94a5c962f374a00ee3e341266eaf94fbdc88d93", 0xea}, {&(0x7f000000a2c0)="e0a925aac57a458bd3e7e978389e977224a49bc0e08de3a5955ccdea31f812996abdc79ceddc3c7b33aa657160368ecafcc54f7503a5c36d692a60208f57dbb3bed649643cad7f9be512957eac10bb8ecee8d86d492af5af7be9665802d7e9e74e096830927a7708a1329f56293f0f65a7e9c051e393b034db94f42b5bf8f9ecefa267e4fabf517dad7e081228f50ea1af08536d6e44c236583c121e3e7c65c88acbc158f9cae7a99dd8778f5ac4f553f9adaff5bff398db69fd2b49caaee6e01b0db41877961ac1", 0xc8}, {&(0x7f000000a3c0)="d2920b1c22f2519e50636a475d912d431991d6e11a0f9f2424d8037cb08d9eb4be1b4c24a040fd3437180f7ccbc8e46d752f0e33d41a72909121ba7f800e3b7fac49edd6c885f17026843ccecd564d72633e9e76bc", 0x55}, {&(0x7f000000a440)="555fe940cef03cbf9eced0b9049c64809dc150dc5a123d3b8fdacecb708640ac9fc5183a7bcef3dcd088444cd972f193b92080a68da27908b22bd59c52c1f82da342fdfce1c71001b25ae9eea83a39e14fd99662975a54627cc9a68676da40cf680ba5b963d131f24c2f37cb788c24b915a5c3127a447796ccbd5dc4bf06884fa1593863f528b2159059bd1eb36f322bee136a2d230354f89623474a4d21e5a10569fd17adec02951884dd7d953b29695f0a7033bdf4eaefce98a32fcaff7aa58b144273fdb61a85e360780d0c6fdb7c9dfbaba26929d2000409ebd7260eaa20cbc46a49acee1363f15ddc4813d1d158b0a7256d3a332f7fc9bb078df5cdac675e05b4367f4984061ed044e211e9693ee594a55fb5bd1734fe135c2ae98adc6cb87ba96668535c99d1bf1219cc5ec575bf06af11893896816f54330c2c83989c5933650c79758cf14051c247c0f65cb80d3026a2923e95fb33aa6d82586501d5cf2b16129542c0c6c2b35871833c29b5d30dcf13228d315181a40aea894ed588f6c2245ff78cdaf643dd79eb92a7dff698cb4fe8dede8f0b186742a56cbcd862be698b72ce55a3ab22d532acf236e13784981931f242e12ef1107ec96d38a30e631e5bede03cfcfd17c3a744dfd253e814cfd779cc39c938c45fc64097d831347567e3544041a0615ac9ff3fd0d3bea0e0bf5d46b3aa1a5d2ea043bd642186e9cf46c1e60eb8880212d5d82a80466cfccbc84c12c7ac8d9d97f5b15ef1b00d8e16e91156ed5371d6504a37fd6be7bf1485c7f7752e4dc1d2c9e0f2e6343eef56967a852f1fc5b743ca5c2afc921ef3bf2095023263c7e7ef30dec77ed49c75b218f771f493cffe34c90463711fbde59f971f087124d27d50a1917ec8f8c4e9c97aeb484be1166a02d9c5f0e45d7be18ea97769b10270948d21197acbac8bd4823995c830b0eee042650156ebdfa69e273c55cb23cc23b81f75c85ca98632064a432a517d0223342d5d28dbf65692f1b8b32730d63258d3c9ba7588664b6822f4414d33cca17f4f5992817e79b0ca041f48df950658953a3784a1134d60b675c309ddd60a32b53f32e10b1ed9f88d8ae5f4407a7fdbf9a7579bb504a229fbecf7110d3c49c9e23170fe0f02bececd2dab89c18c7a7fbf5475e03c225d0b15078ad8ef11a46442b1b32fa62806b80596a0febbe8bf624f4480ffd2ea1fc93e8651c4d4cc817ce7cd05c075c1d8683edb5b47be5627b2aa04fc47262e4dfcfb2a9e1b408671c5816c4f0fb3aa4a27bd39a8cf2afdd1837897d9560dd21d68f6173bc20e84e2268e62d5dee3613bc10944e2b360385b6f46ea13ecd284af50e17c6d53526760668dea7ad2cd3adfe5b0e8da57133d740b3474b5d2681365442c1ae87bd78627630c4e16a734601b0d2a5ebac0903511ab318a67c1d527ea36882cc288d351645bfb405c0cb74e058442edf95b230ec94d13e331435fd58b119c9bee03502d5abcd7f6bf1b42fae3757ce400c7e9860882921af5d0c5509a96ff01a2136d16ccbc2020af3edf7bf331c9b6e84a3535c44e7f9fdf5373638d273eef66e6c0a2f678eb515756d7fc6b65353b511a11e7942d098564fb71d4b28976ccf2445814447b238155477f239a34bb0fb06612b6b5bf865335300299de891614d022555a1d973bbb62368109643b5bb637d1c441e7a90e7e92b4a66235d737bc5cd92554cb2a6d7ab3175044a46d3681138d5cc48c33e3dd8b0c519632a3ce7963c6a05e1f8b75364e7ac24d71e026bbc45fe4898898f89a702f21000da6e2ac985089c1e6008b73f06817c00791d4b0681754f71e88131bb5256860d5388b8c3024aca111ec814141591e552c1d02554e15342660b38fa1b134a3a8454c9871254dfbb62887d1ecad774e3e00649a1f4982a8736e62f657a551522ddba9a68dbfc62140687a8eb180eb724c5c1bb123e3a6603f7df01f42ec0c5a7a2566522d4d5e575ab0765f7a8374fd30a280b62156b3d1d29403cf99619169dc2eb03c46e89f78b71af7703a83db580851e420b6128c0a15bd6cdbbcba3421a1d3a3c1ad7b0c9d45bdcf77143e07757fca73b392041b304c07762e69c2d9459d40a097d59c5414ce890d9f33ec3fb79cbef0dd76498dc371e197224f8d5c4ddfb568f7617dd2e3c7b017facd7853905cc216ebc55ff889e4302cea9e60c3edc610e90d4204bb7fb45dab738eee835f4846852065e4436221ac46613713a96c84995838ebd0269b5b896d02a648e695beb66faa5231b6830c615a1239ad829f397589905da81dd30ccf6aa353645c9f58b11e97a0e8e3d5ea8d7c5dbff5e0c0fe5df8b79f2733d4bbfc55e7de5d2f073ef0a24a52f536e560dd4391554a48c597c7a2815934c3ca9e8fb4247fd8410c5d0ef86624901ed53d0599974f8ef63fe62f8fd3869dd22e018da8be321292318c0709df13c88cf33173c754dc0fb0db2808403fa5d75c2f74c72bf783b141fce0d2fbaf473baf0ac98e1061d563efd89625d404ae999fe7e1081c5285850e66b21a111e2f324114cb71be958c811fb6c634f9d3479f844d550e9ea69eb5b0079133476a20d0617f0ce84188ff9b401a92ec14fe832b84a281ac217cb0b2d6f6dd64bf14fc4ab5af24f4810772d669e6a265981c43a3bb78690deccd02a1c442a6ca4a3af975fc14f295e3865978cdbd74903cabc7c59584e6d70fbd9f191435ed1b604e05b55b59356f8bf6991301d74c8a881470a0f0ed0de7af2f3ecd9987c5fb62c1cadbdd373800850cc9d02a6fe806b58526ebb15e3db7944b173a00439b01e1b3b62dfe12abf2adebab3f6d0c57f259362c711fe7a3a7d341d7510ce07ea8bf629559a82fc47897c459151b1e2b900e4198e7b46625c1fe4ae5b1bcf72a7a468b163aa4b5a44de4d90cbaa7b03955dcbf9a3bcf87d29ae8d2d394f69e8139e78bd763cfd154cb3d086978fb4e4731cb1c0675e430091a8874753e52dcd882ca8b4711eef68318cf710a0dffb5ac455c2091cf2e7c5f3bee4f80c667c6a8b9505d7b3b2c9fa996f88a2dc58f8b528fd88d3eb5f4b1729d087274dcd71504f9b0a28f0b27b6312c3946d1488598cf45544b1e2c50b7e3a271323f7fa8c08dbc35db452724fd4e67fae8ddc06cd2fd4f8cbf69e7aeea06a3a3d87026708320079d566e09c09cecb9155440f8fbfea094b881dae902ba0e00d98c49da47abfdf93cab2c63577fc4e638298c2016a4a820291896592346be789c169d9a22782c24f633d2b6bcf16cbe584ed8dcf0a227ba4dcc29e868a5424d0c17eb9eeb33b74235ef87272e00fb99eec4e1846f1ea6c2788c63349244987fc3c1b9aa74db2142e11357b57faebe197b5ed86417e802ad867825e7f8d0ffa06b54f61873b1d0bd648b53d3e3faed1dd17ad09f7c2dfaa28d98fc008882ae473d973fdecd21bf99f9f95da0340099b326070db5f76a0219f834cd14aea86353a9e9f8a73f63fc8e595196d3db75ab65a9e308a8664b2526d8787f009f8e0b3a35fd8aa202129d4789863565fca07fea29fd513de4e4135db2651b048ea773fc77b46d542de81a01e2be363543372999f7739f4ab19436860dad4c1c506567741677f625a8dca00ae2f4f374905c47448566e6c8090a7ee2aa1c1e8314faa8000a7089d91f8ca4086d03fa27fb1498f038b75758ab422610796161a70ed2a8cedbc615ee65edc765240ee50b6357bc30441cd6d4c9a06b308479fa0c1ca46fbd63610f945b416248389db2c99c9d1de47a770e9ec8ad07ad7cfec7225bb694d5f0a50ec73dfe66e12e64fbccd1dd4deb50a60f3a2d14528bb6006e42d03d1b22289b456092cfeccca44045bc0b31c132c4b3f7f75ceba958afeb21c4503bb199b429a96f6e0f05768354b4aba0492403c463c3192d55a275d4c83b2a176e3e875d9eda2953e8dec4ff427143babfd4ac4248fdf3edfc2e6f4c01ea87ec26d99acc36f3480a3f506c6153d470199fcd615cf33762f8a52b2cca4bdca25e97ffea1df58c564b2a121c381826df2001b4be544b6885d7bf215c8a47edfde20915727c82919f04a93c63bca5c5b926d3b9e1f767e72b930d0ef07ebb67085222cf5946e1b6f84df6c461635630b7fd8863c80c3c3d003782fbb01561861b6fdfeb2afc6516fad280f03c9c0425f623564f839ad1297ee6e4c0de6e91988e106a5c10ad0a5183154e57349e0eb6edf08f57968000ff5c48947c7345ca273e8c0ad22c86bacc6aa92da90ee402be05be3d58821484c9269c69b1920f80553c2e4e91619a0441903aedef9c6f32686f2bb122648f6a53d1935501d7f8cd561feb1d127d963bf03d57e98b88c0e2d5c6fc988c837ed4df5993306529e4e05474fe24d9025fe6953a7595edb5b2ffb1d842dd8129e86e33713b5f88c482541cb48693fd2b72c1a0966ef1c0031bc07d30340ba30de51ccc43333b2f491008c1161e8e47d058ee8c8f073318f0e5712ff764996654bf2daac003ccd86e7e82da45b1a5886d3995155c8cdb8b69b31089813007cf24e153bec23cf890699efeab34c8cb252a49afc08e6cad4ae4ed539dfce5cd9aa12c83df1a24807edcae991ad292604cbbf890955b9eabddb510f794c3dcaaef4ca495599517b0da260dab2519bb53134828234b0624024adff60a4d261a7b3ae108a93e6fa58d79a59ddd7439ad46d34bffd5cbe6a07f22a6173e896151ad50d7318d324c2900423a73e1a72501ae3140ad27434e6898a7e97e988cf4bd22289e652200c38f170bc17dee29c9478165dec7c29786591a238807f397d7745a40407470b58d929c600d0506476a570ea66f43d864d78384a7919de578dbb5ebf0a4c38f5184343360e23cc1138d8e6484834a4c84f5eb15e81187a462fa466564ddb8a11bec1cad3815b1a10d6b8a457a4ca673f2c36c785c4c0f63b8d20782ac1c9230db539c7a9ec8a0545cf01eb527e183e37c2c11e9e2e232de51175bf52958f73590ccde9a5bf317971303a2c7d4ebb2bb8f2b1508ec772a33a148700bd6ad1a51a132ebe5e1b8718f995d90778ce7eb5a2d54befdc217b353ca65c805dd544bff32147a1df367713f7c166c24d9d692fef8dc7ad20f263c32e666625a3046c5764ee0b7192ab66ad3d5ba434e84c3a2a7b23bb17eb47af4e55d557a6ae5f4491b932adc5bf11c555e1383f587d8d67b64ad0c761d2421f0dacc4402e39124432332f808e9ae8c71f15977008eee4f8b59c9c61a21e813e2ee9a566b108d6cf17dbdc05473da6a65a459e88e4491d79f583789dedcb154d62ed241772e525f6872b726ff9bc26d55d17ad6604f52040b1ebfe387b46b8339cf4cc189850ae70f2da47ff8e95860650d2302bde36262ee0d911da86a030f03a018430b72ebb63e707dcc24a6728a76d6676a139536205ddbe00edf35cacf0c0e8b7e2b2b18b86bca7552d53dd971b1ce265dc514c0d5e4e15bd0c058d2045f050259c05b717e6beb93108c54f91cd1624ca1ba76a35969107d73e202f921c0b7faef367d308d6de11758c92a245157681f0b9b4db5e5ca150134aafe02095adfc06430455e0a64adb1d60db958980297ffcef234243f4c87729a90afd22c25fee6169a282d54728b1c59de26e365010cb7e2d7d1ef552e890417da77fbe15efc7bce43cf84054754e5ca263feab65a1e982a4f1d9d9638cc4a3aaaa62c5f52cead2fc251f316945ca3f416e796a7454d5ddb260e08543394228f95e0fbe004c7086a6821c11b0309f9adcae07fb4b0100ba3", 0x1000}, {&(0x7f000000b440)="91293134e94580f381ee2ea96fecc0b2c851382f7c897dfd6a2369feaa33530d9b9ce7f6863bb71f0c4f02e58252ee6db80a74ad396b1b4be99b7208a52095462339fb16a91878cb244f73aabcad9023beaa0b426858c4bb6ab159158b67c2651be79b36d5558b42d8a522cde71078a100e5fc297c519d667348d7f52c890a1cf0085c892ba91cdf95cae9fe6228237ae9b59b672ab4bb653d00fbb92a651eebd0fc24c7cdd892a0d74b5f61314cbdc63970c2b4e172cc94513f717f7155", 0xbe}], 0x6, &(0x7f000000b580)=[{0x38, 0x10e, 0x5, "639a0ee142e1ba6ac4522358339e51ab45adbeb1a17e6f5e22bd16fffb7995dfa3c9ebb37bfad2"}, {0xc0, 0x88, 0x7, "97aef9f860743b93d88a7c3556e3835282d1dce52604e158338507ed485368050abe3fc5bde6111bb630f401373a702b88303e3a1cc84067ef709417851a7305a365b5515bc59c9255a36e2b4e8ab3b614180c4b8594b6c73a508a0341fab6ddbe51e3b180998b1a229e2293c8793cd841b77f7bd0e65ced0b122efdf3a6cc8093fcd14d86e240cde9d524a2c5784b30b688fa8888dc9c6c167fa239b1f7168bb8d8cb7ce4fa320e4a2caddc26f4faeb"}], 0xf8}}, {{&(0x7f000000b680)=@in6={0xa, 0x4e22, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x9}, 0x80, &(0x7f000000bc80)=[{&(0x7f000000b700)="74d5ee30ffd6afb6b4270aad1bcb6e1540e3637290f556ce32208f682c045502f685599c38c1dfd5eb05130a8cb701e3f965fc854dc27b9adb08aa84d7082feefd51a95c002cf36632ff40b55a06b91874338f747bada2a06f721df34e1c02dab2673f170097c75bb25559198a05329ec79b4784984b519739936eb1ebcffcd06b741c4c22de6ec426d15565bf4a5c362323dc5f96573f9ad69e75b7c9a00cba430cf270a326ca7e04ab02b9c808a3a09c8db73177e70c94c41b17b7dde229c3323b4cf68c4ed282698958fb8f793805200e3d3881f1514bcf1ec183f246858f", 0xe0}, {&(0x7f000000b800)="24a1d23849fc8927f03d9b660ee8188d800a8652b10db093f4e8e8d21c39d5891b0d527b752002878c77ef47fc46e81ec5262c60bad3a530673646758bf5d5ad4d70f21e79491bd62acf56b91067348655556226fec1bc0137d15a909484d0b15be67e0e386014796c38b87bfb824e911bdb7181100c31693516b6ee04794fc3b6d716bb83e3502d", 0x88}, {&(0x7f000000b8c0)="3f5b0e50b8ea5cad5678fc30c5b83c471b3299403126286137041233655f0562d26c1bcbf87afcb98c68bd874590f997d5d96b7a065fb119291b7ffca2560ffc2614a88c5f5a75ade40944c19213d57f3997a1d3c7275c00174acee1e3581ecc53bddab755c0fc2fb388d3c54ef48de51da7306f98f1ee96095d9755b3784b2d970f928dc13f0260241bfb7d23b30a5f3989a2b091ca594b3dd12cdd97efe1f4fa", 0xa1}, {&(0x7f000000b980)="7b559ba14e4dc2a7e4c85a60c46c9f0c6069f6dcb45a425b81cdd44dc617c4a6cdc4d929cbeaf62d1509391983", 0x2d}, {&(0x7f000000b9c0)="2981404509bca91a6e14b462518d787d101cc6e3fd0fdbf062ec629799efd1717f90f28b28363717de840184cc2ee7ddc154ac2ee5eda473b85a8c0da336e167edf0ac3c83417e0f3b51703d2b159795c67ee9a3fc120dbcb83d673451d0bdc527f9a6f020bf67fe3c9f96b2b0490cfbee820c53b9988e9ceff17212d7d87be7a360f23c09975e9edb1c19081d00", 0x8e}, {&(0x7f000000ba80)="5f73ad9750dd3c92cf271b9cbe32f703789e6af3da59292b0d3fea1c41cb0cce2f482e30dffb0d0d7c1957e8da1b84fd6566ccdf28c7fd36ecbbadffd51659e108b265df01ed449574d20bb72d3d662307a36e24b8d61ba2", 0x58}, {&(0x7f000000bb00)="66e57bdc45e25b4728847904de731359dc12de4dcb6e971273c8741e1d53a4a0286b7f7b0e330792f6166d3d0e57fd877e8b6202991e6e42581e11637ddadcaa94dfd8f037a5bd5245fbdb677e15cb7610c104952a3147caa82e097a9d88b1451d0b6b67bc4352d33a45fd7f470cab00d2b0e548f1adfcf7dc5c268728f0f6e330d41f4fe1036a28002cf1d133525685b729", 0x92}, {&(0x7f000000bbc0)="c698c8d79de8bc24a793b26ee52934d2000d48b505c823561764343ab641640f81c1aab2a984439c9731fa87b8892a7200322bd2b1629fb924a514c388bbd16c8048714aafdc9e641d793f6b90677bdf72134ad523ea59110b6bf444a1a9de803e09cab0aee3d09cb34125c992e492261f3757f7f87e25102f595f39965414cd347864a5c0d92c7d29a0aa696f9f9f8dcdcfbb2d6e4597d228b2dd29ca1c1046677e446423f4042cf04bf88898b9de5834c0", 0xb2}], 0x8, &(0x7f000000bd00)=[{0x48, 0x113, 0x5, "5a2d8272ad88565c345263918ed568d159045b12b49f5b1f84d7a234ac0b9994e8fd885c8fe35f6c94fc6efd8d4b2ef664b890fa06b74d89"}, {0xe8, 0x84, 0x1, "8f935f3843d05535d722b49f065a245ef47eb67c10a116b0b437e94f4d17257f3c918a33150375c6559049d14c07e2f824bdbdc0663d8104cc82ca457eb12319f052ea3aaf9e3f50d7555ed083aa5479d3020ad94bcc90d62f5018e7780bdbd1af1ce134c1c5752a1389f5778a013ef4eca01b8eea75a0c4cfdde4fb89e80bc58a2b325021a9324f1976a104a323431662a844a0cde6a99681898585f39c05f399aee4f46c7c838dd5b2b34024fd19f9cd5d4651688978fffb0225c5fedde6fca3e5766636676a6d6aa186910f311bb575aaf6"}, {0x28, 0x10a, 0x40, "cedb28bd79722877cba02b87a8c7f0907f73fd216ec3"}, {0x110, 0x117, 0x1, "e918181acb634f351c6eabf27d439d26d58e3aa0c2e520ace7e4b834318c6c299cacbff6ae2ac7f5d24254b7095a775376d688b35c1020c727402f1a3db4dff0011ae4478e2d77e7fd57e99460b58e42f17edb0be3f195d68e7ff7a03671ed41ab9ff2956f7323899e35411b4b0ce9196422a95718dcd95f4e3f37db9a83ff9e9e49a0d2870dd1be57966d25fce93df05ddc95f0dbced864ddfe5dd610a48b87ad57203f310422d6ed19ed00d30f183e6ed1cf4e7d87ef821a545c1ea53c22c37d0b2922043dba25c4940a5825fd1d549addf48b4696c3cda438dba6dd6593191a6ad0530a5f71f316ae430cb0000fac443d20c090a12506a195"}, {0x18, 0x115, 0x0, 'M'}, {0xe8, 0x11, 0x7, "918a04dd0f46a39ef04c505be34caac50fd35ee597d51549b23abc4c8a8e35e77fde3b08de7b85ccfca2dedbe89f07e3d4e35a36f448587e1d54726e267ff545d9f7b8686dbb1ab606baff9c8774334521a129c2ab6119c8b88a2d8551c594666bf727af94ab20285b73ed825840cb487aa49837adccde3169a91f8c3ebe93a8bd5b5eb0dd538bda54889d151f4915d98fda978c342f2ca52dc2ad82072b89788d9186a3edcf083372eed492f9dba4be3420a29394c3a89b787892de5e5c9929c3df0cf69fc2c90c9809bf1ef263ea874887ebff9ebe"}], 0x368}}, {{0x0, 0x0, &(0x7f000000c280)=[{&(0x7f000000c080)="ffe9f3c73b5ebb38b6fda0e0fa799ba2e012a49abd9139a99c441d77d7bae1b9ba56c6dda37b460bf17a4d5a11aed28420b4a29fbb07f03b4579b30d3f76de608cff01207005faeb1b681dc18856a7df80ca7f4cb65a06f98151a3fd979cce6584b090976348e07ba4b8d9dc6ca744c0353b52f02ef20fd333d10a4fd27565f21acb115a1ab0dcc9849182c5b09c4262b7dd31be0317b71e5dbe7315fb9dc8a48cb3b81ebf512c4b94bdeda559aad83acaf39d83a9d83fa63e0bca72d7ab723275d5d857cb0db6a37025c40233acb94db87818cb232c841b1361f3", 0xdb}, {&(0x7f000000c180)="2ff0dd05c5be2357cafaab719d07eab8af6d78e15c37c70d7fde7dac9488642e77e51adba0dbe4251cdbda6c96fa8d38cb7feba3747b74937ffa69ba1f77ce14679b75ef2ae3088f6087272433a0912b16005ef6798a5bafa569102e34721ea6b92ba91dd2f63998fb7b81dc3d80b17752843df1921b3adbd54ef57ad911d73699b49080d92c90f47ac7892376aa9e2d580a3393f6c58c06b0e1c903c763e9f1e913663112e37a33", 0xa8}, {&(0x7f000000c240)="d66ffb9b23d0493ec591212e7896749e99da35006ce9ccf1ed", 0x19}], 0x3, &(0x7f000000c2c0)=[{0xa8, 0x107, 0x8, "968d011a872094ed3c0afacc19ffb9c039777a6240ad6159c1d12cd748f9a7a91afaf9f4d0610589ee7d8c61320b134ddf84c24bdc19c733894e05bf2a8831a84e3f62bb8f77c78aa206b00944ee2c0c891a9326bd5d310986e9110143962f30b52fb67cb1500b0611c3bc3abbd3ab751b010dfb366cca72ee9265a3a660771aae5f03ab23f54acfc0ab18230a755df71f3c69"}, {0xe0, 0x3, 0x5, "79f5138c4b965bd48b73d979c7341b97bec99d170ba79a4e6480e71260fa719a41d212a25c165dd812bb750ac809d1cdeb6b6e1598cce4af727a835d4840e502262864b1dcbc5b628ba84c699771397c0aa339a2e73de0230b853efd61d42bfad6e1952cd86dcaa8b23f8d4e3b0cb068698a35747e6ca8944691ca63c5b90335aad5be54f3874f9f1acec4eae8440be29c7a693ad73a4985eccd64b73beac60d918f072334b42ffcb189440ee1ca8f33f2d3cdfc68fc7b5e958333b96c0787813d6c202276d00945707688734cc4"}, {0xc8, 0x112, 0x7, "cda6cf66e7d6aa64c7918357b92fe749e94524f0c0619ffbf2c3e0872f708a4099007206d0121ab0bbda3ff4e1ac2e61f8ef7d476b0d29e8f20e4f69f11723271e50c43b3e482b797a804609d984cc4ae63c22d190887c7fcbe71f289aff0a65e7e7f0f1d54d9526c4fec04eda5b1fddfc77592bb6ce3399255ddcea719dca70856ac2c55ee77f5164907191579ab70186c35f2f9fd1b39a9b52f4804df02b9c39a94e4bed6744b717db082856da31ae40495deecdbd"}, {0x38, 0x117, 0x9, "bc10031d63a9005e657ea94bd277c82718af9b1171bf29c8ca89fdcf1b41099533"}, {0x98, 0x1, 0x618c6898, "760ece25ac654d95a7a3819bc12b48038a0aabde7d570d0a80651dc52cb47c3c8c46456d5909ee87b4a8b5bd8fe1d4c30e0646762d77aa72a13f89f3103d5f2607f2ea0b791794cf556b8e85b40fe3b9299864baf036fd73cc8f52866917511acf4b139b93fcea604f83f0dd3e2916ee33f12a68fc0c5d035a457775b3cdb57d2f"}, {0x108, 0xff, 0x0, "08a8d515f188c3f0868a59a6739f241005085c930d9c756a5fac4bff3876f16c02f2db8a13281f758d78e36f10a61afd511adb960b4f411b2f9ddabe3a7423490d59005a12f22619493048f7586d3226122aff4a5a5ef840fe86b5869d62e07e76cc4daabd458809db1a71695619c4097f83ab93caa7ff9afebe143a0041429365bcac563462c1adfb0467646b8e6ae0cc0de47df3448219c6dcf9d8e51c59aff3c20dcb94697a228905a011f8b797881e14c696dc02af72a9d63ff6d5f8f5fa98bf9d92271460db825d0546dddfda49f44e124b40e23278f5f737086012b9c343e807e8761a7a836aa64e28e00747976d"}, {0x68, 0x104, 0x1, "f61e25ffa52358f516307087f11b98fcf8cab90a4d9d360ace056fd02efeb0734bb5c208152829307be4d2d8b4b28b25c6807f80cbf0cf3cc1c636f9b0fe09f8af562fceb5fd5c80c27dfb401669c4c39ebdfac3fea52c36"}, {0x68, 0x108, 0x2, "3457a3c4dc9a84b51d2356287ed819170ff438182dced46d1c7527db8eb40dbb4a9a11f9aa20e53d19f2ed0242752c150969996e966beda091508e6a4a106b00216618d5742fa18df762e6c2c73a5e578e672b27"}, {0xe0, 0x102, 0x2, "6a9af586b3ca28a9fa170a58d940520d1e73af5a7dfb1935ab614dc0c5291805a8c779a00691f8d81cf61e5f8985ff789c26263f6d3f7f754e2ee3738371f25bf7de9e96286b3020661ef04393d3d14e977f11353c054a5fe7013be99f85ebed6887506d1a31575fa233bf5f062c717d029e3b2c206643f97c8f7f66d49f13dba9b75dbdaae1df022dec2e32060d02643d26cce39c6a7a8c7e439e05be63a7b43db428eccba77a422885955ca56741233d0d78455dac216fa8202b888302737d1090087bf62af3b8e1fd8d9203a0"}], 0x5d8}}, {{&(0x7f000000c8c0)=@ll={0x11, 0x2, r5, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x80, &(0x7f000000cb80)=[{&(0x7f000000c940)="81936efb316afe741c1747d65a8b8d4e26b178477ac1ce1a76fedd5611568b833039fda68f2a51f2ec8fa9a7838fefcc78ebb9a36ba515ae19219afb797227b6961d02a3e03d280ff8b7f05b83ada6638690fe87474873dd6d8597703934db84bd8e7091a8795ef432fe37408a46b91b397daba7e1e54fdcd1172ade6c6adc2a90c9abe0a974c3e5de5c540db26ec13abdc84fcd", 0x94}, {&(0x7f000000ca00)="a89ea3e52a20498181abef699ac05984c117675f9235bcfa2fededdec2f544d1acbf56e602580824518bceca787b5df59723fbe8b21ae3c4f550841e20304d4c885552e050ead5e8d4e4a9625c", 0x4d}, {&(0x7f000000ca80)="2f5fce46e5861f462ef6817ac2ff8130c29c7d5eff9d7b99a0c5fc745362c8a634b68b28fcbf78b7d366e2c5988861bb1c1e0cf9319feae2cf8e32a2b56901ff1fc414ad910ef4bc1e7c17b5828cbe7d69e798cb65291e5e447f1a5c02d0551d354cda5f14b18ff6494fa2dc179c36b06272e4fe72b47fc6fb24483702824c6bf5a929b1ccc855ff2aeb29b80772c0fb351d2d8f616a267c834f1b72cbdc36fc6092222367a5299760a941ff3926210a1c37261e86dee4b19d45156319ef40727dd672426da8a46bed3661d3d086a15972927d4a67e3337fc9195b05028ecdc832d107f8212f45942a52d33620cc993d222c6b1656d4dbcb", 0xf8}], 0x3, &(0x7f000000cbc0)=[{0x70, 0x104, 0xffffff01, "8efb510336a3e14e15a064b75e8ed35ea568305d4c47c9a9882928d017e68dcba1047900c552df7e21893a1c0b03fa26c2c5b9612a3e73de8d3aa1cd6820fde9f3a921bc7ecb6bd9710f0073c687c0f7d288a67fe32aaf909ebf"}], 0x70}}, {{&(0x7f000000cc40)=@rc={0x1f, @none, 0x81}, 0x80, &(0x7f000000ce80)=[{&(0x7f000000ccc0)="a0edf68a0e2478ddbd9d0e829baacd7ababa58fe41cdedad9d8fb1c45067e1f3867fc32254d93063e8d04832c3b2e7c4c7d412f159f2f46f08bfde70f1e416822c1d9cdacde02e7eace5df774e3003d42781a2338547382e439cab62631ee0036de37ca18429287ca7f27c4ae4958b70c9bed5ad9c4eb947c503e6e8deaa9a4afbe6658b0c7024f3feb4e095907e1b7f8178c9c495168931015b3dd639fdd4bda3c785c28de3067d64ecc39027a3657dfff7ed", 0xb3}, {&(0x7f000000cd80)="4c9346", 0x3}, {&(0x7f000000cdc0)="197669de0f2b28200adf566fcff27b224877a21c72ed36efc7ef7747e4da91778afb34e01bf2b83e08d2ce9c0c7e7c20c39a393f55e5fae6ceeeee5302687e645a722c1b1d1ff394f5621181e6c6f31e46d9f801db9dad6e42e28b5ba35526703db8c8d974ec5a43e0105b1f4f53f8b3c3702cf6a1188eb7df735647196b5d06af2d9a80902dfe31509e720ecc0a8f338e", 0x91}], 0x3, &(0x7f000000cec0)=[{0x28, 0x114, 0x1000, "28b1a3e8d2993521fa816c8065461ef8ce58c709b53a"}, {0x58, 0x105, 0xfffffffb, "1ab3b9002b29fb29209ed4ba90df1ce43f3cbd6d638b8f236c1a66f337da01a0adb6419e0757ae76335c9e951b4b7e49b7d44700106f292d7a1a6751357264ea9a35e3c767da"}, {0x70, 0x117, 0x4, "4b4771d7305b6eb435312aa6f0be155f6ba30d33c8c112bb31a205eb12c7e6ada4bad14594fe1a9996ce20a042215e6fd93a9df7b374cd4474571fb14fb0480ee39b55ec3505805f96668b82ac18d39c6763331de7a0a89504"}, {0xf0, 0x10a, 0x100, "0c582cd3ba7ddccd1e648d347f2c69679f4eafb1fbfdc7fd950c974eedbad6a989c07ed511e59f22aa347604dad2ded7ccdd5149f4ed6f69461ec0f52c5da32b9777eee82e0a10170a6f5faf4c4e89785c00abd112fd237ce028f02edf7a8e121c83ee1e8fa6949801d101fbc169da0a3d586f51ebc74bd3af2932a381ddc2403bddf6ae62a03b407eae9c29ba412a7cb2f35256f6c159ce7f57fa760affa19c15776f539ae2ab7f3160caf49643573dbc67dfd9282fde87854f937aea2586fd8c57294563a46028e900e482625d98ca568cfd9f14320c64d34902d556"}, {0x88, 0x6, 0x1000, "c1ab811555105fb606367dfdce614a3e84d52154d768970c4c8c204e451f9683ab0e5c5f1b142afb70c6fb59eee2fec674d411634d6e3d9e05fe664561f07fc3690ad9c93e7f228f57f8ab9340f10e6e05b66f8b460ec0dca4984395d984d689cfa04afd6e78884a077e5e09cbcedf8ba5ed6617303b73"}, {0x58, 0x116, 0x9246, "6c21612c5bb123cc8ff933eca3aaaa370e6f9f23468bcde9d8dbd68b5477f862355f632fc7e65a384c0764326f7bd64e54a267a82b6fbe0bc671ad2f0a2acb973f970d27"}], 0x2c0}}], 0x7, 0x80) clock_gettime(0x0, &(0x7f0000006440)={0x0, 0x0}) recvmmsg(r2, &(0x7f0000006200)=[{{&(0x7f0000000040)=@pppoe={0x18, 0x0, {0x0, @remote}}, 0x80, &(0x7f00000002c0)=[{&(0x7f00000000c0)=""/61, 0x3d}, {&(0x7f0000000100)=""/231, 0xe7}, {&(0x7f0000000200)=""/182, 0xb6}], 0x3, &(0x7f0000000800)=""/4096, 0x1000}}, {{&(0x7f0000000300)=@qipcrtr, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000380)=""/238, 0xee}, {&(0x7f0000000480)=""/79, 0x4f}, {&(0x7f0000000500)=""/163, 0xa3}, {&(0x7f00000005c0)=""/221, 0xdd}], 0x4, &(0x7f0000000700)=""/41, 0x29}, 0x80000}, {{&(0x7f0000000740)=@in6={0xa, 0x0, 0x0, @empty}, 0x80, &(0x7f0000002800)=[{&(0x7f0000001800)=""/4096, 0x1000}], 0x1, &(0x7f0000002840)}, 0x8}, {{&(0x7f0000002880)=@nfc_llcp, 0x80, &(0x7f0000002e40)=[{&(0x7f0000002900)=""/241, 0xf1}, {&(0x7f0000002a00)=""/180, 0xb4}, {&(0x7f0000002ac0)=""/21, 0x15}, {&(0x7f0000002b00)=""/176, 0xb0}, {&(0x7f0000002bc0)=""/116, 0x74}, {&(0x7f0000002c40)=""/255, 0xff}, {&(0x7f0000002d40)=""/234, 0xea}], 0x7, &(0x7f0000002ec0)=""/122, 0x7a}, 0x6d}, {{&(0x7f0000002f40)=@nfc_llcp, 0x80, &(0x7f0000003080)=[{&(0x7f0000002fc0)=""/179, 0xb3}], 0x1, &(0x7f00000030c0)=""/215, 0xd7}, 0x9}, {{&(0x7f00000031c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004700)=[{&(0x7f0000003240)=""/35, 0x23}, {&(0x7f0000003280)=""/133, 0x85}, {&(0x7f0000003340)=""/164, 0xa4}, {&(0x7f0000003400)=""/4096, 0x1000}, {&(0x7f0000004400)=""/144, 0x90}, {&(0x7f00000044c0)=""/121, 0x79}, {&(0x7f0000004540)=""/161, 0xa1}, {&(0x7f0000004600)=""/242, 0xf2}], 0x8, &(0x7f0000004780)=""/60, 0x3c}, 0x18109f41}, {{&(0x7f00000047c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, &(0x7f0000004880)=[{&(0x7f0000004840)=""/12, 0xc}], 0x1}, 0xcf}, {{0x0, 0x0, &(0x7f0000005b80)=[{&(0x7f00000048c0)=""/238, 0xee}, {&(0x7f00000049c0)=""/4096, 0x1000}, {&(0x7f00000059c0)=""/64, 0x40}, {&(0x7f0000005a00)=""/55, 0x37}, {&(0x7f0000005a40)=""/20, 0x14}, {&(0x7f0000005a80)=""/13, 0xd}, {&(0x7f0000005ac0)=""/171, 0xab}], 0x7, &(0x7f0000005c00)=""/137, 0x89}, 0xff}, {{&(0x7f0000005cc0)=@phonet, 0x80, &(0x7f0000006140)=[{&(0x7f0000005d40)=""/142, 0x8e}, {&(0x7f0000005e00)=""/161, 0xa1}, {&(0x7f0000005ec0)=""/73, 0x49}, {&(0x7f0000005f40)=""/202, 0xca}, {&(0x7f0000006040)=""/219, 0xdb}], 0x5, &(0x7f00000061c0)=""/52, 0x34}}], 0x9, 0x20, &(0x7f0000006480)={r7, r8+60000000}) ioctl$sock_bt_hci(r9, 0x800448d4, &(0x7f00000064c0)="4ae41374d122aa7340bb615f4ce09cad4c1ccf293db3a6fc11bffacc7ad85fb8b7076a8a7b3f03e686bea6085fe3d4bb877d75fc7f85dcc08e64d4a3355336596869bfbae5607661f7d27bf9b24066fc4babb3fd560637edc3b55ebc9208f4e1d4a5f1fc84f7c8f1f9c060ccdaf6fece4be8") 11:59:41 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x10, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 11:59:41 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xfffffff5, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) [ 2091.302901] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2091.306742] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2091.311616] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2091.316430] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2091.319646] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2093.338095] Bluetooth: hci0: command tx timeout [ 2095.386078] Bluetooth: hci0: command tx timeout [ 2097.434044] Bluetooth: hci0: command tx timeout [ 2099.483108] Bluetooth: hci0: command tx timeout [ 2108.572275] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2108.573405] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2108.646573] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2108.648089] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 12:00:11 executing program 2: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000240)) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x204000, 0x0) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0xc8) setsockopt$inet_group_source_req(r3, 0x0, 0x2c, &(0x7f0000000100)={0x4, {{0x2, 0x4e21, @private=0xa010101}}, {{0x2, 0x4e24, @private=0xa010102}}}, 0x108) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r2, 0x400c6615, &(0x7f0000000080)={0x0, @adiantum, 0x0, @desc2}) 12:00:11 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x8, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:00:11 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x40000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:00:11 executing program 7: r0 = syz_io_uring_setup(0x282, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, 0x2f9}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400), 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) sendfile(r3, r0, &(0x7f0000000180)=0x9, 0xd58) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(0xffffffffffffffff, 0x80045301, &(0x7f00000000c0)) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x40806685, &(0x7f0000000300)={0x1, 0x0, 0x1000, 0x1000, &(0x7f0000000400)="29637f3fe8cda297198bd9904ce3832629357bf05c214e52004e937bb1a89eeb339c1e4f3162aadd50eeffdea9dade230fc0a9ed39244136a8b0e3d30470aeb6685f23473ff0618970ce10d651b7bb2a9f44d627b89ee3145ec91b226f0863a9d0f95698eea88b71cfcb0e84c1899f5849dcc150ecc4b2509423c0ed01d8d5acc63aeae7cbd5c7459f013755db647b727278695bd0d6103138ab25a22f79911e198b9173363d6980640e38046d66b9fe538a3a2960a9307c1d3357826ae6a62e0c3508e7d396edd4ac5ce12a73940dbac51b132dd28bd80bb44e3052f7fd054ee337e35e8b86e9643c3fe131c1e1b65fc302ae02dc55c95b4ed20d76f7f39e65c31c55d9f889301a0295fe83dbd06a5d0126d1704927b48393c245a65c04e75c486e3c7538f278d0507aff0522a94d9cd440ef6d993bfc228773fad02dfbf535811397721448e80344de6fea334c58c46ee4b179a93743e091c27f222896118506148b9144b01d2875d647bb0253b545059dc2b1db68721f14c3f3dd403ab1b605858fde2a1f2505648d91fd91755c4ec672de374b8a774aea1e7c36e5bb49c07bbf52f39a58ff3b92984e4a47907697f52bf46b728c8826880512283b15b4f5cf99645762eae5f17a99d8cebbed94618c6221f342e909814183e8710d08461a6d0562e96f6b5f74ceceb2c150801769a7d47052744ceae4503f7b6b262aef50da8d96457343188dd9ba8dcf612443f78707c6f903f8f961bb6599e11b0964d9098148d172cb02d598dd4b4e42d9bda06431efb0bc2c011512fe8bf4fa5fbbbfd29b18d7afa177dd9661a8ce2b15b8d291cb7a7931636e9706f45b7a95b7268228ed2499464bcf5c6b6b53cc05acbd3bba8104e8b293031d770952f964a13ee9e124edf4138646c20e14a19db81f5ec077af72c8026c55ceb64760966e3f2cc4ade9b91e27ac13e818fbf5ceeda0e6e80452e60b927d6d5d05adbabe53ab3a47904cc3e214fdfe58f2978ad4b1da6dfdd191ea511b153a79143a86d9a6909a5a9c764aecc9092fa88378d8c4d6897ab892d76032c07f9c9720f470e13ae19f31f53847a690decc4ff28844e8d1df2843da15b7f7eea3c035c0313df8b60752502d90ee9a8ff1cca5be9d900d7528c429f41dae1a5c4bd7b624c930434b4828a1d8478f7b36a6913e54f3304dd6b0be7fc1809df52d78fcc6b0a4d79fc2ca7b7cefe6a47302627d712d0478374a001428a8f95d6dc0fbcf621fb111afd0ed0905a9f7f73ddb2b635398760e74a2b13e132ad192872f10a9cd3609e4ce99ad54e0d30e228610eb6f99ac263293e2c6049aa95e6363556a8ca5ab981d1d64ff26edfd90e32bbbafa6e2334d69bd1209f140e453fd9f4a861d121be575ca0e62917382616f1570401a9e07a537184f03df60cd7bad9577415319c700afbe7f1f49f678e5cbfa8abfbb2f2f6e3eb871b179945ceaa4b9331805555505b07ffe86d5f8dc3f6c19e1d3953acf98fff8e54a69deb24f83318399720e29a60e9d16bc42312e57071d86bcbfa685d68a80c463b2cf76489a04c7208ae17dd05f5677c601980d58c510394505d5813e7439c305c10283b6dfa86bfbc339d6c7e69340afd91eaaf1cad039c2d068406bff54898e8e6d3799a7b46adc417552246b08d45d7110af43a94128a7ed402eded710e4517fe5ab4e8853e97e82758e07a0c84a09482c88cdf7aaae25c7f810ff6422c9213ae06e027996bebecd1deb8546cd5e50f2d364d247112590482c27bc832de96d230822f4297281c60ed0e6673ba6577bc78d4a8799d5418b296c14bcce9c5e66084e485ff05e78f81dc1dce92d9163acf80ae01fccb8b73170f7ece0d9615a6b83a689c791882e1c4da9755672a6897fa50654fc3c4c3bb242f686016ae5269074d4098f89c79d2353df9af5b8c5626394a807bdef2ae294707d69c1b93036a009dbadc44fb4b4f97bc506be362b411556ef9272506f9938a181d767d45bbb05d9ce3b580c271b1179f53171ae4b9cb12f67b5c714dd5afb1b9669827142b992dd33904c38d6ba256e9de4067e9ada5fce6ecc50c18bb567efb07a063febc85f31f126e63bb8a57e88e7a922af3510d227e4d7663f55c222126594f9fae87f9c641ca4f7597621ce5e7e350c8b1cdb3e4df717447b3a5df05fbbf719fa1e6c5c1670ecaeeaef40cd30d50531da329c855305df2c8bab0d1eda510e46a73f9a54ecdd5ddebf173ed5448bdd62aae8c4ecde0608f9dc02c849bb544fad6ec1a969e073810292b38d8ecc0af636bfea047087edbad58914875952834ed9ae2a76dbf7f192ab772343e7eac5821a41b7b70b99e61b1ade318849344a5e06b71c75abf3093e16a3d3090c46ca28e605ea18fd360725427693e3dbb7feccbcf172ae4e81a5af50cbdcfee4dc9866c8d8e908ba2bea8c565d711cc0faefdb594042a09c625124acf92d8779a1c6776199809aa27ddbe3f0b7757b76e6c852a97639c39f405e7d7f1aaa320397648a0002cf46f0ac14604d39821d0e0e8c5d0d1c706e5a24f9469f9865b9e066eec397e24527b5899f3ee458991508c640d56a54a354d665c20758c34a6adb3bc6d7551405908d2751afa4efe4a887016b48608f9456e8f401fb326b5dc8d71aa2bc8b53c63d71f72afa1bd8d33eb7fbe0c7c5d21e510dbed04caa33010ca51a2f6d7c6a12d66fe6d8115f632e54b3dfd7a55c7b9c233bb223adaca20d4dd5f3a9a0d0ac419c1bb148067a63de864b02cdcc93cb2c7b8cd24097af0a13b737bb51f4848254d642f688639f7aae716e62465a20f90f8a1296d9afdb0a126b978601ae12848157f68bf5c3741c926529fa782e4cbd55857371b934ef18d386f56b183901f413eaf306f525925c75a54d9900e7fb42bb6123233d619824f3a78bacf393dca7f7d03cc9f14a082a4ecda991e1f50282aba458a7af85799dfe179def6f6384a064757cba3d2847ae856c7c41d0c0d13d93a1f5aacc48091b10b306063778d47d6bd3a3df0b46766cc94e289311bbb6a9c02253e1e3d9e40b18a16f8d0111a1f86ea3a4129efcd7564120e7f6297614bc0566c24c43b6d076a204993fbc39504540880241ba1c8aaf6b56082a42560e9256aa7d8e334b982ef16d5256f9038c7dd09c037a8c1520c3926c09ba0a2ba3aef930ce338934dac2bd955b34e4609cd8b01a23f9b1f38d0d925ca0e2e407652ffa2c4bffca0c6748259eacf4225f3337d553bc7b97fcaa83fbaf3df337d42b73a2626c98b645f16f5b5982e600c9c0e44b768d0eaf94be0a40b3a27b884dd31e4793328dee9e4335b2c76e7008428f821d4d21348aa03dee1875fe654219d9bd6304b5da38bd43f1e08804e1cbd0c3a183844e090a19818b381fc29263449445ebc5f89d26abdfdb26aab41656a89efcd075abf220c7317d202067af626b65444c4509671af6c021c11c5baecd7e8a194d938e14fbe7a6b41e290505881dc9e59b297d043dec88e7774270aae7cdaad4cfc7a1a8884e236b6ca969331dbed6abcedd5bd3c6374922d0378739278695b5856816a645e8980917717433d941dc38fcebcc46a75e969a5a684f4a83b5b4a6cc16de9405457045cf71a179c1b62a5fb26125fc134606be3a326a8fe8bc577f4ae559f5fc55c09fe0c9bbc94021c2cf6e5d0c67be8b9ed176d839a4299bd254763e1f285163bad59bdbc2e79e55ffe40791bfdb687ab810750de0169f430deda8560aab00cb19b8972d2205c8c6137e03a7a88c6aa33d7533c4cbb6253fec8c15278fe9e72ed62ea9cf3c960c582b49a0291d5a7899643095bd10d712e60ccabac900478f61a5458e3e5d2c6e9fbc1ebb433d5a5d0502b668252f3c7d5c9a34b93f09884bb4595236a0d582669e776af723a985816d593b0ddb376a44bfb6444f73f0f9d09e8e8a42b82db1af3b439b1c48b4595d155f3b0db0b0316c2a861dc1fe2d8763310d01f1639392a192470b5149a411df9d7361b322c79b7d4d33fbfcb5dcb212330a982a43ec74ba8b6a50af1819e229d6177e353cfea02adcf972e99256be5b4b99312e17bb1eac8fcacc81c23dea34b8ace07448cfe546d18cd437c30d56d713fdb3bfb20118ebcbb7af4f14efc1f1f13a75121a1322ce88ab5ef590b6572029ad7e29d6405303f95e342048b57e872b6488f6173f45d89bdb4997c25ea7fab6887da5932352f0eca46fce70a33904d35385ce921f28fd314040a20a4d4774df913bd52ab7938112a185fab1dd2f332a907ffdeab72c2b049a47e0a216c94db3eb7a5c748b99d6aa03038a59da0af090c04fa69e66fb303a55912eaa5cb04103ca7e6413b6394e360f22463e036a74ec198543620e7a604b6717d2f3f12d5f0209e00b1c55e55953f902d95889a2ea5b56dbd0b27d14fb5041efb8c5be5ecac2e02eefaa70d7e20715f65eb6d9fe1df1e6f4997d613ed3613697e26056432fa5fe7c5116c1909b71313e365dc0209dded137e62a42ead4424b0195a809eb16b2901b3ecee4544390571abb01f874e3bffb2456637a6aefd54ed4723f7007e14201ff63b8ffde9ad880e3db569dc721b3c6fd8b86aac395fdd94cc6d91ca3041e8bebb3f097e8ee10b043e74a96b8ebb154c400a1e1ddd36d9eb7ad8a9bc45d0959394f3980c385574e3a71fdfd8f63b2e380386c4b9e80e274becc8aa06a6c95d64e8d03cbd49bec5810d46c05b9b544ba32a393503495e86ac9624fc74e1ecd3f4f2519e47518d7b55e3b7c78739bb93e16bb42879aa410984976c951594178e59993fe632c4f3fec5d376d1f1c7329fdeddfa0dbdc026924d7f48b3e3c2f2bf2d7572d1002d01b6c87e0877135e1a306b19f19b13fdecf6d2ef41210d254a776fc7bd39ffc763f93fb19ae8a33c22e30c6583d6e0e313d0341ac12c053c07cf0293b128126f9baa2cf96b02aa5bf8e227547339e46b026acb7a7e9ad75da1e6786b08d9f968e4cad2961b69a0d953f939d06c71266709a6ea5d49ea2b7e2982f7e9b41f5e4d731a1beff630823f0c1924f508f7e595e60a0e5fccfa4f845eb2f89145bbf3c8b2552432f70c4a53dc01ba4e1ad2bc806db2cfa1a21b47998467f905d5b27d146376e657a3f7efb79ae4c3c3adc450f7ab21f95005245c52686349b8b47dc5d44a81422a250d341ea01c88b37f9f99366a4d01b08941d60203da7620196d92a13128b6b16f7f6b22948b0363966a7704d37333f7bd2b5d138ea8312cdf4fe0b92d8d146867db5fa2daa8347aef8e79b4db72f4bc0d80d55f6a25c1f70c8155115463362f88610dd45a6708aa79c5055873051852fedf3594abd0b748c09c339b8e265e31567094a53ac554db0f37773d9d94d43d16ba2b1bf265ad26bea1b56f7c8b42aa7cc128676ddbc86e115abe4ba250614fe706aea65f1c1f608506d1931de447c3c9a97c6ab0ce9bb0fbf1e54396571191d4b14c8c4c8abce9478951ad8b61f1445b1d99f2bed0b80313e39fa3fe5ef1bef1504dc05d2e79c76bb9fca67c8ed9192fde2a9770a076c08d7e55d40b966e1ad43bb3fd7c050568f02ce9480beb5a4870d4dd3a4da704bf551ca6f137edbedbadd46147f6898d6501edbc04803956fbbf345518b77013e55548fa31b2a21470fd8d7f67313441645122437da391467b8e0f4807ff4903cc04ca517ba3a1e28ed36c34008387ec8b7b89f2171f4b7310da123d4fd516faa8d3d48a208251059f625395ef1caa8d02150efeeb36cd467f15b9e65dff0ecb20fdaf84d93fa0a613c6720d303", 0xf8, 0x0, &(0x7f0000000200)="99633ca59e5df59cc428152a7888670829a6961e3fde96eb65e90f71e412929a48ae55ada1e78ed3cfb859a9075766b196a7df05b5475cf3b3e869bb385b6ba6c12723102be0a4ee7ff739f49d9721382bf514fe2b07aee96037f62794a7931bc7c713718292fc965171e8f9fff2643103bacbd470acb9d0c63c87e61a246bcda61d2311a781e3562d39d8bfc3cca5d2b2962e5572689996c101b96cd7bf138d8632b2d34b304dc398e21ac2f83b9e7b0f3ea58bdcab541dfcd64015be275692d39976b82945a53420e3e8ec89b96fb82e5e29ed58a4333204c2725bbf80643c9f8c48db7ada6b97d7ab206709751157c908eb3da5e3b795"}) ioctl$BLKDISCARD(r2, 0x1277, &(0x7f0000000080)=0x5) ioctl$F2FS_IOC_DEFRAGMENT(r0, 0xc010f508, &(0x7f00000001c0)={0x4, 0x9d0}) close(r0) 12:00:11 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x300, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:00:11 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xfffffffb, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:00:11 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, 0xffffffffffffffff, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:00:11 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x4}}}, 0xb) 12:00:11 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x5}}}, 0xb) 12:00:11 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) r3 = openat(r2, &(0x7f0000000380)='./file0\x00', 0x632000, 0x40) close(r3) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000340)=[{&(0x7f0000000180)=""/164, 0xa4}, {&(0x7f0000000080)=""/82, 0x52}, {&(0x7f0000000240)=""/98, 0x62}, {&(0x7f00000002c0)=""/96, 0x60}], 0x4) 12:00:11 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x40000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:00:12 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x6}}}, 0xb) 12:00:12 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x80000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:00:12 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x500, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:00:12 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_bt_hci(r0, 0x800448f0, &(0x7f0000000040)="300286931dd3abef9c6a08668cbfd856b229787616c19f89c79689dcdfa7e3796870c5c3336cc54346e2cbf03b6c818be43885bf8e1b608d0210c418ca2c53c3a4837df78bff9754546ea726dd8b4eed565d5e7086") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000000c0)={{{@in=@local, @in6=@initdev}}, {{@in=@broadcast}, 0x0, @in6}}, &(0x7f00000001c0)=0xe8) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, &(0x7f0000000200), 0x2) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[], 0x178) 12:00:12 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x100000800, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:00:12 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x8}}}, 0xb) 12:00:12 executing program 3: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000080)={0x0, 0x47f0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) [ 2121.306121] Bluetooth: hci0: command tx timeout [ 2123.354052] Bluetooth: hci0: command tx timeout [ 2125.402057] Bluetooth: hci0: command tx timeout [ 2127.450136] Bluetooth: hci0: command tx timeout 12:00:21 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0xa}}}, 0xb) 12:00:21 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e7, &(0x7f0000000040)="dd2f233be6040571e155c2be69102d0308348087a7e43713266f284d3a162326b1f6bf30461e4a4e20bb1bc3fef630bfab47280a4f7523c37d94ea36d47c7b0c482221cbdc35fe09a705da") bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000002440)={0x0, 0x0}) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000002340)=[{{&(0x7f0000000100)=@abs, 0x6e, &(0x7f00000002c0)=[{&(0x7f0000000180)=""/218, 0xda}, {&(0x7f0000000280)}], 0x2}}, {{&(0x7f0000000300), 0x6e, &(0x7f0000000700)=[{&(0x7f0000000380)=""/119, 0x77}, {&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000000400)=""/126, 0x7e}, {&(0x7f0000000480)=""/68, 0x44}, {&(0x7f0000000500)=""/107, 0x6b}, {&(0x7f0000000580)=""/232, 0xe8}, {&(0x7f0000000680)=""/115, 0x73}], 0x7, &(0x7f0000001800)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x88}}, {{&(0x7f00000018c0), 0x6e, &(0x7f0000001f00)=[{&(0x7f0000000780)=""/45, 0x2d}, {&(0x7f0000001940)=""/202, 0xca}, {&(0x7f0000001a40)=""/8, 0x8}, {&(0x7f0000001a80)=""/188, 0xbc}, {&(0x7f0000002500)=""/107, 0x6b}, {&(0x7f0000001bc0)=""/178, 0xb2}, {&(0x7f0000001c80)=""/194, 0xc2}, {&(0x7f0000001d80)=""/159, 0x9f}, {&(0x7f0000001e40)=""/144, 0x90}], 0x9}}, {{0x0, 0x0, &(0x7f0000002240)=[{&(0x7f0000001fc0)=""/219, 0xdb}, {&(0x7f00000020c0)=""/87, 0x57}, {&(0x7f0000002140)=""/126, 0x7e}, {&(0x7f00000021c0)=""/30, 0x1e}, {&(0x7f0000002200)=""/38, 0x26}], 0x5, &(0x7f00000022c0)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x80}}], 0x4, 0x40000000, &(0x7f0000002480)={r1, r2+60000000}) recvmsg$unix(r3, &(0x7f0000002580)={&(0x7f0000001b40), 0x6e, &(0x7f0000000280)}, 0x857df762b6da1250) setsockopt$inet_tcp_int(r3, 0x6, 0x5, &(0x7f00000024c0)=0x40, 0x4) r4 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r4], 0x178) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 12:00:21 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x10000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:00:21 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x400000, 0x0) syz_io_uring_setup(0x2919, &(0x7f0000000240)={0x0, 0xf77d, 0x0, 0x3, 0x1ef}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f00000002c0), &(0x7f0000000300)) syz_io_uring_setup(0x2b5b, &(0x7f0000000180)={0x0, 0xbd16, 0x2, 0x2, 0x36c, 0x0, r1}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000200)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r2, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) 12:00:21 executing program 3: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x40000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:00:21 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:00:21 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x1000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:00:21 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x600, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:00:22 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x500}}}, 0xb) [ 2129.498084] Bluetooth: hci0: command tx timeout 12:00:22 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x7f8c22212fff, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:00:22 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) r2 = syz_open_dev$vcsu(&(0x7f0000000040), 0x3, 0x400000) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r3, 0x40189429, &(0x7f00000000c0)={0x0, 0x2, 0x1}) setsockopt$inet_tcp_int(r2, 0x6, 0xc, &(0x7f0000000080)=0x4, 0x4) 12:00:22 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) epoll_create1(0x0) r1 = dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x0) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:00:22 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:00:22 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x810, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:00:22 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x600}}}, 0xb) 12:00:22 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_bt_hci(r0, 0x400448dd, &(0x7f0000000040)="c6cea40e5d3972453de06ba564f364304fea2fca628b63ac54d1963613959116b8d1b0b34488043eeda2cd70f7b5edce0aeac7f2d8a0d5dec60b34ac8c25e5b39ccaf98817120395d5ec375b808e69add0b186b52b2ac2ac28043939cf6044c9752b0b3f6884c693f2560626d4b94c699e435d6aead8bc2c3f27e36f39c7b8b0431a29224ace18b5081f1c4de391cf47747d2a5f85d5cc1419d3772258d1b408f27fe8d8cc0ab8c8edd2ca8d60b922ca8c3989dd621c5aebdff533afa7cdaffb7ecad6649e0f818b755394444df861ec24bc95840167") r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 12:00:22 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x3000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 2131.546080] Bluetooth: hci0: command tx timeout [ 2133.594067] Bluetooth: hci0: command tx timeout [ 2135.642155] Bluetooth: hci0: command tx timeout [ 2137.690148] Bluetooth: hci0: command tx timeout [ 2139.738158] Bluetooth: hci0: command tx timeout 12:00:33 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) (fail_nth: 1) 12:00:33 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x2001000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:00:33 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f0000000080)=""/18, 0x75}], 0x1) close(r0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0), 0x101001, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r2, 0xc0189373, &(0x7f0000000180)={{0x1, 0x1, 0x18, r3, {0x36c}}, './file0\x00'}) 12:00:33 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0xa00}}}, 0xb) 12:00:33 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) epoll_create1(0x0) r1 = dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x0) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:00:33 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x1008, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:00:33 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000100)={0x2, 0x5, "7b38e3", 0x9, 0x2}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) dup3(r1, r0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$bt_hci(r3, &(0x7f00000000c0)={0x1, @add_sco={{0x407, 0x4}, {0xc9, 0xff}}}, 0x8) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) 12:00:33 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x7000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 2141.464613] FAULT_INJECTION: forcing a failure. [ 2141.464613] name failslab, interval 1, probability 0, space 0, times 0 [ 2141.466181] CPU: 0 UID: 0 PID: 20361 Comm: syz-executor.3 Not tainted 6.17.0-next-20251003 #1 PREEMPT(voluntary) [ 2141.466207] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2141.466218] Call Trace: [ 2141.466225] [ 2141.466232] dump_stack_lvl+0xfa/0x120 [ 2141.466261] should_fail_ex+0x4d7/0x5e0 [ 2141.466290] should_failslab+0xc2/0x120 [ 2141.466318] kmem_cache_alloc_node_noprof+0x79/0x6a0 [ 2141.466342] ? lock_release+0xc8/0x290 [ 2141.466365] ? __alloc_skb+0x2ab/0x370 [ 2141.466392] ? __alloc_skb+0x2ab/0x370 [ 2141.466409] __alloc_skb+0x2ab/0x370 [ 2141.466429] ? __pfx___alloc_skb+0x10/0x10 [ 2141.466462] alloc_skb_with_frags+0x8f/0x7c0 [ 2141.466489] ? __pfx_perf_trace_lock+0x10/0x10 [ 2141.466518] sock_alloc_send_pskb+0x7cb/0x950 [ 2141.466538] ? lock_acquire+0x15e/0x2f0 [ 2141.466559] ? avc_has_perm_noaudit+0x59/0x3d0 [ 2141.466591] ? avc_has_perm_noaudit+0x11b/0x3d0 [ 2141.466624] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 2141.466644] ? avc_has_perm_noaudit+0x150/0x3d0 [ 2141.466677] ? sock_has_perm+0x21d/0x2b0 [ 2141.466707] ? __pfx_sock_has_perm+0x10/0x10 [ 2141.466741] hci_sock_sendmsg+0x190/0x2270 [ 2141.466773] ? perf_trace_lock+0xb5/0x5d0 [ 2141.466799] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 2141.466838] sock_write_iter+0x57e/0x610 [ 2141.466868] ? __pfx_sock_write_iter+0x10/0x10 [ 2141.466909] ? security_file_permission+0x22/0x90 [ 2141.466943] vfs_write+0xbe9/0x1150 [ 2141.466977] ? __pfx_sock_write_iter+0x10/0x10 [ 2141.467005] ? __fget_files+0x34/0x3b0 [ 2141.467028] ? __pfx_vfs_write+0x10/0x10 [ 2141.467074] ksys_write+0x1ef/0x240 [ 2141.467099] ? __pfx_ksys_write+0x10/0x10 [ 2141.467134] do_syscall_64+0xbf/0x390 [ 2141.467160] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2141.467180] RIP: 0033:0x7f7e980feb19 [ 2141.467195] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2141.467214] RSP: 002b:00007f7e95674188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2141.467232] RAX: ffffffffffffffda RBX: 00007f7e98211f60 RCX: 00007f7e980feb19 [ 2141.467245] RDX: 000000000000000b RSI: 00000000200000c0 RDI: 0000000000000004 [ 2141.467257] RBP: 00007f7e956741d0 R08: 0000000000000000 R09: 0000000000000000 [ 2141.467268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2141.467280] R13: 00007ffe998b6cdf R14: 00007f7e95674300 R15: 0000000000022000 [ 2141.467308] [ 2141.515433] Bluetooth: hci2: Opcode 0x0401 failed: -4 12:00:34 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) epoll_create1(0x0) r1 = dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x0) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:00:34 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = fsmount(0xffffffffffffffff, 0x0, 0x4) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000040)={'IDLETIMER\x00'}, &(0x7f0000000080)=0x1e) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x7}, 0x6) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r1, 0xc0189374, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x400}}, './file0\x00'}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r3], 0x178) 12:00:34 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x3) 12:00:34 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) (fail_nth: 2) 12:00:34 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x8000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:00:34 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 12:00:34 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) (fail_nth: 3) 12:00:34 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x4000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:00:34 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x2020000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) [ 2141.787400] Bluetooth: hci0: command tx timeout 12:00:34 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x8100000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 2143.834096] Bluetooth: hci0: command tx timeout [ 2145.882026] Bluetooth: hci0: command tx timeout [ 2147.930067] Bluetooth: hci0: command tx timeout [ 2149.978091] Bluetooth: hci0: command tx timeout 12:00:44 executing program 7: prctl$PR_GET_UNALIGN(0x5, &(0x7f0000000080)) r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) 12:00:44 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:00:44 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYRESHEX=r1], 0x178) 12:00:44 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) (fail_nth: 4) 12:00:44 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 12:00:44 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x11000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:00:44 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x9000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:00:44 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x8000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:00:44 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) (fail_nth: 5) 12:00:44 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 12:00:44 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x404) 12:00:44 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x34000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2152.340528] FAULT_INJECTION: forcing a failure. [ 2152.340528] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2152.342242] CPU: 1 UID: 0 PID: 20664 Comm: syz-executor.3 Not tainted 6.17.0-next-20251003 #1 PREEMPT(voluntary) [ 2152.342273] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2152.342286] Call Trace: [ 2152.342293] [ 2152.342302] dump_stack_lvl+0xfa/0x120 [ 2152.342336] should_fail_ex+0x4d7/0x5e0 [ 2152.342369] _copy_from_iter+0x1dc/0x1660 [ 2152.342398] ? lock_acquire+0x15e/0x2f0 [ 2152.342424] ? __virt_addr_valid+0x1c6/0x5d0 [ 2152.342459] ? find_held_lock+0x2b/0x80 [ 2152.342493] ? __pfx__copy_from_iter+0x10/0x10 [ 2152.342518] ? lock_release+0xc8/0x290 [ 2152.342548] ? __virt_addr_valid+0x100/0x5d0 [ 2152.342583] ? __check_object_size+0x57b/0x880 [ 2152.342614] hci_sock_sendmsg+0x402/0x2270 [ 2152.342649] ? perf_trace_lock+0xb5/0x5d0 [ 2152.342679] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 2152.342722] sock_write_iter+0x57e/0x610 [ 2152.342756] ? __pfx_sock_write_iter+0x10/0x10 [ 2152.342803] ? security_file_permission+0x22/0x90 [ 2152.342841] vfs_write+0xbe9/0x1150 [ 2152.342870] ? __pfx_sock_write_iter+0x10/0x10 [ 2152.342901] ? __fget_files+0x34/0x3b0 [ 2152.342927] ? __pfx_vfs_write+0x10/0x10 [ 2152.342987] ksys_write+0x1ef/0x240 [ 2152.343015] ? __pfx_ksys_write+0x10/0x10 [ 2152.343054] do_syscall_64+0xbf/0x390 [ 2152.343082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2152.343104] RIP: 0033:0x7f7e980feb19 [ 2152.343120] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2152.343142] RSP: 002b:00007f7e95674188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2152.343163] RAX: ffffffffffffffda RBX: 00007f7e98211f60 RCX: 00007f7e980feb19 [ 2152.343177] RDX: 000000000000000b RSI: 00000000200000c0 RDI: 0000000000000004 [ 2152.343190] RBP: 00007f7e956741d0 R08: 0000000000000000 R09: 0000000000000000 [ 2152.343204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2152.343216] R13: 00007ffe998b6cdf R14: 00007f7e95674300 R15: 0000000000022000 [ 2152.343249] 12:00:44 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000040)=[{}, {}], 0x2, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x178) 12:00:44 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xa000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:00:44 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) [ 2154.266079] Bluetooth: hci0: command tx timeout [ 2156.314053] Bluetooth: hci0: command tx timeout [ 2158.362077] Bluetooth: hci0: command tx timeout [ 2160.410053] Bluetooth: hci0: command tx timeout 12:00:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xfdef) 12:00:53 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) (fail_nth: 6) 12:00:53 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) readv(r2, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) syz_io_uring_complete(r1) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) r6 = socket$inet_tcp(0x2, 0x1, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$BTRFS_IOC_START_SYNC(r7, 0x80089418, &(0x7f00000000c0)) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) io_uring_register$IORING_REGISTER_FILES(r4, 0x2, &(0x7f0000000080)=[r2, r6, r8, r3], 0x4) 12:00:53 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) write$bt_hci(r0, &(0x7f0000000040)={0x1, @sniff_mode={{0x803, 0xa}, {0xc8, 0x7, 0x0, 0x9, 0x5b}}}, 0xe) 12:00:53 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) 12:00:53 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xb000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:00:53 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x80000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:00:53 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x8000001000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:00:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xfffffdef) [ 2161.411124] FAULT_INJECTION: forcing a failure. [ 2161.411124] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2161.412872] CPU: 1 UID: 0 PID: 20866 Comm: syz-executor.3 Not tainted 6.17.0-next-20251003 #1 PREEMPT(voluntary) [ 2161.412902] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2161.412914] Call Trace: [ 2161.412923] [ 2161.412931] dump_stack_lvl+0xfa/0x120 [ 2161.412971] should_fail_ex+0x4d7/0x5e0 [ 2161.413005] _copy_to_user+0x32/0xd0 [ 2161.413036] simple_read_from_buffer+0xe0/0x180 [ 2161.413065] proc_fail_nth_read+0x18a/0x240 [ 2161.413098] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2161.413131] ? security_file_permission+0x22/0x90 [ 2161.413176] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2161.413207] vfs_read+0x1eb/0xc70 [ 2161.413242] ? __pfx_vfs_read+0x10/0x10 [ 2161.413272] ? lock_release+0xc8/0x290 [ 2161.413304] ? __fget_files+0x20d/0x3b0 [ 2161.413343] ksys_read+0x121/0x240 [ 2161.413371] ? __pfx_ksys_read+0x10/0x10 [ 2161.413410] do_syscall_64+0xbf/0x390 [ 2161.413439] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2161.413461] RIP: 0033:0x7f7e980b169c [ 2161.413478] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 2161.413499] RSP: 002b:00007f7e95674170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2161.413520] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f7e980b169c [ 2161.413535] RDX: 000000000000000f RSI: 00007f7e956741e0 RDI: 0000000000000003 [ 2161.413548] RBP: 00007f7e956741d0 R08: 0000000000000000 R09: 0000000000000000 [ 2161.413561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2161.413574] R13: 00007ffe998b6cdf R14: 00007f7e95674300 R15: 0000000000022000 [ 2161.413608] 12:00:53 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x10100000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:00:53 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) 12:00:54 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xfffffffffffffdef) 12:00:54 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x10000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:00:54 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:00:54 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x100100, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:00:54 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000040)={0x6, 'geneve1\x00', {0x6}, 0x9}) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 12:00:54 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:00:54 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x80000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2163.418119] Bluetooth: hci0: command tx timeout [ 2165.466174] Bluetooth: hci0: command tx timeout 12:01:03 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)={0x1, @le_set_adv_data={{0x2008, 0x20}, {0x9, "daca3f529d3d6a455aa87eef7e9190fb520cce531a0d1da48f1eba1aaf37e0"}}}, 0x24) write$bt_hci(r0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00'/10], 0x7) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f00000000c0)={0x3, 0x8, "85f957", 0x40, 0x20}) 12:01:03 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x3, 0x3}, 0x6) 12:01:03 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r3, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) 12:01:03 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x2}}}, 0xb) 12:01:03 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x20000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:03 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:03 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x400300, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:03 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x10400000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:01:03 executing program 2: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) epoll_pwait2(r1, &(0x7f00000000c0)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)={0x200b}) ioctl$PTP_ENABLE_PPS(r0, 0x40043d04, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @rand_addr=0x64010101}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000140)={0x80000000}) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000300)={0x1f, 0x1, 0x4}, 0x6) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r1, &(0x7f00000002c0)={0x50000005}) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0x0, 0x2}, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000240)={0x200b}) sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0xfffffffffffffe33, 0x0, 0x2, 0x70bd2d, 0x25dfdbfe, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4000082) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000100)={0x0, r2, 0xa05, 0x0, 0x40, 0x4}) write$bt_hci(r2, &(0x7f00000007c0)=ANY=[@ANYRES32=r4], 0x178) 12:01:03 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x20100000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:03 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:03 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0x3ff, 0x4) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:01:03 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x4}}}, 0xb) 12:01:03 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x1000000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2172.890057] Bluetooth: hci0: command tx timeout [ 2174.938062] Bluetooth: hci0: command tx timeout [ 2176.986043] Bluetooth: hci0: command tx timeout [ 2179.034048] Bluetooth: hci0: command tx timeout 12:01:12 executing program 7: syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10, 0x0, 0x4}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r0, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x46400, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f00000000c0), 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) ioctl$BLKROSET(r2, 0x125d, &(0x7f00000000c0)=0x80000001) 12:01:12 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="45500ae99f2815b968b6208ec232a4be8db04a30ab5603692c0a869f942ba8c1d8cb016638ad8fd0cc1ce9548e187663b6abaa9a2494914db500"/68], 0x1da) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) setsockopt$inet_tcp_int(r2, 0x6, 0x22, &(0x7f0000000100)=0x57, 0x4) 12:01:12 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x40000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:12 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x100000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:01:12 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:12 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x5}}}, 0xb) 12:01:12 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x3}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @logical_link_cancel={{0x43b, 0x2}, {0xc8, 0xff}}}, 0x6) 12:01:12 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x2000000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:12 executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)={0x200b}) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x3}, 0x6) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0x3, 0x2}, 0x6) 12:01:12 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x6}}}, 0xb) 12:01:12 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:12 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x3000000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:12 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x200000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:01:12 executing program 2: ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, &(0x7f0000000100)) futex(&(0x7f0000000040), 0x2, 0x0, &(0x7f0000000080), &(0x7f00000000c0), 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) semtimedop(0xffffffffffffffff, &(0x7f0000000140)=[{0x4, 0x2}, {0x2, 0x7, 0x1800}, {0x0, 0x6, 0x800}, {0x3, 0x2, 0x800}, {0x3, 0x9}, {0x2, 0xbbc8, 0x800}, {0x2, 0x8000}], 0x7, &(0x7f00000001c0)={r1, r2+60000000}) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r3], 0x178) 12:01:12 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x8cffffff, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:12 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) [ 2181.082077] Bluetooth: hci0: command tx timeout [ 2183.130072] Bluetooth: hci0: command tx timeout [ 2185.178042] Bluetooth: hci0: command tx timeout 12:01:20 executing program 7: r0 = syz_io_uring_setup(0xfffffffa, &(0x7f0000000000)={0x0, 0x0, 0x10}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100), &(0x7f0000000140)) syz_io_uring_setup(0x5292, &(0x7f00000002c0)={0x0, 0x38e8, 0x10, 0x3, 0x231, 0x0, r0}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000340), &(0x7f0000000380)) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000080)=""/18, 0x12}, {&(0x7f0000000180)=""/114, 0x72}, {&(0x7f0000000200)=""/91, 0x5b}, {&(0x7f00000000c0)=""/3, 0x3}], 0x4) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x0) readv(r1, &(0x7f0000001400)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) close(r0) 12:01:20 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="013300000000000000"], 0xb) 12:01:20 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x300000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:01:20 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x8}}}, 0xb) 12:01:20 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x4000000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:20 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:20 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x7, [0x10001, 0x9], 0xaa5f}, 0x10) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 12:01:20 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xc0ed0000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:20 executing program 1: bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:20 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0xa}}}, 0xb) 12:01:20 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socketpair(0xb, 0xa, 0x8000, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write$bt_hci(r2, &(0x7f0000000080)={0x1, @le_set_data_len={{0x2022, 0x6}, {0xc8, 0x3, 0x7f}}}, 0xa) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 12:01:20 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x5000000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:20 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x400000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:01:20 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xf6ffffff, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:20 executing program 1: bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) [ 2189.914108] Bluetooth: hci0: command tx timeout [ 2191.962076] Bluetooth: hci0: command tx timeout 12:01:29 executing program 7: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x3000000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:29 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x500}}}, 0xb) 12:01:29 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f0000000100)={0x0, 0x5, 0x8efe}) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/11], 0xb) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000040)={0x0, 'macvlan0\x00', {0x1}, 0x6}) 12:01:29 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xfeff0000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:29 executing program 1: bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:29 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x6000000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:29 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x500000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:01:29 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000080)='./file0\x00', 0x10001, 0x4, &(0x7f0000000340)=[{&(0x7f00000000c0)="094c166316f3c45abd23eca39e6ff38df33a3922123460e4d1d8031a74f15bc38995c0f5804cafb05916c3107565ecf85b441fc939c9640dc1225e2a3459df9baa2520d633363311470eec9bf8673ba21a31bcdde05ed6b51101d66599c3bca29f9f1adc732992c684ef1c25c5d44e2013d457b397ad333e2557241c50fa09f7ad1409e66f9c89efe1241cf75f2e58af8201b75754386a794186dd731def1aa52d8e3a0e138bf7bda88363", 0xab, 0xa5}, {&(0x7f0000000180)="2c711283364e2e042c1c5e4be006b7d3e1c419925d18b9456f878f834384bcfe71209a4da1420ae0faf31dc48a784df939312c9092b85af7b4e3da2ae5df49", 0x3f, 0x5}, {&(0x7f00000001c0)="d4e852a99056efd2d4dbcaa6345dc3a3a568e32c5d1e473d386bef8a7aba8135d0d9476a465a2d6d77844b9791ac9a1b94bc3fbe737a78d6b59ba185d89f1fda1403728795f8dc8e3ca3fa464fb3ec76d3e3219d7ef4cbe1f45f612415774714aee5f99fb830c422ad63ec3a062b90761bf022c6d4a3564e1cff7c3c0d29387a3f9c318a39700ba1070193f64505b5589a4f1ea84f32c40d5612d77c447e8bbab931870126872a8f6c903ddad970b76b6cbafd07975cbf5737e220f4867b08904d7e0685ef6cb6", 0xc7, 0x3}, {&(0x7f00000002c0)="1fd20fd6cc8883894fbdfd9c0cd1bc106bad933a03e0e32c53b1a01fbe481440a85b98354c62976779bddd948914f0d8a765b783ee86e055eafcf601ea83cdea7d944f32b8ed3f67a7a9af2fc8527dad", 0x50, 0x46f}], 0x2001401, &(0x7f00000003c0)={[{@noload}, {@jqfmt_vfsv0}], [{@dont_measure}]}) dup3(0xffffffffffffffff, r1, 0x80000) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) 12:01:29 executing program 7: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x400300, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:29 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x600}}}, 0xb) 12:01:29 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xffff0000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:29 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:29 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000080)={0x1, @link_key_neg_reply={{0x40c, 0x6}, {@none}}}, 0xa) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYRES32=r1], 0x178) 12:01:29 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x600000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:01:29 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x8100000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:29 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYRESDEC=r1], 0x178) 12:01:29 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0xa00}}}, 0xb) 12:01:29 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="8dc615a48002780dfe9169ef99c60cb87cc20be1f6d93bdcecea712173c9577d7668df5354ee67cd46af0e20ceec794afffaffffffffffffff1b6dfe84aaa1250f2b45c0b37ef17bf79a4bd1673bdc54163c64"], 0xb) r1 = socket$netlink(0x10, 0x3, 0x2) recvmmsg(r0, &(0x7f0000002cc0)=[{{&(0x7f0000000280)=@hci, 0x80, &(0x7f00000006c0)=[{&(0x7f00000000c0)=""/57, 0x39}, {&(0x7f0000000300)=""/117, 0x75}, {&(0x7f0000000380)=""/126, 0x7e}, {&(0x7f0000000400)=""/162, 0xa2}, {&(0x7f00000004c0)=""/34, 0x22}, {&(0x7f0000000500)=""/201, 0xc9}, {&(0x7f0000000600)=""/152, 0x98}], 0x7, &(0x7f0000000740)=""/68, 0x44}, 0x8f1}, {{0x0, 0x0, &(0x7f0000001c40)=[{&(0x7f00000007c0)=""/4096, 0x1000}, {&(0x7f00000017c0)=""/52, 0x34}, {&(0x7f0000001800)=""/55, 0x37}, {&(0x7f0000001840)=""/172, 0xac}, {&(0x7f0000001900)=""/233, 0xe9}, {&(0x7f0000001a00)=""/148, 0x94}, {&(0x7f0000001ac0)=""/163, 0xa3}, {&(0x7f0000001b80)=""/187, 0xbb}], 0x8, &(0x7f0000001cc0)=""/4096, 0x1000}, 0x6e5}], 0x2, 0x40000001, &(0x7f0000002d40)) getsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$sock_bt_hci(r0, 0x400448de, &(0x7f0000000100)="0459455c74bf8bb769cb8d50498099d964b449b3d4e524a33de9f087f611716a55ed4c75f17e366a1e6b4f8908332bccc39ac64072757e859f9b9fad59d7949e31a2c9a375fed004c1dda5a36f5c7b56dadabaa17c303abee63acab625bfd76ba260c4457536496529b94b550468cd3256c58df108b7c3f43055440b744642f52e433c846510210e3c2d0a613f4eda019b20dc32700889a8c3a0a94627bac12697bc03fcd7bda6c10d1e24e83044ecd0125b6bc981b83a85a77942a501e7f16cb7e16b7f729506d1696ca261f438a771b7a128575ae7881628f1b7") 12:01:29 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:29 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) (fail_nth: 1) 12:01:29 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:01:29 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:01:40 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x700000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:01:40 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xffffff8c, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:40 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000340)=ANY=[@ANYBLOB="2000c90000", @ANYRES32=r0, @ANYBLOB="0400ea00000000002e2f666930005b6678e1b1c6d63267fd0800c0206cdfa9ef69c2c467c4abfa5bbdca10e5708a47c4217dda630000"]) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000440)={0x1, 0x20, "14102e", 0x6d, 0x80}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$bt_hci(r2, 0x0, 0x2, &(0x7f0000000100)=""/249, &(0x7f0000000080)=0xf9) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r6 = epoll_create1(0x0) epoll_pwait2(r6, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000240)={0x200b}) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000240)={0x200b}) epoll_wait(0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x4a) write$bt_hci(r5, &(0x7f0000000300)=ANY=[@ANYBLOB="0114885983b5f09e9086f645387a90ef9c76000000000000000000"], 0x1b) r7 = openat2(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)={0xa8442, 0x105, 0x3}, 0x18) bind$bt_hci(r7, &(0x7f0000000240)={0x1f, 0x3, 0x1}, 0x6) 12:01:40 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x10000000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:40 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:40 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) write$bt_hci(r0, &(0x7f0000000040)={0x1, @link_key_neg_reply={{0x40c, 0x6}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}}}, 0xa) 12:01:40 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:01:40 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x2}}}, 0xb) 12:01:40 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xfffffff6, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:40 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x40000000, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2210.010101] Bluetooth: hci0: command tx timeout [ 2215.258093] Bluetooth: hci0: command 0x0406 tx timeout 12:01:50 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x4000) 12:01:50 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000080)=0x7f, &(0x7f0000000100)=0x1) 12:01:50 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x2, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:50 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x900000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:01:50 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xedc000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x4}}}, 0xb) 12:01:50 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) dup3(r1, r0, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) 12:01:50 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:50 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x0, 0x4}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) epoll_pwait2(r3, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0xa, &(0x7f0000000040), &(0x7f0000000180)={[0x6]}, 0x8) 12:01:50 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 12:01:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x5}}}, 0xb) 12:01:50 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x3, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:50 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x4000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:50 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:50 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xd00000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:01:51 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYRES32=r1], 0x178) [ 2220.186050] Bluetooth: hci0: command 0x0406 tx timeout [ 2222.234058] Bluetooth: hci0: command 0x0406 tx timeout 12:01:59 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0xaaaaaa9) 12:01:59 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x1100000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:01:59 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x8000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x6}}}, 0xb) 12:01:59 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x1}, 0x6) write$bt_hci(r0, &(0x7f0000000080)={0x1, @le_start_enc={{0x2019, 0x1c}, {0xc8, 0xfff, 0x400, "02a7592b3c7f5147aa1cb573714ce2b5"}}}, 0x20) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x3, 0x4) 12:01:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000140), 0x0, 0x0, 0x0, 0xffffffffffffffd1) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$sock_bt_hci(r1, 0x800448d7, &(0x7f0000000040)="1fefa71b73e25e45e42da1b34061f9ec4de6bdd2de54750f9676dd8f6c71cfe51c49ac770a4b6b8cf231e128d866318bf50320") r3 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r3], 0x178) ioctl$AUTOFS_DEV_IOCTL_FAIL(r1, 0xc0189377, &(0x7f0000000140)={{0x1, 0x1, 0x18, r3, {0x5, 0x90001}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r1, 0xc0189374, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0xff}}, './file0\x00'}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f0000000100)={0x20000004}) 12:01:59 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x4, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:59 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x100000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:01:59 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01330cfe006bd14a2df3c0"], 0xb) 12:01:59 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x5, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:01:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:01:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0xa}}}, 0xb) 12:01:59 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x2000000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:01:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="77b89df002e95c0cb9efee40dd156e875faf84d89d61373fe343a5d8fcaf7b"], 0x178) r2 = syz_io_uring_complete(0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {0x80008dec, 0x4}}, './file0\x00'}) write$bt_hci(r3, &(0x7f0000000100)={0x1, @role_discovery={{0x809, 0x2}, {0xc8}}}, 0x6) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r3, 0xc018937b, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff, 0xee01}}, './file0\x00'}) ioctl$HCIINQUIRY(r4, 0x800448f0, &(0x7f0000000200)={0xffffffffffffffff, 0x800, "10bb07", 0x20, 0x80}) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r6 = epoll_create1(0x0) epoll_pwait2(r6, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000240)={0x200b}) r7 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r5, 0x4c80, r7) bind$bt_hci(r3, &(0x7f00000000c0)={0x1f, 0x1}, 0x6) 12:01:59 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x200000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 2229.275029] Bluetooth: hci1: command 0x0406 tx timeout [ 2229.402074] Bluetooth: hci0: command 0x0406 tx timeout [ 2231.325055] Bluetooth: hci1: command 0x0406 tx timeout [ 2231.450067] Bluetooth: hci0: command 0x0406 tx timeout 12:02:10 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:02:10 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x7, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:02:10 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x40000000) 12:02:10 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x5}, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000080)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000200)=""/151, 0xa7, 0x0, &(0x7f0000000100)=""/52, 0xfffffffffffffed0}, &(0x7f00000001c0)=0x40) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f00000000c0)={0x1, 0x9, "208caa", 0xc1, 0x69}) 12:02:10 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:02:10 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x300000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:02:10 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x3a03000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:02:10 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x101000, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f00000001c0)=0x6, 0x4) r2 = accept(r0, &(0x7f0000000040)=@isdn, &(0x7f0000000100)=0x80) write$bt_hci(r2, &(0x7f0000000140)={0x1, @read_remote_version={{0x41d, 0x2}, {0xc9}}}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:02:10 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:02:10 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)={0x1, @le_set_ext_adv_enable={{0x2039, 0x41}, {0x1, 0x2, "50dbe70d0d4cf8247792a5d158e29dc7e2878fab50f029bb88ce651b22cdab4517a1c8f1fc13363af66fa6615709b89f1445bb0ce64add39b658436ea8b8bc"}}}, 0x45) 12:02:10 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x2}}}, 0xb) 12:02:10 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, 0x0, 0x0) 12:02:10 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x3f00000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:02:10 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x0, 0x5}, 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) fsetxattr(r0, &(0x7f0000000040)=@random={'os2.', '\xc5w[#\\&\x00'}, &(0x7f0000000080)='@}\x00', 0x3, 0x1) socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f0000001100)=ANY=[@ANYRESHEX, @ANYBLOB="3e12ff2e8462ddb3b11cb9302d8d30463ad575db634d87e1d0eef0a12edba0d42815deba98b989a1e810e6c4a756e1084a275920a6bdf2adac7e57bc5a353521c4bc2da51f12735b2ea25548f2df7e757b6e980019f5f13bf490374e4b32c8834c198d6a2e059a357fb8d4216f8b080b29d61365230ed9f851b479c6c8c4a1f15a17578f3f94cd9d7f0826d9362cf1315f52360bf205930e62805e3c9fc1557c09efbb4538eddf8310fd18b57ec0ea6533fba6f9c83e0509daee91e822a1cac67ccb6640c903000e92b2557090bcaac3cf6701c190baebd1f4b364ac8c352d67f5df2a151259c789b4a9e68d75b862878085cc20457379db044c4cf35773b18398e24f07b7a6c53550135aac5dbe6f80637b89d60d7938f428f2666b87a594e94973690af700cbe3e8c065a647e754cd15cfa30ca33bf7b5b4edf918bf456249fb0a5090e63b5ea7a525e662362574cd6de6df36b6ee9592c6a6c932d40d001d834d1c8b66953d2dbf0c2cc75564d18fd93174b404f6e3c490efe7283077cd4dbf349806f3d03e9fc92be471e6e4dc7328cfcafd9899aa4523137a234201436d8c38e8aa88fa0310c5d7c010fb574c7ac7659bfe82d065bd807f7174f4f03525d67fdd5ca583316bf6ed621795207c1cd964efdfda16a32c1f74fb0b4810bf5d82f44fe1bcafdc78a864519a09bdd747f11a995c397b0f3007ec3702c1cb56b26373f31856f03f4aae41a3dfef459f7479560cd4e288ef0fb71a7d4dd9cd31f34114aaa1fb77a1e4b3400c1c27c0bd96b4cb28c4e04bcdeb6f92f6f7b1db743bfeab6674b808db3af52e73b8ddeaaa82fca616a5a18dc07c19accd7e922beeb3e06d15649993a246af7fd6f7c004533af2f8287fd9ee770d1bafae5ba2f638f9a4b8eb0c6d8d98ccd576b38e7f117f187419543fbfe57deb1e21e73ea71c05a02f5674e9100cf4d9e8785b6d03c176bfdc2539019f7a35f7a0fc260c42c4da989354d0ca041d05e47654a1e0fffdfc5efbe9e4006b7e7c831f70b42adc3712d63330f42e73a8b42335454e32373a411eb0b80042e74fbd3ef807a0f15c5f39e137ad5fd14919fe202d20a2b5c2ab3089ae0a6cbc565bfa19384029c680ba0b1b3fe097d6d8e29781c10d8a0e0a8491005a42d63b5ce648969717ed98515527b275dee13b1ea7d4819556206caf1463f4c0cacbace731e4e0864222cb2c8e6d42654cadcd4b67c3109073582b3c02ab512e694322ded188ca3915eb5d9c55ee9dad5c022080a4d25fce8156f542f7c44ec848c58e4865434cbacf8f72d4e25a7b22c4aa3b7a1d8d231004831e641be972870f8d2ad8a59eba7fb1ab2f7b03dff90cf8b0a097dca7f504cdc47c701453b3ca0709d5c1e7e296d45e7cd158cd4abb9294ebd8d0a91e46af03e29b0eb8aa3ba5fd2e8dc71dedd836b06990347aa8ce569862883cea5f8316b9179c48a8d90147d2ace2a2afd67ea09f9597a6f7d006098b67114088c7f1079a57bfe7fcd6e5802ebf71ed7b0fb6f6bd18d31ec9e113f4aa2492ea385ef0fae8b2f756299c19cc0f3b1ab72dd7dc6dcd58e23705c6c667b4e3229c267c92212a211211cb03e799712190563b767b2a0ec132f96df5ed66d90b3f997fb53c0b4632131e59eba269d620e26c4e9042f2c57908d0b632c3f92fbc7d97249f387b2d886c5d7e645722386a4cc93a9aa6cfde82164a52cfc9e09c7426be7aec4e3955a96c34ce3ed1f235788a8f0eeac3a5b2286772a90df86bb51476625ab4b80d87edfce2d7e5bfd5e7d3abbe4d953c67974289b71459da911ae73e99bbf6d551921d6c52ab3a84f38f9a010272e2ff803cc5596022416d56179db0ffa8944dd341809494a256cbf0ee8bd290bc0ce761bbc533f6f9d30915745c3219a19f44fc44f04f0e5fe792ccf4ec0be1a87657f79bd90e56900bd4c62be18533b64e05fd10831b8d688f75d1d471397d963fb4d24bf0a1cc1de742c73048f972edbd3888b51ccbb68a6e502f3d146825e2154c53f8df8468460c61814a113e8a40cf26991331281c34abf28dc5dba4af7b04267a9df9b4fbcac1c9a3d006b6b38c4b2b1a280abf18f6a4fe3324bf52f84745256424b345c1236cec2df455f92e616eb845fba86a5e37f8d64130445cdca6a76e879cf9c1de3d5308837f224ec94b71a540ebb5a6a5a187e0ea1e45bfe338767587fdc2987031a4467da33032deaa67e7cc44b8366db4d60b74ff1a93dabfc906215fed5e98e23e68ab4f12d862de5ee85fdcc65c7cae02bbeb4357d4eca1347907440124500679d5f565d524cab62e3e2a2f7d28f6412b8c100e3822b72f9152a7720e83340a35eea592a729135d6e980038e5b2c14487474f2a0bd79ea202687186a2357481a4b4f6a0893a95989e62fa54cfffa084d2103505f035ae055fd871bc65c96c621d3df3f2f5682ee3fb12a671e778cb2b0e26509bb00a7ffeb15a3bc4605cf22a077639db5a032c0de30bd73f6359d1ad83516c9637d19facc5d5c24ed7c247bfa4617dbe03792191faf105feaedc807cde229b0f09564042947541eecbeb8864f24084c20100f9746b677d5e45043acf86b0cb3069f667ae03977bf52ebf40c96d0c9af5ac2ae07bac42c189d64fb94c9a4cef984cf5b0479d33cf338784a911ea6a522dcd0ee8457cc693ef829ae046dcca6712d127cf043b21cec531809bd940abc8d6689944f89ce76a44220d2bc858082f25273bcb69295e878c0a766ece2ce902145e02d171ac18dcceb9bbd613c6a0f8e6f0979a7d2a6a57e65fb1a717dccaac0f1446c5b9d925045241997fba681a4d760d82d1be58cce717aa650e0bdfe072413d7c276741798b84bdd24ab0638f2b55a7108e9b5e1348eca7893be7fad74a4b1aa017ac0e4620d48d610217e53d74afe71fadcc8388b7e0a25d5784a259c095c30421010c384547a57f77d48f0c688e8119f69e739f8b3db13d4b7ff5ead57e762a19d39a318bd1ef5c20af81b207425f0b61d851ee7306e5b2f660bb22e9e95a2a33035021b3f18151cf1bb72b5508d473b06f2667e5d9af66d256bc64c72aab4259744bb8c5fef70f2a03c00df0800dd64d1b04114757a3bbf06a30035842fe89192a51893b4de88725718a172dc250e9bb05ce0bba4ec8bc5599d40f56f2d3a3edd9e431cb76560c809713d675a4b4a90dadf4a020e03f575904ccc96caa96522e0b7d19dc1e29cfb2002db93254ee645930b5903da92cfd586718eb480d0ef730dd3a80c8a577847f03859efac32054d92f69181502a8df2af99f586d8866abf2f5709f4302d35c48fda6a498a97f4ac9e7c292ae27d9a94adeee9682ebcfd161800c5016d7dfa95d7f6293361bc510ff710bbb809c5cca56ec21e2652fd5835732f2409a6dc87991107fdd0ab5c15b3bee5609cee81bd7a3c62adde93559068795312012f05c0bc6aef3bd38d8970f5a029cabed52fa5dc69a1da75c088ab7209ca438afd1b75d21bcc2d2929810dcdc44fb68d18f20cc7ea2de79d2509f1b51ced7f5dabf89e98a1aca54b42f337f6cc3427d76c4123e77c5ba21023efcbdd933d4306b8a0a9edee50f43383ad6805443697fea4dca41ac80b9e990461b8e5d40214c2abad396553ec7c9935fead9a33ff18046827f9c89d1441e1db52b3aa2503dece9d45b74c642a304677868471d3433edc6ab444ce8ccbb78ef480c0f761e8fd3204985ecf1378677d26ae6a71bad9bad68c2e526c9320dc3964d010384ae582a694d1fe481378e7f3aead12e43ecf5f7619c7900bfd8b6fe55de45cec3ca706fff6c5bba63e1776828692b43db060b5b3ae68b8d96989d4fdee75a4a179d62a80dc5a3e8d1cc80d09dbcc3aca009f7ce6bb221d811133d13a2ad4f3b31e5196e1841b587b15751444c290c03e37b79194e4f0a42ae8911da7eadef416fedd018ca91c92485ce6875116c6fff151b315e4995dc93da2cce9668aac4edadae2cb323f0387e9d8b73c3abe12fd6942b4bdb9af3772830294d1dbc6703d7b28870bdf69c8eff339ca8bac3d25e39e897f05ecd292bb579930c10aefeca97529b4d0f0bef7bf64c1585edcdddad653f2baecc7c4c47dd540922ce85e1611684552d6453df4764294fd00787b6a2da32eec66e2d122c4add2190fc08a095c424b48b39fa35f8c2fe657d4ea8d4290eb6865d1f97d915a5995178fa54f83a8dc4e85722331a90e90cf92cd46ba4f85abb2259e3446990fad4f2afe6ff733f1ade9249913c342cb2e991f047c964098a2a87efe7563418594ddc343b7aa52f9498149c8c0aab5ad1f1a24749b316bd4a440c99be6ac5ee8fbfa376c57d9b248f9cb954e02f01f3fd509cff612e7886a132a917fe4343bcb7217c0446134afc81a46b21269b24dd0242fb7ef84cefe6709bf405e68109db05c4eebdaaf8bf8f376dbcc75ce8d7c80a9a88d6454b857e1fdbbb1a375dd631287706fe1634e86c0aa66178d9874fe39c1c1bd3b62e6fba055676d673e7d27cd1366e6eeebcb3f1452a70dbb0428986f28c8025f77571e7b3f858a251e53e82e18eb9de6c97b4e39f2c45597d681dc507dc20c94a643a9f563a5f95c0e518405a1b19bdc3216ca77c08134dc230644d12316372ead0d1a18307d489ab2eb635eb8b9f9045260e32cc559af7ee54b1ef7c3bc5445da5a5e90b9ba470d6729638f16a8ff126310d61d5e7a7b4a6840eadbf5c3f7314814148c4989388c09350d905118db0a10e7db4b8874c172f3ff9ca6e0e73c1516f204edffc1e857075a6678c8b54d6fda53c31565d6c0dd0784a2e60d42d64ce1767bea5539f1a11f2c46ba236691f3ff010722cce076f3e279555cfb3ebc9aaf764bf0036f23c13ccff7814c669388f1e31476d8dc733cc1075d1b06dde2831c01aedd9dc1acea8d96d3e00869891d4f640083a4e4567ad416034cef614a6ab4a441a23cbdb12d6cab0fa1911ffef4f2bc65124ab68c4e89f2c7d6aa9ec204579c447da6bcf817ad45dae2a33c25f7a8a6695c638920e84e02778335008ed381a4f1de852b2b98ec7695789ceb3bf9956df32adf3f3c7a3f1028045ea96635dca29671cf8408af910140882b20b257387c15c2757e225c4f4c003c29601d57a061708de3f76336e645853184b43af3cf79fb4e6f498aa8f1bcf77592ed39e891463877562f62a789566daed044bf2e16a3bf75b5fa7804a12e5c2bc3f36ca4db876b2a4d5e506b381e44d774cb831ddf4f4e5646c5818d837a901bb104561857f04a1e26293aeb5d6eb7b969e2b8921f050525a96a477b780a178d8895cdddc597560e4f6697dc4847389acd5f52adb94b64fc08443b59a26ae4d1734e4b61dbfe6cca89b82dcabbb1cfdb4d918daddf86b09714a4680c4035b503bab59b9d5ec72198d1edae4f4c2620806ec2e7584ecfdee492eac3022ac8d7134a997fd24d4f5366d0d89b3acbb315d9b5ea85a85ca71a670304503bb5e5e263ae525f5f644294563fce18d537a29ab8e622647fb8838e45e793665881f54d48edd90a154e1e0aa4f8b646f1d2654c1e2e920f9cf9675386e1c179dae864226362d78607423b3ff8feee767139aecebd349efd7d9cb6c2e3af0ed1545ac4c535cea0d0aa0fd42d3e182f1c88e7e9f368d0fe64207c1b05aff4e70632600044c50c402faa089aff6a5f9b1b5697cec43af42a89ccdedcca12eec65a7a45ada423d979f9f223f53b785b2c15681999ec214816d73d44f0654596fcf4fec218dcc6b9201499bf7e644e58c00000000000000000000007253d8399c06877fedd349114b1140b2c0d7180d8959fd45a0805cdaef7e", @ANYRES64, @ANYRESHEX], 0x178) 12:02:10 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x700000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:02:10 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, 0x0, 0x0) [ 2239.706075] Bluetooth: hci0: command 0x0406 tx timeout [ 2241.754108] Bluetooth: hci0: command 0x0406 tx timeout [ 2243.802196] Bluetooth: hci0: command 0x0406 tx timeout [ 2245.850124] Bluetooth: hci0: command 0x0406 tx timeout 12:02:21 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x4}}}, 0xb) 12:02:21 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:02:21 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0xa9aaaa0a) 12:02:21 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x0, 0x2}, 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x2}, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r3], 0x178) 12:02:21 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1, {r1}}, './file0\x00'}) write$bt_hci(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYRES64=r0, @ANYRES16=r2, @ANYBLOB="0926510d6c53c6b9cd7dfc5c2d24f411ededa33bc39268e52fff319fbdeb05c7ddfd728c8f8d13b2df7abe6d47fb31b7bc2ba49f3ebf15a18abf2c0e492a10fd8443676365963bf3c143faa11a6e350383cd84ad96a5ad353e99c1bcd599a62a43ff38655b816cd1764020497d7fe683da309780441d3ef45666e1892fc4c64bfd00c1a2f5d6f73e7f9e2de8109870d1546336b36c50144de3af20e4b2589bb79f51cbac0e17393269e24db8124842e7c145dccc6cbef0a73e9c362bca53049c7d101d69f2d94858c0af11398d75ac0a6c685f97e12847656688933c9b77cd0df1ffad325398c34311"], 0xb) 12:02:21 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, 0x0, 0x0) 12:02:21 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x800000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:02:21 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x4000000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:02:21 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x5}}}, 0xb) 12:02:21 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) (fail_nth: 1) 12:02:21 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:02:21 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x810000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:02:21 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='bridge0\x00', 0x10) write$bt_hci(r0, &(0x7f0000000080)={0x1, @set_conn_encrypt={{0x413, 0x3}, {0xc8, 0x2}}}, 0x7) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) [ 2249.388320] FAULT_INJECTION: forcing a failure. [ 2249.388320] name failslab, interval 1, probability 0, space 0, times 0 [ 2249.389411] CPU: 0 UID: 0 PID: 22644 Comm: syz-executor.1 Not tainted 6.17.0-next-20251003 #1 PREEMPT(voluntary) [ 2249.389427] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2249.389435] Call Trace: [ 2249.389439] [ 2249.389444] dump_stack_lvl+0xfa/0x120 [ 2249.389465] should_fail_ex+0x4d7/0x5e0 [ 2249.389484] should_failslab+0xc2/0x120 [ 2249.389503] kmem_cache_alloc_node_noprof+0x79/0x6a0 [ 2249.389518] ? lock_release+0xc8/0x290 [ 2249.389532] ? __alloc_skb+0x2ab/0x370 [ 2249.389549] ? __alloc_skb+0x2ab/0x370 [ 2249.389560] __alloc_skb+0x2ab/0x370 [ 2249.389572] ? __pfx___alloc_skb+0x10/0x10 [ 2249.389592] alloc_skb_with_frags+0x8f/0x7c0 [ 2249.389609] ? __pfx_perf_trace_lock+0x10/0x10 [ 2249.389627] sock_alloc_send_pskb+0x7cb/0x950 [ 2249.389639] ? lock_acquire+0x15e/0x2f0 [ 2249.389652] ? avc_has_perm_noaudit+0x59/0x3d0 [ 2249.389673] ? avc_has_perm_noaudit+0x11b/0x3d0 [ 2249.389692] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 2249.389705] ? avc_has_perm_noaudit+0x150/0x3d0 [ 2249.389724] ? sock_has_perm+0x21d/0x2b0 [ 2249.389742] ? __pfx_sock_has_perm+0x10/0x10 [ 2249.389763] hci_sock_sendmsg+0x190/0x2270 [ 2249.389783] ? perf_trace_lock+0xb5/0x5d0 [ 2249.389798] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 2249.389822] sock_write_iter+0x57e/0x610 [ 2249.389841] ? __pfx_sock_write_iter+0x10/0x10 [ 2249.389866] ? security_file_permission+0x22/0x90 [ 2249.389886] vfs_write+0xbe9/0x1150 [ 2249.389903] ? __pfx_sock_write_iter+0x10/0x10 [ 2249.389919] ? __fget_files+0x34/0x3b0 [ 2249.389934] ? __pfx_vfs_write+0x10/0x10 [ 2249.389967] ksys_write+0x1ef/0x240 [ 2249.389981] ? __pfx_ksys_write+0x10/0x10 [ 2249.390002] do_syscall_64+0xbf/0x390 [ 2249.390018] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2249.390030] RIP: 0033:0x7f72d3822b19 [ 2249.390039] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2249.390051] RSP: 002b:00007f72d0d98188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2249.390063] RAX: ffffffffffffffda RBX: 00007f72d3935f60 RCX: 00007f72d3822b19 [ 2249.390071] RDX: 0000000000000178 RSI: 00000000200000c0 RDI: 0000000000000004 [ 2249.390078] RBP: 00007f72d0d981d0 R08: 0000000000000000 R09: 0000000000000000 [ 2249.390085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2249.390091] R13: 00007ffef9ba9c9f R14: 00007f72d0d98300 R15: 0000000000022000 [ 2249.390109] 12:02:22 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x6}}}, 0xb) [ 2251.482101] Bluetooth: hci0: command 0x0406 tx timeout [ 2253.530119] Bluetooth: hci0: command 0x0406 tx timeout [ 2255.578069] Bluetooth: hci0: command 0x0406 tx timeout [ 2257.626625] Bluetooth: hci0: command 0x0406 tx timeout 12:02:30 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r1, 0x6, 0x1c, &(0x7f0000000300)=""/12, &(0x7f0000000280)=0xc) r2 = syz_open_dev$vcsu(&(0x7f0000000180), 0xa86b980, 0x20000) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f00000001c0), &(0x7f0000000200)=0x14) r3 = openat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x200280, 0x2, 0x1}, 0x18) ioctl$sock_bt_hci(r3, 0x400448dd, &(0x7f00000000c0)="b8ecac501183e6b1637e04632bb00055d5e9260133bb8ddf87378d27c8c587c9ff623455234dae46892eb3b6226171acaae38dd161f88ed1b113b10715bcc89f74535fa676fb7ec062a6d0945485a68d2e73820e928ba725f93c13a2746607d9d952c4643217a4ed121adde28cb5aebe565f6b33621c831dc30927c51bfc3cb73907ee24dac919c2e89bb25a1b7187b707e0ad468adea5cda16adef19a2dda354c11e9d454128dd6107ecd620d45de44da83eaff") write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r4, 0x80047210, &(0x7f0000000700)) write$bt_hci(r2, &(0x7f00000002c0)=ANY=[@ANYBLOB="98e1de6a8ed16ac4ab"], 0x9) 12:02:30 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x4000000000000000) 12:02:30 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x5) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) epoll_pwait2(r2, &(0x7f0000000000)=[{}], 0x1, &(0x7f0000000140)={r3, r4+60000000}, &(0x7f0000000180)={[0x6]}, 0x8) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01330c1c00000002000000"], 0xb) 12:02:30 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x2, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:02:30 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x7bffffff00000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:02:30 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x900000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:02:30 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x8}}}, 0xb) 12:02:30 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) (fail_nth: 2) 12:02:30 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0xa}}}, 0xb) 12:02:30 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xa00000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:02:30 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x7f, 0x4) 12:02:30 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xb00000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:02:30 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x3, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:02:30 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x1}, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 12:02:30 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) (fail_nth: 3) 12:02:30 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xc003000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:02:30 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x2}}}, 0xb) [ 2259.866049] Bluetooth: hci0: command 0x0406 tx timeout [ 2261.914026] Bluetooth: hci0: command 0x0406 tx timeout [ 2263.962100] Bluetooth: hci0: command 0x0406 tx timeout [ 2266.010075] Bluetooth: hci0: command 0x0406 tx timeout 12:02:41 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x500}}}, 0xb) 12:02:41 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0xa9aaaa0a00000000) 12:02:41 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xe000000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:02:41 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) (fail_nth: 4) 12:02:41 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x1000000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:02:41 executing program 2: sendmsg$DCCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000800)={0x127c, 0x13, 0x100, 0x70bd26, 0x25dfdbfb, {0x10, 0x8, 0x3a, 0x8, {0x4e22, 0x4e22, [0x0, 0x4, 0x1, 0x2], [0xa0000000, 0x2, 0x8499, 0x7], 0x0, [0x5, 0x6]}, 0x1f, 0x8}, [@INET_DIAG_REQ_BYTECODE={0x27, 0x1, "660d60f6facccb930d0e1c6c4cbcc839dcc8c901fa7f98a8747b0474266b1f108a74b0"}, @INET_DIAG_REQ_BYTECODE={0xe, 0x1, "fb9f57d6ac5d712421b9"}, @INET_DIAG_REQ_BYTECODE={0x9, 0x1, "34b52e93c2"}, @INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "16c23a3ea4f26c64582396704303f233fb498515e6bcff968d83eea3bb9fc8f920f31a6ba2513aa4a57fede87aff685f667162980de6daecea2e210f3d90e5f0e052891091408a72086ca8455e561caf7e449e7cea17a1d6c7df7320a0092c66627c7bec2e7616157f6854af8aa8004704aec213de38a51b0a987158c62a8c8c9b59cb272113d5c221993cfd4d13b779491dc6b1c66479fcfc2786ceb70930cd7dc7eff1005f8f41bc5eee3786a5bfb2ffcce71b7651ef129ac9a1380915f19b789a8ce446674511a8bbaad5c24c462537d6e15d1f2419746b6da10c6497a2c6a8a1dc8599d3a308f28bf082cf16a885b03408c4f75337fdc8e8d9114dc21b746b34c3882eebcdf79fddf3001b5af6e68d0af6bd2e8dd1228a8b512b6bda74f0deda3db7a6f3501283c8f3d6e17b8856d9d79275c31d5c97e2f57befb8662c78acbae5a2f5aaab951912f07d254cc4ef94ea4dfdc9f66614778525dc84d965b9e482a874ca1e2620603feb1193c440f97f9a633f474be408dba01dcd4eeaac3d54796dfaa741f42086f7738f910b2751444af17ce0e2089063523bca7a883f9c714f0c60923a8588dbc843e96deff82a3ad86abee11ca2e4f2f782905ef457a910e1937bd37e41a9a066d91d063e51df333d9e1c9c447fb7888a0c80d5028e75c70fd32c1434858ea11eb423852a34bd6e0ec29547382523058fe3ba0c36048b987798cbdcf970333cf3ad11be0eb6cb02442b15efdd96a29b2b01590d7b51f1b3599d04cc4af91ede52c42df434db6f6f7782b133aa68767da3d87e4a9153140c8f4f9c706375334340669f10713de3849ab2ead6abd93e58907881405bd9dbb1ce28f2f0365abe370ef668df770c61026a978e30cab4b3a44fe2a6b15bbe60ec9a06069082f08a88c88998ccb64a12afb7127be0812ede4fa706b12076fc07a3cd5a83bd6a5410fd0c989a219737bde10fcbf77734104d684ee9e3f39a555aa6b5c59834f831224d47a60d395f3b5c57d2f471b479994c4211bea04792caec38fe65bf307107a150c58859948d7cd7938ec19a918e3181b628ec6c2cb6f7b2845e00c2f5d77ae181f4c66a5fcbe804587f930f1dcc0b0afcde2bb626b0aa2f668e28717d35ef3e5e4501c4a654a189c894b7bd29e5be658b805e29c497fb83104cfd1b85d6b35a016d26a894f2170348145346f0a8603d1c1c52b4612ce6a9174723e1d6a4a3781c4c9193db374167e5a78c577fc158e44a883a61425467eb3b3f213e8280dc387c9825c42139b298387e0fc923ed19d28003b841fff92ef6cc945908258c1747f03f252cfde56590f2f1cb2479237ecc9522e81c7386501c40898495159d55708d53607da83393d5f50af40de419000dc36b14f4f7e59c90d5c5cc9cb3a89a2043b5a14fab6fe30f362a7b45a238016af38c8f03e2d32aee269fef54d417170c4af9125a5b24e0328bef1ce2df98bb6dd80484245eb774f8e5ebfa678d5f75ac71d6fb31f5788fdd6c04abc4b6fded77c96ac6d6c734ca69989cc1cbf2ae74608340a3e454f9546a92d2e14554aaf9b8e9e52832de987eaf7ae1e0304060dc9c31c92d10c218f8e8ed425d12be6c473ea31da69f0f2d28f5c082ac58a179df37360fb62e961ec3d763bef154e8ebf659dc55166f55744dbf27871b802c98205c12e6a2c9b33ddcb3917f7f30b3fecb70d868c16687d7c0175f1ae3bb5ad3e2b6da8c8bc89380e85286d718b45fca51fabf6ffa11d866948070fb10858fd4a389d64c04e1ab42f74b47e840ad1ee186e9c74a67c1c6a87687dc91ad38b0f648fe778c26b09a1a910cfef2976688e5647f5b34dd05f5b17f87e7508851da10bb09b47e11be849913cbcbda5dafe027abb7bd2f7643c4c065c7dbd1c4db35bd9e3e3c51c45a64440c5df85936525a24302b8870acd09a4cacd9c89295d71cce8b7aacb04f87fdc79dd62f0ef0fefc4c6bd97b5c8054c06c475e7716b3da48adaba583a5e14cf4b1b6f0897740d53e60de6bb795397bc591a2d42361da762a9c45f8c702feab626c7896d47bce0b298cd63d79659b04f599e6f3fab46055d45677e7bc6afc9d9dc93ea5bfeb72637db3b82d3e14edce1dfb6c2392a7159b343c03cd92e5341c4b8bffccfe7fc53472a8a7238c8e8d03dada38c4e0a1f0663935297729ed7664a62c386878a8b6265c2fc2de205fa89a37eb36d2958287ad04de56f1d3bbb1853888877491db5d6c6bda1d7e75c87309a3202ae891977610577a47ef6d5e7f22b2a7d09cf157166613372892cacb54a62e8f3233fde7ad0b6971307b249acb07f47b7e37c8e474746fd73c647f31d5ad3e71c082c12a757e5d72f8dcaf778e76cd504ab36322db6ad73525740f497ba980be1b4e8c4a433383b2c062ab5a7a8d7519fb34a705a62e2123542fddef35dd44e01cf378b5ac0e6c05290706a7755d1ded82d43558c61fc11c941b0563090bcac6befe286b4313dc5deaef3cf54383ece1d3d0e284fcfe862b96df22a9558990994a27541a00f1cd9305ba0a2f574140b68dc9445fd1a36505a601e0eb53fe3c674397835c6311fa3ee59d6aac283c1b1f3dbca9ad36e77755d81561cecc89eccd08f770a261ec410f64f3ca79a91f4b9b6c71d1d14594f1de640f3ad42046ca292fac2d9f8fc65d5c359f1ef17cefc0c09b3125944e35f1cef18baf029fc0b97402658750364f852ae1f0e291f05947513d8b5c1fd955a5092ab50c26bb52363218258428fe1127767461c6d4a4e0ed8d1c14a7c39d9d57b4dd49d2572a15d921f2c3c73ddcc2fdad9e01df2d7733a4e1b64c0169b3a95ad7dea56486fb36ca654bf9eae9330fcd6dc118c0e7affdbc80b6487668408173bbc8a284767109148eb5f631bcfb279bcc235de22154b7f609301ea22326297ea3d07e1fa5344ddb27a9887ea5b4a6fadced636bdc88f1c77a0c0383f5bfe1c4b26b24b2577a46388843d064bf486b247b236afb95ea1815ec9a077735d7d495e833f082587c83f9845f4c12c1377fca1b568dfcb039c7720392a755e4c5ebf51f3a56ffc78cb3daf79230b4ad42521447c0c5466088d84840e99441e5bda12aa3a856b8569a937a713ace23d32f31d0edf998148b496efa06ce097c9b8e12484f093e2d1b7ad37020c01afb54cf070f882f02e39e5f1f905859bba83cb14c9a39111e33b5dab6a46564787676e7111c52b38e1cf3fcc9871419af1cc6530a45f2e1d1623c9030bcd8cf4393ba9cc434341d74fcff03e62210c35cfcd7eb1c4af0fc014d18fe989813fca8d34f31922ea8abd7269403513a5dfbdfe045c476c28ff7f2c675e853b78679346ec7099c3eafa1a819f5db66270b58255560becf96ba5a4513501f7bb15f13ef217827a4679ba23d20d999bd3a864ea4ace4659c84701c367850ae752eb69b1603b9f5c02adabda4022704a7d218b33cdeeb95b9a7ec5d229313ea75a651385937a2d2feb08e9773d06275e62fe7e20ba06868211034fc336d34d2139729b3fca90c62ec6e7dee2730aa0a3b930b51e6af4a8ac0d60013de04835e189393bee10cde8b37777b2af4af230e2108e2f1c19750cc8d1b4608bfb4d74533fb9f3a9ed71bd77b81b954a8a5061d7dbdd9ec76073058f378117df0cc2714dd0715d38b99d999e9c9e9f1dc2ec44ba3794f5ffd1287f98c6a0d4d105e22cbcdb68657e6c9135492e384a7b8da7673a5d46ecef09daf487d570751261e8afef0f5dd0289e15087599cba173d6768081684e17eb61247a1a548381ac1e3542674e4e40fcc49618a607971d48813014176f03ab91e0cc39aba7296ff6ffb7d6e3c3015e918fc2756b934cb5758b87d2bff614158b08f0e7668e6e37f19cb4de66f6a8e34f5cdd8e8333c66c1f8e4a6fc44172ad108e16ef8580ca8d4eeefbc5de533263c0693f19c9f0897c65a3f8d5ca7597d28ffc6ca7fb5da20d2e34a49b7899343b11594c7829c7b15de1d4bfe45403acaa8b639652d1fca8af881c420d98d9e7ef3e7cbd738677ba814618e2b47a53661d17cc74b253322da072591097bef08ddc8d674fa9815df1d9b6a035aeb52e2cf3674ac1c1e9984c55509f46aa6307da3b162aa39737db1757b4e2522712100b83afe60cd6cd24998bc65556500a029808a510544d9d04ef4104056e7a661d1dfc3f0110dd74def71649afefb54f8fd6a6f28e5155fd869133f1965d7e49548883b3e78baf7ed738f116ba8d8f8dd5f74307a28b6b3de0388219ff3640a20f6b932e0d932756ca4599d3a49931c2afbb240d5c1d62f2233c94cd715f36430fde7621bf128ab448b65b9596e290203f892d660a298c830447293a345c030e670754f527dfde992d177484b521d11dd6aeec752c39b529b9cb9b2282bcf5c6d98ef64a23256980f688f8719e5ed44db39f442dd5a53839daf4cceb649a02b83d2f99f5f274087b45be7dd5042498ee7f11c6d0d8f8398a052d86efb1011e86409691ab992032dec8f2f66477539007937d443d4d7fab636bb3b74eb29a0087aef897e9cd8fed043dd9b046e6221b55ce829c68c04659fbbd297293e1071a02866cc5a0dd72e93b7dfbb3a5da464c7d9734a121d8e001493a88bcd78d3b0ee7cbedd2a43c1c95cfc171e4a05f31ad8ef0405857c416493eede78e2b03b8a0a0c65b5d14d985c91a1b93239485483309446e6ff5e4248e2df0fe3bd72d69a2963445142656f1801af13c38c5ef02b309b75a46b1c2a653025f892702df24e6229073bf7a8c0bbf35e4471a7a1e589b48f94d5f5f894cef5a0a62eeac6a641949e5861f309a8da095ebe822f19000029bec7840f3327a9dc03c93a05294e8889c9b19ad2a773bda2632a4a5a321bea9f86e3fd51e590cb6aa894a391f573bddf36da09500b20fd2ed910c36105f4a5901158b760f2967113af61780607c94d74972c1e9d72a922ff248028a11ea9b7a11dcc182e05474bab452d5b095f801586c791ad4872eafad35d2b64f022ddd45117fd482e30879b99aaf0275ea0ec9a7caacfc8f5978919b282604213e0ab90830776d5deb763f834fab5f84b9e203819791d822478193935556f204e664acf7788d874cc6b1c22f7043834627fc3fa4c2654a884454fa0d2d47f95cdb9c00e785edc4810b97ff0de26279148bd954abab176f7f0e7203f138105608858f0a9448d302fc295a2700a4dd0512575da30e7993416d68c30103bae7a128557476065f3b779ec9543c5593f1cdc7386017758387647a0833c28dad3371bbd76e2b798182a1de7ab5fa39bde26df79aaa51f29630bf71787331e256f973fc94850573466b39a2b2df541c352fdee23b130911caa86e6d2c10874373a7493a27f99808ebe9cd581206da0308e999f4f1ac3e54f41a17ce5072e57df7746f495c1c1a2f764d49554f9fd29d4851a898023514cb9ead3d1e2b5e5f6b014b6ef56ef03e7118cc32f9fb2782dccdde13c982216384c366502b78d34781e0e238239569a9cea512cda24c6a9e28eb04c61450844ca1bdd13ad95a9151091975960da9d41c6df01977555332f031f2364c2d25ef2190c89df739531aea31f1e115cb015a10acb5c3e9f3201f260363440eb3f78a5a98a6d2eae21ad5137239db0c47e590fb506ec0d6c3f345232c8810221e163b87655f07a1d268f866801596055f97aabcfdef0e71a2b3f301021eea99d6818d0d921e60186429eea98a4ed9d57213f9ccf18ffa7d7cc628d731dccde0588163c78b669c7ede0a11d9b794152fba544bf53f6a7f8016f7b"}, @INET_DIAG_REQ_BYTECODE={0x50, 0x1, "fb5e0f363923837107fe1cfc4d54adbba82adbf269850202d62a01913bdd70bf4fd60489afa33a0ca289ad4c8bf742d15f76f76850497f94323f29ce220e36812226f01646b9192171aedf5c"}, @INET_DIAG_REQ_BYTECODE={0xf5, 0x1, "99c7d192b2f164f9a24a0b4790a4fffad55b3ffc83bcee6f6d64598e43b3281c2e6aa2e4feabdeb154a6a8575273dc7410ee312004c2e582a1c534b6c90ea5ff861e0866b63f68a19d2f5d4b2ef98214a3ca677ce3fe53607365b3cee18a7ad20cfd03861f3cb3c8ff91b6d2ab85cbd3aa92691206bda75c4f6cbe9c002ff4af7936cdd85fed1c856443d7c1ca10dd22b6f4078f46485b088b674655e79b7b6acdd591e086ae994045b97a9f21cca54b64e8b7029f1089a2999eb29f80b9944cb6449cedbeaf9ffd3fdf4e4a43d06dd9bbf79df06cd5c3de9f39ccaf70133fe85693474c79bb2c0f2addda259792eb225c"}, @INET_DIAG_REQ_BYTECODE={0xa0, 0x1, "619709456803cb43e4c8e77b1a4e6e1b6ed7b3e17f787483933d52b1a56395a74aef525ec137e69302e1e7e8032c226e669d39423acadcd63f557aa008e7b639132972b4cbda8cca7610fa3f5dfa29898f65307681170f17e9caa2fc1b134ce87db12fc7b6ac0896c4db82cbfff23931836392881890b3e96cec1986e2f9b56e626b1fafc72f5c9b6cde76efa7b239bf99bd86a0ff873fa79a5903a4"}]}, 0x127c}, 0x1, 0x0, 0x0, 0x80}, 0x20041010) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x4e21, @private=0xa010101}}, 0x0, 0x0, 0x35, 0x0, "2944337b82fbc440989f9807a0accc3472db5a31b420bcdeff5e3f089f47e7f005c37118bf2286a8c0c5ce804cae94576c8ef1aa8c75c2a16a5038d832833cdd62b36b213e080db4f885e33902450a19"}, 0xd8) 12:02:41 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) epoll_wait(r4, &(0x7f0000000040)=[{}, {}], 0x2, 0x1000) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x4}, 0x6) write$bt_hci(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="94c4003a0d0800000000007ae1d0b30ce74ca208918571881607b0bd7039642423926296383d52f3a9b5b9187003c6b022892b20858847a8ec3ec50c91e00567ab422014da208ac8bde829504937b9ce057831cd5f5ab1c1b84b1ed2742938b7ada319183bcf442c1410547171f74aaf7fa657aace37775b91ecb852b99cb0b0e6867444f02768c0dad0ebec2cb2bd7043f5b5cb9c810497eaafeea47de3343694cb7d42315a6e765920f42e483bc8326d7ea059c4b781bed27e4b249f4cc1046ab74e17e7cf53c55a77e1977b3602d508cef74c4d6a5d3082e91b2cfb76f5a6d611724c02485d0de18243cd29c1d9eb6b9e86cc17d2d0bc31e44e803988f26dafc7715b13024547a9ed14d0f7229aa83dbc13ea932da29cc7e580e8c9eb48f5cb00986a7fb43adaef9619aa862e142e8cdcb05398893452a23048c31712229a1b69aae9436b2d1d23b0452b41e4e9c472f97274e1e2974243e1d554346e5843afc00bd8badb86387e0bd293b1427db8c90a3c754905027bab2935d685daf736143a1cc6086d33989e8538f53f14a8ca4014947b73e486e02dbe85baafd602170a47c2c1258eb9f1bce9a594b9686fe905257fe14354aa0efd8198b7bb358e052dbec0d4ab67978734b84c99236a53812e87846e36b0c2c4d56079b81533bd6cddf454ccedb7ce8186bad90247c69fe173ee41b8a6834e6e9c48185c8a42b9bd2f13534326d95a9afd71cd34b7fd5d81de42a386805122d6da41d600"], 0xb) 12:02:41 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x4, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:02:41 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) (fail_nth: 5) 12:02:41 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x600}}}, 0xb) [ 2268.954807] FAULT_INJECTION: forcing a failure. [ 2268.954807] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2268.956729] CPU: 0 UID: 0 PID: 23105 Comm: syz-executor.1 Not tainted 6.17.0-next-20251003 #1 PREEMPT(voluntary) [ 2268.956759] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2268.956771] Call Trace: [ 2268.956780] [ 2268.956788] dump_stack_lvl+0xfa/0x120 [ 2268.956821] should_fail_ex+0x4d7/0x5e0 [ 2268.956853] _copy_from_iter+0x1dc/0x1660 [ 2268.956881] ? lock_acquire+0x15e/0x2f0 [ 2268.956907] ? __virt_addr_valid+0x1c6/0x5d0 [ 2268.956942] ? find_held_lock+0x2b/0x80 [ 2268.956985] ? __pfx__copy_from_iter+0x10/0x10 [ 2268.957008] ? lock_release+0xc8/0x290 [ 2268.957038] ? __virt_addr_valid+0x100/0x5d0 [ 2268.957073] ? __check_object_size+0x57b/0x880 [ 2268.957104] hci_sock_sendmsg+0x402/0x2270 [ 2268.957139] ? perf_trace_lock+0xb5/0x5d0 [ 2268.957169] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 2268.957211] sock_write_iter+0x57e/0x610 [ 2268.957245] ? __pfx_sock_write_iter+0x10/0x10 [ 2268.957292] ? security_file_permission+0x22/0x90 [ 2268.957330] vfs_write+0xbe9/0x1150 [ 2268.957358] ? __pfx_sock_write_iter+0x10/0x10 [ 2268.957389] ? __fget_files+0x34/0x3b0 [ 2268.957415] ? __pfx_vfs_write+0x10/0x10 [ 2268.957467] ksys_write+0x1ef/0x240 [ 2268.957494] ? __pfx_ksys_write+0x10/0x10 [ 2268.957535] do_syscall_64+0xbf/0x390 [ 2268.957564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2268.957585] RIP: 0033:0x7f72d3822b19 [ 2268.957602] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2268.957623] RSP: 002b:00007f72d0d98188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2268.957644] RAX: ffffffffffffffda RBX: 00007f72d3935f60 RCX: 00007f72d3822b19 [ 2268.957658] RDX: 0000000000000178 RSI: 00000000200000c0 RDI: 0000000000000004 [ 2268.957676] RBP: 00007f72d0d981d0 R08: 0000000000000000 R09: 0000000000000000 [ 2268.957695] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2268.957714] R13: 00007ffef9ba9c9f R14: 00007f72d0d98300 R15: 0000000000022000 [ 2268.957751] 12:02:41 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x5, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:02:41 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 12:02:41 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xf0ffffff00000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:02:41 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2000000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:02:41 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) (fail_nth: 6) 12:02:41 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000080)={0x1, @le_set_adv_data={{0x2008, 0x20}, {0x3, "d9ab4b7d3c461d6c2447afaeab3c26a3c5a8e0329597636d49fd7f55675151"}}}, 0x24) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) 12:02:41 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0xa00}}}, 0xb) [ 2269.239453] FAULT_INJECTION: forcing a failure. [ 2269.239453] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2269.241177] CPU: 0 UID: 0 PID: 23203 Comm: syz-executor.1 Not tainted 6.17.0-next-20251003 #1 PREEMPT(voluntary) [ 2269.241205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 2269.241218] Call Trace: [ 2269.241227] [ 2269.241236] dump_stack_lvl+0xfa/0x120 [ 2269.241273] should_fail_ex+0x4d7/0x5e0 [ 2269.241308] _copy_to_user+0x32/0xd0 [ 2269.241343] simple_read_from_buffer+0xe0/0x180 [ 2269.241375] proc_fail_nth_read+0x18a/0x240 [ 2269.241410] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2269.241442] ? security_file_permission+0x22/0x90 [ 2269.241476] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2269.241506] vfs_read+0x1eb/0xc70 [ 2269.241542] ? __pfx_vfs_read+0x10/0x10 [ 2269.241571] ? lock_release+0xc8/0x290 [ 2269.241603] ? __fget_files+0x20d/0x3b0 [ 2269.241643] ksys_read+0x121/0x240 [ 2269.241672] ? __pfx_ksys_read+0x10/0x10 [ 2269.241713] do_syscall_64+0xbf/0x390 [ 2269.241744] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2269.241768] RIP: 0033:0x7f72d37d569c [ 2269.241786] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 2269.241810] RSP: 002b:00007f72d0d98170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2269.241838] RAX: ffffffffffffffda RBX: 0000000000000178 RCX: 00007f72d37d569c [ 2269.241854] RDX: 000000000000000f RSI: 00007f72d0d981e0 RDI: 0000000000000003 [ 2269.241870] RBP: 00007f72d0d981d0 R08: 0000000000000000 R09: 0000000000000000 [ 2269.241889] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2269.241904] R13: 00007ffef9ba9c9f R14: 00007f72d0d98300 R15: 0000000000022000 [ 2269.241940] [ 2270.874038] Bluetooth: hci0: command 0x0406 tx timeout [ 2272.922025] Bluetooth: hci0: command 0x0406 tx timeout [ 2274.970069] Bluetooth: hci0: command 0x0406 tx timeout [ 2277.018063] Bluetooth: hci0: command 0x0406 tx timeout 12:02:50 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f0000000080)={0x1, @remote_name_req_cancel={{0x41a, 0x6}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}}}, 0xa) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0\x00'}) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 12:02:50 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x2010000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:02:50 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x6, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:02:50 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:02:50 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000080)={0x2, 0x1000, "541001", 0x9}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x4, 0x4}, 0x6) r3 = pidfd_getfd(r1, r1, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000200)={0x0, @tick=0x3de, 0x7f, {0x20, 0x7f}, 0x1f, 0x0, 0x1f}) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="fe08000000000000000000"], 0xb) r4 = openat$incfs(r1, &(0x7f0000000100)='.pending_reads\x00', 0x20800, 0x0) epoll_ctl$EPOLL_CTL_DEL(r4, 0x2, r1) 12:02:50 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xf400000000000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:02:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:02:50 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) lseek(r4, 0x40000, 0x3) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r6 = epoll_create1(0x0) epoll_pwait2(r6, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000240)={0x200b}) r7 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r8 = epoll_create1(0x0) epoll_pwait2(r8, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000240)={0x200b}) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r3, &(0x7f0000000040)={0x3}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x10000015}) 12:02:50 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xf5ffffff00000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:02:50 executing program 2: r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0xff, 0x4, &(0x7f0000001280)=[{&(0x7f0000000100)="1f464350c910be03ba08122ca755d8a00459e1834d9a31381f31de269ad6731ab2cc2543711760892848d0379f6de904d1", 0x31, 0x8001}, {&(0x7f0000000140)="c8104d67c65cb5c0ee35fbfcbc3a0ca92107ead1de8117e9d53143ca4214c2db1d8b80375b5b78c18550c583654f17bba0a6d2f4d8e9a4b6a991aa3a4748de6ff04b5c5fb0645a6372af7af7b510cc2463b8590db1d7833830bfa1090d97b2d31e7a62f37815101a7693", 0x6a, 0x2}, {&(0x7f00000001c0)="b5a9f47dd52b5e52cf57cbc08a79c98f1f133a68b89a5d989a51e91e56eecc3015b7be29d7342c5f16cb86420c3a201af267847e1cc6c2a8feeebf2f33576c97823b9f8c7c8f426ff070a3170fc6e425855f4757597ec22b6e2ae00f9271c069ff37ec13c59d66cce2f3d6204a290bec9d7af24adb1297195fa51cba1eb7bb001850c6383072c1403c2a7dedd4f5dab0d1a3ace4ec156d9c745312", 0x9b, 0x1f}, {&(0x7f0000000280)="a7764c73d8851f2dbeb763a3cc9148ff8e4c4ed45a5931149f56e38ce0b0ce747ac0a09e7d71a74411bb5c8eb4ee827665e5f1c153ae7605a2edc9fb660e65a405e5758cb7e2f679b1d40dbd025161ae5da4b8ab0b1ad3be2e5491d37db96b93bffd011f39043e86d0adaddc60842a412c6983cbe0c10258354c1b33df58eb6cebf577c04c0673282664a3c4b6f9f1c06fe14de4d5c2e88f20ccfe867b6fbfc9a5117e040afca5c5eea4619977b65c149bbfa6f8848555e72eedfa5f1241c9517420acdfb91c7d62e3bf37bcfc81cf021a1046df266b1b761d82c6018b127770db8234180343556e0d0d73ccfaa0b5e02b5ed2281c159f7253374bf596a004a63f1601c0ddb1efdbad2fff0de0af99d476eeba9c3ce84422e8c6c990472269e903e72ed121f48b6934d0340a26b724e82647e5e30f95d1306c5a8c932e22d787477bc09f87041e456b0cb5da49ced4c25ac6d4aa87b39e31855af614a8d42fe2c5477ae9efd65ce7800a711c53b515c70c818251e5bc6a8e9d8c4e54af545c13e5e21215761b084a36a43c67903f0950c74e68263a43bc83f44bc75b1ec3aac844a8120c86dfcf7f41f4eb78e96fe8d5d9bf87112bd1aacdca0a3f17426b343140f91276504f45df61f87c1a734da982ebd1b94731a33bd350b0f04d73baaaa63647705dabadad27b03d9db8690f9194379e2b3207c27388c679a4f5089a2c32706ecdc299c02dae39385dd154def85e25024170ebbdc1814d6d99ff44ccc25e72dcbb9d9013098e4cf3b2660b3a6d45fb9a018d773daea921efd14d5aedef555be787220d8d83a626470b5d36db07c49cb41834f299a81eb2360e62b0ec257c39a639ad30a6e15de8e9fec3a5f0d3bd2e131bd54320eafb3d649651cc22299087ac1f00c28c017b4af91b034231cac2f9d6a366c4ec20aa3800a0a375f5e40e363cdb1f0931bc6d580108caad7f71076dfc531d26599efed4d2c769325502a8d2dbdec0166a587b7b77e79f9b6dac609bc3c5f33852a87a2b7d2c5c735fba94786391054da4cb6237f375a646647a1a88832c451f933ccef4afc4192829d936a5b5a3362fad87612c27121bac64aec7f116665148eea75c9c34976f121e2f6c7ed1e2fb8d681fa5418429958014cfdd6fb9bce109ab89271113f53e7983aa49c830b305d1ccacbcb794bbcced0fce1bb32d10a337ac00d6de723ca1fd3b8147db9d75f5e6e275554db244ef1249c19b6bf443759674c9ca24b17a45e50fdad6a55de53cc9ce8a1ecc726ebd09f10b50d76d8f2f9594bd6ed6d68d49251ab8123db9752a6be2328bb7eedaea714ab83ed40be763d3a86242c84e16b19edd62374ee8e543f383401e0845ef1a1f471c0f29542cc47d80f8f607c9cb96f4f8809242add93b0e419dde1f67e4bc9b7caf81e3e08acc490927bfadff4f936af02dbec29a90b225ef127ec2df27ae8810feb3f52dc7ce07d97a526c6c3e5587e096eec1038db6a18dcd0954194e0bbcbba11b3d3718139ec83c705531d29c4f2bbb0525df16678fb7d33a64aecb5e4d0b17e2e7f363bbc7445572355b8ac4661a423e8980f0a964655b390e3b439180f599a6491c0d61b2a764c2c3e7b189bbd5a733782692d4899f0316bed71885805354d671a7ea5d7a7878ab0e9ec0c8abf84666375e8f9dbc193ae3b5e134c4242ddf55c755ee68c41300e5c2c6518ad696c7f2e50eb81709b5064a2bc611bca2729a914b69bd2863de7e7e839e97bb3c48d7a3bb4955ef507efc42f022cc0ec8bfba7968e5149d282eecd5dec00a59b27f8be6bdbf0093fd05777fc1b6c9fd13dcf79aba16b8b70bc3ede7518a4959038bb9d08ed4edde386054f6c9530cdac2344031b286f6c5094a08f9868075c26a764f197fcf3c65b8692a7464cad81801c9454389512536facb85c8e929c7f4872741bd978a2992684fa581994876372915e13355f0d238970bc1f86ea6ab55afb06217772c179ac9d24ca547ec7c319d8ab216ec34089b7f13c61429b31591082a9c1c0625acbc2a26342f40c96aaed87914f9934702c74abcf01955f18332ffa674baf23c4bd44a3a694e9806b563d3973232e729834f8cd37f2afca50cf7cb7c4840ee31a687f7eefc4bf0f15ba0ad4899ae114b78eb840decd2197d6cf22980d1f833de107f7f5bbaa3c4b9ab7ca46abe5ff1a422d33c5f473fced86768da75144683a059ac3a4ce2f52c40a568a01f9ae224bb986b5e30565cc095ea00d243c683df8bc20506a62828606b3d113e1af833f9099b856fe028d873b45e42082e8808de19044a250d4a48a711d74f0585da37ea5f59316be3a212eed79efd17bf03a237e2a774c565151611bdb1681051cc9f4e8f3fb5630542a2d71989cb5d5990d8f6039c9752534e2bc2f511639d1f0c841069e074007f986a8acb8ed0c81ab79e7a84f1662da5f6fe5598830328984cbed7009dfd7caefc2c35498f71387bcbaa5979fd0dee8fe93e01142b8c4b2052bae7d98e21ff6f9a0ae9b1ba0699f3aed10da1e83504bff0a2b34e41911f08d5984e2147d59280417c69154481126b5da36daabc2b8942aa7306e09409da75065faf40c8bd8ab9cb6594c4fce2b177c3562c7aaae9e95a73467e8da4b2bf8dbc2f68f328eb33f37c07e86bc4ef91c900b5f2fa9d988be65fea8e3db1711e00c9431e97d1100e13f49bd3f16adbdbbe55680cd83d9191c0da6b66fab1603258f1b6292ea8b1becd5e9c97877f1cdf606a4b6e8bf5f81f8d7aa66caf318a95a29d192a1b399763d81b38558ae9988adedda40f39fc48c3a50032b30102b7e6a94e0c8f4dbc8872ee9d64a500ee33b38aafc4eaef9b67d0c9544419b27b2dfbeb92b8df62157d21b5a412f116a633b7e83c58df9395b848349edad4535f927faded42190f6932f1f4d846933680403793c3c8d599f6910ffbced9831e781719459e44ccf1f948ff096ca61913d8608523b5f59056c8c0ab8704bc57f064a92a4a26d4a1a5652ff6d62d8dc4eb7fcd339186f00d7973a846ed9640c093e7695a5029f25a14cdd9f8d3252ec3f6a58be732464ce377430b5df00921db78590bfa75a17a23a4439cc2e81d9a0150fa84a3f8dcd141eb33af57e7f5bf07d499bd36d79464540a1164d84765ed5acaf23ab91eaa7c332e665fa5ae21c3492cdaee1e6416c704686b682c65b8ee0951ff1a77e94c85ef36c282ed8704af215769ff848029fe542aa4fe6d136b2b5da27ed9878cc388bb7bfa68d06fe06708027a4353c46c4cc2bf079537e09e29a6622427ad374c68c60a7696d8e7f32ddf173aa8d984519ac8729772400c280423138fb193e4eff8bec9ffe8d8e8476eba449f2380d8dd9dce1f77c72f4592ed6d11f6fe9dd81b33768ada69eee778e0db057c9fd60929d411554e0628876a00560415fad4b7f3979c1640571ca2472c0e57ff7f00ee92f58dac35cec428559de5d75a0a83bdcccdf4ce8e2df7352f9b27a603ba12602744c56ad666a2d4eede2acbc32b87368c865ef1a29d4a3832f42b0c3c103a8261c913043e74739a49f4b4b407b5ad73cd22a041f9fc2806d11ee9bbb23173689f75b498e7814f4c249b36a073485feecb988a4922c38be7b9d7da8f2d147b24a5eda3f5135e41eca735f1f19b042130687b86be08cb3b3813522aa81a0ad1fb43dbb58392e985764c982ecd4aed3289493c8963da673c945041b69f418b9c259dce5bd346209d7cfb38856077570bbd31bd3164d8c0fbce206641cca476ab8a1b3443dfbdcb5dc62e0c165c46b33399d1fe6d08e75e02f661ed1ecf1c2f3f73fcc089965f3f608949603fe7b885a2b6e3234c556ce155c8e4ac8d4a818454a9926d7259fd850324c3f386a773364b985135be38121d543915ae7212351d7bb128e79b2ccb9b707066f5ead097234380cf444157109b647cbb256d0ec0022a4eedf0c7e3debbe545a0d36ee44056294f39e161e8473f68450b2b70d05ea91ff35320a29baefa0bf1d514a2cdc9e63226a0d91c0954b80c62b0f162cbe0b96838f86ce3f1263531f3271da32ac291f41d813311780580718a256df097ccce6e5c879d662e61477aa7c0aee33478c81860ad584a553c17907de3033bffa4cb1b780af37c39f90fa09af7c6c966f352aef7f3e13eba7696b351f40d235104203885349a71047b276a2afb8400ae80af142f6bbb8a897e3728a7f704a5df0a385e8053b243c41d9b26e8b651be84481e5d6fdd09f84dc3ec6c7b049ef903464a3f756c638a0c3e3aa5be396bb3880c0ad56f48c5fddb83e73eb89c754dea509712d6765df07625d4c3b91aa1fdc71843c0f71be2bf5510d5f114e1c879729e52b75194fe4b384eea13562435f733fbe5e0ac7ab1114538f8323ee60020dede036993efb3de5a7dc853565765a66a808d2d355a98aeddee4f3b031210d8565b36fa949336cbf9f954cc95255c0d63df2cbd39f511e788f2ed2f347f9b3d1148f4ecbe4e514d5eb47d0438b3d5f5d703c5fc83f490b285043548b4ec226fe470c44df2d2a864d1a3fb0cffe922da6d3e37a981c1bdfd4c6cb7bcbb6bb124413a1dd5b1fdc68fd1a91bb423e07d651d3616f58f3d84161b84196a474ff71d63fbf4a978a421e8b51920b29b881bfa40b67ae41074da6b716b403106ab583ad0b74c7dd22fd25b5c1ae3708718dc5c0570f34ef5f9c2b25d577b9da866a8eb7e4c6ded53648e3bbdda14f9b407686feda8eaea088652375d55a323280597472c517696089315dddde0a9699934d0d1b802218338d8300beef6e2440e7bc473666cabdb1b26217c8c99d395dcd680f518ad85853476f41e1339619ad7c0952c6b0dff1f105997ad9582fedf0449216806f87a1b8d976a5ba217c0e0b42915a1d6916cfef4f0d782d9ba362870d1904c327665e2cf25e42069511485316ddab9a73cad93311f27ec5f93e65f7c694fe59c09527e8309481ccbe93a9998271c7c09e8528fff83babd102b25b3610d185d11b5a9ec9c5ae2db5f4ccc71a6a8ab6cff60efff18abe6dfe699d56a2c8bac06bb80cc7be98dba5bda94428b688bbebb673ece73a1a83c87d0f87e6354f9252d349da9ddca5c5ddbfea94790fe53006bb537e860576b105f7598fa625d93b91f543626e5dfcd91f061c41f61060f81bb215014f8fa96c9a731c3ba9c5fb0788c8ca92da2f7fde6778d618ae877a450f2936b64d61933c12c6dfe4cb8bf0db7c92751edab9ac26bdde68eb53cc5056900460a610e0a4175c5d96a6a173719d07f2163bea2588d9eb57129f63a3a81a9e6a86870fa7505f1de19be1ea9ab8e7a3e99d3fae6884206afde4cc31bde17a7602e90f610ccd557a6d048ed724c6d1cf380cfe4d68390353fc24573d99f847dfdced5039bbf45bfb37e5a58cc5bc98319ab360970c0d6a8324b9d5591d6ddafed40d8557d79b01c8b05f549666be5f0dbf27e335eb026be570be962c5b24c17882828462181ec4513f51f5ce3181a4e40222f1cf9d432d782cab6ca010db5ce89d7a0b3f815b229ee0b4535a67ae26b872c149e0af1bc4926ffac616202079cf7d8f99680078638a352a15b3fefe0133d9b7e566d5c6c6a1f81102275bd5655e31a9ee8f63fafa048be8ff74f7096d62202688e9ae63b4c63bbbbaf7992fc8d36eccd3fd9c97a092b4e45bfd211bb76c2942deda570692404177b59f66941bbe64b98f30b4020f09c32dc2bc864007fad59a8ab83a73630f9bd9128a19c620ef284edcdd9c65b130ffaf96ee3aa30d1af7334b7d2c1a466", 0x1000, 0x40}], 0x1000800, &(0x7f0000001300)=ANY=[@ANYBLOB="756e695f786c6174653d302c73686f72746e616dafe37d2776570e290b653d77696e39352c756d61736b3d30303030303030303030303030303030304000000030312c757466383d312c726f6469722c756d61736b3d30303030303030303030303030303030303030303030352c73686f72746e616d653d77696e6e742c6f626a5f757365723d242c617070725c9273652c6f626a5f726f6c653d26e33a7d5e2926261b29bb232d2c646566636f6e746578743d726f6f742c636f6e746578743d73797361646d5f752c636f6e746578743d737461fca75f752c7375626a5f757365723d2c726f6f74636f6e746578743d756e636f6e66696e65", @ANYRESDEC=0x0, @ANYBLOB=',subj_user=$.{}+^!,)-,\x00']) tee(r0, 0xffffffffffffffff, 0x200, 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x2, 0x4}, 0x6) bind$bt_hci(r1, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 12:02:50 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:02:50 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x8, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:02:50 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xfbffffff00000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:02:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x2}}}, 0xb) 12:02:50 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x4000000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 2280.282130] Bluetooth: hci0: command 0x0406 tx timeout [ 2282.330053] Bluetooth: hci0: command 0x0406 tx timeout [ 2284.378265] Bluetooth: hci0: command 0x0406 tx timeout 12:03:02 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:03:02 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xff2f21228c7f0000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:03:02 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x10, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:03:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000040)) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 12:03:02 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000040)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000), 0x6) write$bt_hci(r1, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x801, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) perf_event_open(&(0x7f0000000100)={0x3, 0x80, 0x80, 0x40, 0x20, 0x8d, 0x0, 0x3, 0x8400, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1f, 0x0, @perf_config_ext={0x9b, 0x200}, 0x1200, 0x7, 0x1, 0x6, 0xfffffffffffffbff, 0x1f, 0x7, 0x0, 0x80000001, 0x0, 0x9}, 0x0, 0xf, r2, 0x3) 12:03:02 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x8cffffff00000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:03:02 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x4}}}, 0xb) 12:03:02 executing program 7: ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000380)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1b01}}, './file0\x00'}) ioctl$TIOCGPTPEER(r0, 0x5441, 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) sendmsg$IPSET_CMD_DEL(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000040)={&(0x7f00000000c0)={0x7c, 0xa, 0x6, 0x5, 0x0, 0x0, {0x5, 0x0, 0x4}, [@IPSET_ATTR_ADT={0x40, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP2_TO={0x18, 0x16, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x6}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_NAME={0x9, 0x12, 'syz0\x00'}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x9}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x7}]}, 0x7c}, 0x1, 0x0, 0x0, 0x1}, 0x4001) sendmsg$TIPC_NL_PUBL_GET(r1, &(0x7f0000001800)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000017c0)={&(0x7f0000001840)={0x1498, 0x0, 0x20, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x16c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1000}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5187}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2d}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @broadcast}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x7, @dev={0xfe, 0x80, '\x00', 0x13}, 0x7}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @rand_addr=0x64010101}}, {0x20, 0x2, @in6={0xa, 0x4f23, 0x1, @dev={0xfe, 0x80, '\x00', 0x2e}, 0x90}}}}, @TIPC_NLA_BEARER_NAME={0x16, 0x1, @l2={'ib', 0x3a, 'batadv_slave_1\x00'}}, @TIPC_NLA_BEARER_NAME={0x13, 0x1, @l2={'eth', 0x3a, 'veth1_vlan\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @empty}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x3}}}}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe6d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5a}, @TIPC_NLA_PROP_TOL={0x8}]}]}, @TIPC_NLA_LINK={0x2c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NODE={0x1098, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "6b5b767a4e7618a9ffd4a836bc3196271118dcb9091c9f7d"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_ID={0x1004, 0x3, "703fc21b9f008147cb70604458ae07f3921a83ab32f24d6b3c82454c26d1fa36922325d11ce02d0f3ca1004524f1a695a38ad3845b0aaac0bff64b3070e662627762b7a78f159455fe06c5b73dca162665eb1aadac6025f79ac744101b6daab99ea0c57022f05bcbda07224abd280a85cdc7653f886648bb2f008af1096a6cbed16656655810d3cdc2d81c4aa274fa7066a8af7ecfc22445381daa52fb869cc2dbd8aef57285bd55a8af6414550480c1f4cda5dbb3f414b6fb7da9afdb41e85df31cf3c024a0318ba505c5d79c8b97554e3a789be3ee861fb49fbac6262fa2c884bfe18b71071c362b5f9a187c80a6ac929eb611648ae98cd35c2df9f3ef4e7571b30fbb8ef8436b9987fa10a7fd0870ebe966490c8d4739dd7819b27ec75f837563d64e3f066fc88629fd1592e9637dfe0b80c4c8249cde41887a95613b9b1a5dc925425819a6eff46b1bffcef842dff0d98d2b2e4c01ffffa8d56d46d0cac01940ef60af765dca172e016cb1962b955ef1240f07ae1917aa10d699303a69c95f2cac60023d1606dec979d74ed3b6b10ea393bd19c13c7e2df822be3c3e8c8a5cccec01c29a6cf626e82aa2b18d8920e5d1cf099887fe2e08a17ca5bbeb97665a47302508a40e913598ee18960d48a8469ff878d58a3fd6b70226cb7b6160cbf72a7c0ae103b5a0b52b4848f38af539e9341417b945c3f0f6acf1670a2492e437aa34b8d2ed9acd67e953e416ecf5e8fdfe1bb9c3c0e9caf9969572b6ef03c1fdfa4d7053d35df09efcba1d4a98f729469320c5cd21b61c97f285738fe1607b27fde028fa8455330553a0564f6a583a9888b41252f308cbd1089ded0ad214b21eb2f42d2baf94cc7060ed2d1c4dc45dda9ceb2153fde19a4c5c7b273eabccbdb883c340ef34bd56b9ab55fa8ad7cf0d5332b0076badfdd5fd29faeabeb0362d14c54b22d2ae173b85f2af5f895265f176777a9862e79207bd6af9450f5b4728c0aa41f2faf352d9352bec3acec670652dc086b88c51603e92c089f88303cc1a0e9d055089a85802aed44cc94075d1c674a6a94ccd0649eebd607e44ce8f4dd111982a879c779a6b9f5bc0466b8ae686b2dc86e8ace7a4964b10982e26ff4ae805f1be3f5af44b8fcfbe6d32fe4d4552fb7596305ed9f2119058c2e04ded617be8281e91cce957e17c310a01f4368ef31add0f44b2e310298f324c94459de0c9eda743420a965fa253cb1845ea1242009c85fb01ba72e871448a136bf57cd13ac1b1ea2b27c2c568c34a710e11a129cbc939488b658c12ffde3341b73625f12dd679750821129cf1401829c8e200902606a1f0796ed3ae16e45a60f63053137f3265d8290fc0b2a936bfd7aadc3af0a51ae4ba49a0130bfde90cc51d74388fd091da2189f6a2573e070b98d7cc39b5dabda15a1e12c62685fbd0928908cc002e9260a86be639fc70d6e8022fd257b032a2e1a2c30e9ba5a30d1c007c3102f041cde3028f8cba79da2e39292e3c6ea89088fd6993ca9acb0392f68ae8935e193d7d788078341479a83dd9a0b66b43264ab0fd40d8d78fd94e8d6d981526871ac59e4e95e2324db17812e21763813b86ddc708600703f4605838e83ece34eed43ffbe9f54ed41763866dffa85d04eca517cde177b74cdedf5c5a48be01ef721c50c8a961420fbabf18527f8a90228e6089b58b8bc8fc29dd6df9de06339af7b3afd8fbce1b28039f1e77d1887c43f4b1ed1b1d872b27f15aff05b1e61555a8f8a929dd25a97e5e69c4a93f064ff44445e30242e28d36f377546801f557870267c99f08c42dcc2901ac78aa301bdb6ebe77a50cf90b537841badad02e128a198071dde3d39cb66174dbcff957ce42a2681e01549c8ee0edf80b9bb832ac320888b62d8d4ef23c239c7ad7dfbfca5e65258de426c44d7e7e023709bb1e6f46b81437e2da84dd5071fb79a94eb304a00c0dcca2243742c9d6e4fc88aa113d63cb238bce8648bbfc4e842f16a51b3c1c7a40cfb491195428c729f3df30e0f54a65688e40ec7343a1a3bf5b8e654ab3377e65362dd8ee14261fe44e4a9f13cf2d02584e30f9cd965e5bcb31391123f146ddf74f34d4fc898e1074e4a98a3d7df8142e729f0549afeeec591e4977c0f8b67e73c2e272688b36915d48f7eaf63d75e5721c5c784a039fd3e4b86d91cad85818296e6a908133017a40e506d8a0606fefedf0dc7d3608cb05227779b17a0a4c7bbf9a56972d73afc15f5ee79416cc07d172f9f823dd9230372b0017338fffe6e7e2465888ac61b863a9974b6968c8975e93b7ee8c92ab867aeed9200ceaf0c7f6ebb619849d9378f5150996aacae507904ddbafa4b3c3fd42b11336b2d94dac0b5cac8938191255c7521625a18eae9b35b7bd4834094e68a26f67cc80e64c3871af188b80c54ad37af24dc9277a703a52440485c3ba2062d898f6316203950ab4e020579100d18bbfb3041a77e058df1a1df3382923d1a1f197e1e451e8416a9e2cfb5316bd958dce49b4660879b06ad2cf3c6b43b57745f5a9afc7817a18ccd66e28a7e740472c7d40de9773c465cf0bc7016939acaa36a199b7b78e55e45420dc090e64a95ef92504282860c6d0b24424e9777b41abd21986089deee30a104db5753bdbb11485a88c93020c8b17014eb0824e1cb6788aba0f21427c84443756d538c4e797e624c735c9a94e1e750a4767c89aec2154f4edd1e402ed790c876faf4f304b3294b1f64e4ccb695e0c5534c18a39d82b5536f14229f5e56cec13c0c39be40c8288cc6ad97823ebef2c044da892f3105e15bccff49c9b7d2b1a7c481fe628bc0583f746d420a1429f66602e3fafa69f4cfc1f0fefcaa935b4fdd320ead184527d4b98cbe47711c44733a6d22c6de8c65a5e394d2ad819b1bcb12ed009fc145a58db972944f44fdb51a81b25249f21757e9fa2f8af7af0ba640b42c75bfcd666c23abaaa854241f40b4df982927c0e5713984a53434ea0e8587d4f2606065bdf07773c2f617df2932c59f0836911ed86de50e76a61fa25cce4e32f2abc1b12d050b7f3caa015fae3dcf3332447b2b6fbef63ec473faf7a24586af0cae1bd60c760d016544cb87819b980defa68a8720ede62ccddf665805a6845f3387b1a12e539e4b8df898d935ead044ba678b12877b80803ba43f9840edbb722f003c21791a3d60bd1d88a46656232abca24cf8adc8002c6a8590bd37a904b71bcdbc9e8bfb2a1c47225146b38e34f328ade32068ea0e6ed0832b1f7f81080a456eab8eead112ed92b9af3ff9421f60372d58fbfcf7bbab32f20755652705c5dfb457b302246095e56fcc9f2d01344265fba9425f937642b528c6994293575ec257ee592cceca0669408aa571999c3501e63724a10564c6de5df29ff6dacf92f5eab10f92ecd0ace2848f86de932b4eff72c2655be7a86588c8157a34fc73114102d55165f59e989f16f680f41f40baf15b35839a17232ea9c5ce9a65c24cacd936fa4832322630b5870f9720b716a94a4baca37c95ec39ec700cb0a18a3e55a20df3d98c05eddd03883ed48a383e6fe8ab89dae38e698c4dcb5db77bf72e9a15b19541bbd7031f815f524743186e680334614a11315e893079b1bfad824f710f526c33f88166c50c780559ce72415cd4de8dec94cc3cdfecdc735702aaf9e3f2358fe4cc55372018850c1b8f5b8d18b9cabeb1a7d1f66184d20a6fea7cde66511313fe6a345d02f10c99e2edb5cdc48199366aced2a26ed906c225c13cbc794591b77cda3ecee76b2da2e045116c71e54fecd8577ce70037da338b3d2f5747b4af3028c18f93531decfc34baf9dc0b4a68c3cad2af8a43dcd400f5168bf4431b61b0f374019af614b1a4f7dd3b6144d36a55d2a61740acd6c5295c657eea09550c0cd9a8781518e3eddfaaee60cd609a1d3953988234a240fe7fe12a00e74b0df4818650f08fcec10952ef5314051e30a038c63f9203c0fef7a757fdc777a1efc4d59fadbf7cdc71c952f7aa8dc6f9e88a74e3af891192794c10564789e4705d10fff6f6c23ce9ed7580e9bd25c5b6963f2e3dacdc7191b5b93233c4841298d666693abcd1ee4d83e628cdfe2f60071434438cd878933d861c2c1963e5c013232d28114bd1b045188846bb67d0acf3969e9da47485ea01d9728308074ad73c364cf2ff0cb812cc600469509c6171bd435de19fcc47c2488bd4863ec812589e6328c1f089acb5e3945779729ea2b0f62952966208e8d879541751abc29cce673f8479e8bf86c43321664c07ff80bde97c177158c150ed9de1095804a761720e737f7eaf59272ac3b9377f74006abbd89643882bad741f39949fa3c8a19fb0de553ae87b0855c2b957fe8ec80f0460b1ed9c68523589f9595c8e79f471d8d36907dc53f0f98d56252ab8209a8e75e9cd1be6fbd385605e7ab54b3cfce0ebcfeb682b80da14bffc02f11800755c22ec25cd47b08a6c0b5b1eb745a5d6403d906f6970783c1e4f3dafb59b75fa8bb532a4e1b119bcdd88a1ad119bef496661c4af2926735a09abb5f286e58e026394539106e50eaac0f319a7ae6a7453cd7ad7c2c0675c5bc4294ab35515c763f495d6da27999390c33c0b8efa567d3abf4b1c0697d0df6090c7c04396f6f796bd2f1ea3a71c6cc16596870c1d54e1893756d86288bc4032d864b3fb8aed3e130e737ccc67374a414ed37af7a7ca2c95fff4bdd74a5736fc3d386a33fb498770f402d48448ab0d9e9258f2a97e815ae436f91db5cdfa7610da4aa2ed472c3968553f497d86413fec833e3f97239aa94aab65b0e7c1ad6d4cc4053f2f84082a8000e60a008ba0f1b06c1870eafa986ffe3cd3d4dbeaa2e75e39e8e7dce80a3d4054073778f9de6417c52fd1b6fbd5e1bd8460259fb5d1b8108f1a629f129285ac6f3c185ade475420267b4d7babb9194296762d39f7601fbb7caf40ad8dd72862733d71ec0703e424c46756c0df812f3b49c4a90a074faaef62837124073111e51b6c3eb2a5258543e67ad9a9b619ff0ee1946b44f09a0b69898862e70086b58dfaa9041bc07a4c1c7a9abd3fd0012c06355701dfe53927d3fdf4c70f5f113ccb38b0ead729d0b93fe515a1be4b4cf54a1db26a0418b293bd15668c241fca895a64f4d299dd3f434761b7e893e6af30d0c9d73dbcecf4e08913adf1f8cea31ea9b5674e472b49c91ac0e34ec3bf27c0cc1fc1c45f3b742bfa163ed1d8d979607f02ad95c27843051ce83342446b51feaf1927703f554ddf6da51b54fc6f1c7070336e3d4176a1b53d70dd8527da4f9f66883f1780866f2178d0127e3e83ac3e757582abfa71b7fa8bc6c7cdf7e323ad789013aceb6c7f4ff26402070c5c457baae08c699acb110c8868142092cff68a7846e00b67d9287f8eefac7d508f442c529345256239ff34cc5ca320115174da82f8c26bd4731cd60035c55e0245976520ac1c31397988c9eb0ff983c165dc5bfc0644b772b809415a07a55948a542d3a2793c66112085840953ac6299890143b0a13d576b461d722bac15a3637114c23f4436a3a4e437463f6c9ea5a9b2fb390eae634e989e624606432b273a1d36a8b4def4561cfa3902be4318e8505a346da768205363bcee63df579b10896094ca53ee52950680853a629bd4a2789708571be5e4560eeee3fe8942a00d192ff4cfa04c823fa331781f9d8150fd78d6e3aa7b494a5e86ad69162474aea4a6021073f18fc79ca6c9d087052245b902d24e02f01b162c1f6c73218b92dab333354592e9a46f4ae9bf3d48a"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY={0x43, 0x4, {'gcm(aes)\x00', 0x1b, "aa17bad40bde889e75dc07abe62e85741aa778c962d8374c2bee54"}}]}, @TIPC_NLA_PUBL={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80000001}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80000001}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1f}]}, @TIPC_NLA_BEARER={0x134, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1000, @local, 0x61}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0x3f}, 0x7}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'ib', 0x3a, 'wlan1\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x1, @mcast1, 0x8}}, {0x14, 0x2, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x3, @mcast1, 0xe35}}, {0x14, 0x2, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x23}}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0xfffffff9, @loopback, 0x80000000}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x15, @mcast1, 0x7483}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}, @TIPC_NLA_NODE={0xb8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3f, 0x4, {'gcm(aes)\x00', 0x17, "053a4d264adffcdf687772efbca10c2ffe920766eb42ac"}}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0x49, 0x3, "587725f1e141ffb694d8bfb65817b40760f3ac9676e4c548b014faaf3d259231466a477a24d6c0dddbdd659ec6b4b96fa31dfa579891904f09173e8f15fb07edf4871f2bf2"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x1498}}, 0x880) r2 = epoll_create1(0x0) r3 = dup(r1) r4 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r3, r4, 0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) fsetxattr$security_evm(r5, &(0x7f0000000180), &(0x7f0000000240)=@ng={0x4, 0x14, "52f86f5d14428e"}, 0x9, 0x1) 12:03:02 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xf6ffffff00000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:03:02 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x5}}}, 0xb) 12:03:02 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x300, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:03:02 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x2}}}, 0x178) 12:03:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='tasks\x00', 0x2, 0x0) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000280)={0x0, 0x8, 0x62}) ioctl$BTRFS_IOC_RESIZE(r1, 0x50009403, &(0x7f0000000800)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00', @ANYRESDEC=r2, @ANYBLOB="3a6d617824a6cf5dd613b78dbdf02bb03ca601d74150be63f8898c62d4374d58d7e046b129d4ca62e23fca1703a27c5ea7f5e0729633c7f51fb9c56c0b1f1d375e3fc709e1832d03231d48ad5681d49c04fa2209604bc9cc137ad0690055509f05970412db001dc22740c54851f0c48ad5d819b37041a4700acdd455a83a166eaf2fde8c5f0caf1f3fa88da55aae1f6724883fb5bd2a4a6cd607f71cd89d26a51592f29b9f9f9cbc52d6d574db48286b54d99f712819fc23aa79c6ba1618d426b1f2183878ba8075e6cbea321fd88e3d3c578cd01892a861a987159d87c2c7d0e40b46ed4a8c5725f8750117f4da14b9c5622b5b698f1b5da4e2b10624b92730e43440b527a04e4e15ec78563b7f8aef03cca2a47952e1b488435231b2e093029080a970d676aa76393c3e36c21587bf0c89fe0981de31feeec83292587bf06ed92662a57ea910167dd2a90ca7f8933608000000000000007598831421835308e237feaa0c5825859f2cc150598db600161410108e8956c17894b5"]) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180), r3) socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$TUNGETVNETHDRSZ(r3, 0x800454d7, &(0x7f00000000c0)) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r5], 0x178) 12:03:02 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000100)={0x1, @write_remote_amp_assoc={{0x140b, 0xb2}, {0xc9, 0x3, 0x1, "e518627452b206e270f9e626fe61098ab9d42998de82ebe0fd10cf7e84144e72f10b13b883b109fa47c7a2cd4b9b04cede0f55c2092efd2505c23471d8ba18431a11ae542f25ff3acd0615aa24832a1b361b20df1338243468c2951f25b5051d1d7671135e2e3806e32bd447d1226d986651174c2802aa90500b417b9de61e87b850f8364176f683535b096108e4d23081ede420e9eae85b1603292ca494fb5e6285a2dbbb349432b7748b27ef"}}}, 0xb6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:03:03 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xfeff000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:03:03 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xffefff1f00000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:03:03 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x6}}}, 0xb) 12:03:03 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x200}}, './file0\x00'}) ioctl$sock_bt_hci(r1, 0x800448f0, &(0x7f0000000100)="f25eb94cfd020ebbafd5802307165883963c7a47bc4f3443a2ec9edbbf559e0c09b5fad3bd383e623aae88fa2ac4d4d109eecb75c4df8f79c1236abaf9348f9b764d4c45a5a838f4929f292ee3e000ce1991bc505260702190e486c6f981b4a25edfd92b671cdf94b93ab747515e8939821c3244ee061c815531c841a349141c48fc41bb095310a19835effb5f7307179b2b671b332bcfc48d93849791243a3ef64fc17e4c6488b79334c0f792daa05d87df48086530bb165fafa6feead6ca7de58ebbb48135f43fde0679dffda284364fb90bbf1bae9ea5a0bd1577b2857734cca6d3d2c198ef5ee8cadf5d83917db9ad9ea48bd99f009bc6c0ad53d99778b822ee33b3bad952988419b38080d5c1e4c2ffad4a412d91a4ebbfdadd840852b304ded3a849564052baa5ff9a61f6ce2eff326ef3faaac56ba9b7645d0e1488e3a5fc9ab7e303692cf8b84bbf22c738afc821bac6cbaa355a840ebf9db32f6c6336d43a60202b8134ce76fce83a4b33bb84ced8c052657de91f730ee0df30e074197f2c02c2731b6af4473cdcf927fa1e178fc4e48954ee1570774545be69a2053ca1ee9b8c0ce6e808a8a433ebc0493979c355d62871e8b3d3c950e0d7a613c592efa1dd278ae6c1347c26171148040283c9b98ffc525762d74457912c26a42ec6a0c54c3ab995bc2c590e0eaef3fb6eb82001dd34c97dc28f6ab8c37d6c7b6515c3a2cdb87e34fbf929464f2e95cc0cead963bfdba945d2be0fbd9a22869c7a769a4a496002effaf0d4ebcd8dd734e332fe7d83b07a07ec274768dc2cfc2d82e02053148330262491883d77813d2a12bf5bd92dd8c453d38c457f3d17e5692b0d816eb7c8d965e52f0432c6b30bb2039fb11bf6af546f23216c52bc3ed9573c707fa196f890c8b798a76d39a5b402e962e5f5f1e252ecdc8e5e02351089c3716b63d5698cc14981b59aa52926be37bb96f8f241fcfc2d77cc8e6e9eb4a062a81852efbcf30806a1ee8a11a23e60df95e1c53390e4430c3bf2fcbeca6026644cffc484c3e20df4f097c63fb705343d405a2dbbf878097d2250b1f09f32e832f1bd799e4e41bc8110f74f614a9e1eca03445dcb08fe739494ab9f273025f912b19ba58ee4f4cfe923d837eeba3ca7bcec34815966f8fea78fb7054c9e52050b018a06d13f1ca0d9efb607a5eb6da9b6da2184ab2db483cbede53fdb170ff9f54c00f30f93072a5dd8ed3fc5ff13d8ca2c2abbccafe45a7d51a40ae2b6cf06bfb7e17359654df0a72ac92106b4b20c07576fde729b41bdfc726ffc057b4e2e97a7e6fd9cd8f54b7ee495da1d25fd49398b922529a014c21bcd907438585893226e8fd159126c7d31fbedc977a8e9e75be776f112422271f22514fc6bf0d31fd5f9150ec8f603ffae00832ed8b7f25b447cdcc3a90d18d1226567dd0cfd20a7397ae148c948045ef285caf4e4dc5f7c22abb51350c7c02a7054da483038f0b2e45df3e63bf293e434c911d2b739792afb957a55358b374c31c06830c91be1e1d5838cf9ce931f8dbbd4e9c514fa914e73c4218be305089962695a6eca2258e90fcc9dc45164abe97fc4162b8e0aacdb06e02663b2ea3d4cfd1ce7aadae886af5340c675052cb2d4546d2590d76f8e03eaf1b55ff60ae054dccf7131fd33b1df8fe777c3f3f6cc68e28efaad7486b978405703bf2b759d481f0a291418350a6674460c00ddf27a7aa74bd1c23bec640b96c11fabc70867dca153674085b5824124cb6718880bd2eb298acd823610a4d50938de0affaa49efdc3c5f8564e941b5ccafdfb22d35cf6152d7000c0632bc5862cf73d38ac54532d5be133892987dc2243bfea4cf43d0c6cc5edeebea6f99d048c62227771f369f2027c5cf9c1760de77fa5aff1817982c3cc987a7e7ce4f1f212fb147f2469d9daf0b85da6446e2c43f313dc0da25c18aaa59b9bbb9694123ed532a69cd50d8407e2a643d5cb403be8ca286b448a7ba2670d554d565168f439c88c120dbfd2b5a640b73722f2974990474f7869e12aab94492d6161c6bdd68bab16b23f0a8799755c7cdd5c48380afc4404a1253329ffb200c4aef142b0dd5939e02d9b0c24df7cb4c55b3790af223c27734781015f80e066a746ef438c2899893aad9b4c9c8cf5d9887d2fe843f3b7def357be3f4f6c8d472177daa61327a405fd5095341f7eb2ee24c38655ec5dec6f2a0cce6f743762ec2888be17c80d8aa9b2c11e6f2b5c2ece05b4adcbe8e6ec95dd4ea1e7a1fe49fa3569e878e72a45a54be030d30e8bb92a3a693a50875889902787a90f7a48f237a006ab7c4c3056ff4448e889a4f31de85a1e9f4aa1b2580e03a655c60340d098ffc1b77d5dfff5407f7bb3f7ff4ece7d8051df146f864c6288190b3fb8ae62e4dd1876cc077e85d2600db8ba7ab0c229e01a1397455ec345876bd889c91f95c6bf35bdf705f8690eba4fdfd907e9d1708b725d89adb61155a1307066296a165f1dd2c23070edd1578d72b83f069d5dd779b72a1a618527110579dd08031ab5d5745fb58b8fd7f9380af60f0813d16d3fe862fb2b5c8a7c14d5fb2fccdbb9f3600a48824ca6a5ba0e69e68d54dd3e5ca95030d4163bda4a411b4b51cb9ddde4db963915a809497a7a768d495676afc21fe28ba88c8443f543a07eb39dc923b9292b0acc66161d8580dd50240d529794e36b393033487e8406e9914d258611b8fbd718c598e7a64eca308b18593ff5434cf5f9933d7b356faae0710d3d8ac30b56e80edeb40651994787074d650983af2b42736ce4f85b7199be6db004d315665dc5aba0a7b9842405fc1430d60dc0f23c1a94f10e22feb29169feca5b7b6ef726cdd1c3c67dd77e9d77aef0531bdfaadd9630c5697a113520cff753d2daaae67b48eb8dd7e0ed204dd3447454a1886722a2c0a7fd967c2c0de930292907d5e231eee9b5abf8a5b45c326107449c487eb8cb41d9317ed2dd3d45fae7ece5bd94f3f04f74603ed56384eeb687ee5883a76d48b62159abc1187dc224cc88b2f3f6e387bd31cbb42849e29435a2c30c8c01ddfca150b8b4028cbf8d9bcf9844c573cd6c2940f830d31846d7f7f07871b4dfcea074d4ae7fd43c2c08d262ca4789ff78a6ee628a67c0eabb8b21440bc933ed45c0225f561c9fe1b0cf2016b7be0bbb4f21fdffa9254f4ac5e2a6e764f7f10dc07c54f6426a118237ac41ea3426de69f20dd2025efe283f320d2df6c99a49dc77789cf6234cca4a06a672dea8f18eb477f61d0cdce80ff3953e88b1ce93acd4d6855c72d326b432a7b9abce4d74375f166860c7bde5ff7ad64db9192112d9566da43c6353620a0b559cb2d730aeb2a78c8b8d725a1f402a5aaffe29fe8a33951ebb1a59d5e565e678fecbbe9b090e691bcd0e41a131a4f92373d12ce06a2033df4682e88e56203d1fedc4028e8cffec1c267eee075e6e00e6961af09cd6916ed3fe403f8cd27b14238229b38e56568065f7c62cede7fa4eb2b94228d97a0999e2045f6ae6ce5d048b2a3ebf1d3f726d08509c987563a210bf10f33d694f42ef267852213827b94634573fcc7d76b0fce4d931fddde8b8dbb2b2c49b1a397a1b5feba10f8d946dc32fa30a5b818ca5a0c4865750fc74d601c11de3e7e83c90ba06fb52f1f5285999a202ee8d84e3f9fa9a7236043c575aba2ecbea81cc1e767369bb596efaaca880e4d51804949019f0144f67f2d13ae09772f49d05f30059903dcd40f6fc6b5460fa41f3d0f4a960beddfa48e24ac305b3c9bd7320502360210bec64fbd82d5da2d2539d0a34b64c5212b90c3ed1341a8c7f80e5089ed6fbb8a75e0fa05cda2bab56d18df7d65a6b955f1372a07e62460ff2da1a180c11fdc3d92c192fd8af007810e775daebdd60fd21af361b1f1f183fa8b0dd01cb99315059b9b1554c77f051ae5ad09b722ec3105b4fc95a520b3ff02e2c47a83e22467fad59bdd07da224d4d495259ee29428f2b23e4e3b775e7f194e40e71614b579eb60f6d5ad7d9c6696d0f124ab95e3f7efdc04eb0c2744731f8c58ea437585e1ba76ff78787e4de9926660a62eb89a7878713bcdb85d12ebda9e02cbd1aede6c9178a1358b4f9b74f74df5d3360771c4c1864aca1ddefc5ef9af72f3c264a17e37443a7d2c190ef5bd6d658bc094877286897ca412e1d79823f09b7cce1d0e0ca9f64f2c5f90eb3f6019325825b7517e883434d059cfad04864b54fb8c7219ef8a50797d5885d458cf0ebe98a5110a7b1980d77dca517da823ebe21456350c014043b487c4713f5c381d6cc35b8ecb755d76c897b8b3ba88d6f7b95b7d62039da71eab7f563cdd1f638247dfd5fe84b2bc7763869bc867f0e78e26ce0f08fc3e1af701a93509c4530a437d0004458712724c0d8f5b111fad25b7c42e9dfae8d32e683e262323d09aa766bc1557ca3672c693a8ed46612719ac552b0bc05822b5d854224b4b5ccad60b8d985e5d5e447f2117c002320015ad360531ddcb72a82bdbcce94ccf36389600fc8e0088a66e9c08b97a3ea98373b9147947f747df1b0adc31e2db9ecf8a688cf908a0015e26fe10f95e41fd8a7182b264a6385b3600f1ac55852bccc5141e0ed84f25f025e2c8cd74995bc81b9b98127c81dee8c8713b8705e5d355e7af108a8788ec491c716e24094fe369088bbbcbb9027552228a742cab8678f482ef55dfa885b121c7dda8fcba914bfdb872dd124d9c5fdbf7fc488be890935f4ac8e001cf03f1b9ec79e96fba3d2cb84412040bcb207ecb9d86d77c3bfd52cbc311714b80885f90bcbe092e7e2198783e63d0b8c3be64438a10a6102041895af885fbfe317ab9fe5481156816a25dc299dbd4145c74be6312d83fe017fd7d7fce76bc7e2739dd73af6a8807d0b7e56403a9482259e6d1860e982912f821e2ace76d061f752f76bfe247838c180fab38b1ab65068fc4da4edfbab876c22ee98198ff68c0a847ec3fdcfad277f72fa2fac9140dbd81dc018a91941a0cf7f1c574c70148f588084273704b07c4f3ba08b53d8fd31125f4470947192b5463259f844447fbd4fe11382cb39112b8517bd038919765a124a402333bb757f96637e9d1c20131ebd0d64170e66315d963565ae4ccf2fccbe3d36a36b5edca2d1432019df7904a21788e7c0d8712d45e34c3a606764be86904dc05b1a45a5517c9fd77c5554dc75300939462d83ccd1d83b6dd51c2e96d8a150f79c2ea929c1c79bfd75796fcd627915c78f3fa355a7bed97489e9f6b9c644245c7c85c8298e045f6db19449e50bede6f3eabbc816ebcbbe57853c401095b4a80ffdee2982fe7ae634af7f387b6f2aede1238935eebd046d450f9a736357e0286036ee808d69f6133eee9235f250a4b8254b7f93dacc377269b48e88015c24d7f40119e7b2749a7df48c84f960ccc19c5f59520453a14b2b52329f5d6fa608b366c6e3da54d683d8d48955cafa64de04aa42815f474dc92c20ff56d6a13be6dbfcf19e211fa1bcf46ac4283ed7d7444d02c76b82401d36cf7ab0a29b36bf323ede0ae87fb3f8fd4adc838e5dc2b90eec60dcd8f4d471fa915eb3048326014ef507f8c5f20c8a5be1716281aa2fb3c8e16b9563cd3f25659a6782b799b0891480028068ad1a1866940631ba000b72cfc91e6848665b10711de7f098d2557147d42b2c8bc52919f0e353060e9cfff4ac5f47f545ff800368a0c35e4c3d79c13675d412500c33f03cdc4442f6053b45cb7e009b2d96000a74756a7f2927b717ee12d0863501240a4f569d382a5eeaf9af1b") write$bt_hci(r1, &(0x7f0000000080)={0x1, @write_sync_train_params={{0xc78, 0x9}, {0x9, 0x5, 0x101, 0xb0}}}, 0xd) 12:03:03 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x500, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2292.250107] Bluetooth: hci0: command 0x0406 tx timeout [ 2294.298012] Bluetooth: hci0: command 0x0406 tx timeout [ 2296.346274] Bluetooth: hci0: command 0x0406 tx timeout [ 2298.395100] Bluetooth: hci0: command 0x0406 tx timeout [ 2300.442069] Bluetooth: hci0: command 0x0406 tx timeout 12:03:14 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x4}}}, 0x178) 12:03:14 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x8}}}, 0xb) 12:03:14 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:03:14 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x2f3227ae795d8b68, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 12:03:14 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x600, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:03:14 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f0000000180), 0x0) writev(r1, &(0x7f0000000140)=[{&(0x7f0000000000)="5c9da36c406229373a03ce8dc26ed79aa4220948bbcde679a1", 0x19}, {&(0x7f00000000c0)="7ace5c9fb03090dd87f69051a66afca0f4ff1f8857d0c57ee440b8ee282e1f86655a00e657f1774b61282135331d6f98ec3768ebbae3a9aa38cd369e21cdc56736ae4fadfe95901132e07a813e2b072560008b929956df34", 0x58}, {&(0x7f0000000040)="e0ebc7d9320fa3f6df52d7a7", 0xc}], 0x3) dup3(r2, r3, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x40802, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) fcntl$F_SET_FILE_RW_HINT(r7, 0x40e, &(0x7f0000000380)) ioctl$sock_inet_tcp_SIOCOUTQNSD(r6, 0x894b, &(0x7f0000000340)) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:03:14 executing program 0: ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000100)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000140)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000040)={0x2, 0x0, "2a9675", 0x5, 0xeb}) bind$bt_hci(r1, &(0x7f0000000000), 0x6) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {r1}}, './file0\x00'}) write$bt_hci(r2, &(0x7f0000000100)=ANY=[], 0xb) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0x4, 0x9a5113fa0e779f0f}, 0x6) 12:03:14 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0xffff000000000000, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:03:14 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x5}}}, 0x178) 12:03:14 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0xa}}}, 0xb) 12:03:14 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:03:14 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x22, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:03:14 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1, @out_args}, './file0\x00'}) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0x3, 0x2}, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) 12:03:14 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x810, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2302.006312] 9pnet_fd: Insufficient options for proto=fd 12:03:14 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x500}}}, 0xb) [ 2302.020528] 9pnet_fd: Insufficient options for proto=fd [ 2302.490056] Bluetooth: hci0: command 0x0406 tx timeout [ 2302.582400] Bluetooth: hci2: Opcode 0x0401 failed: -4 [ 2302.585204] Bluetooth: hci2: Opcode 0x0401 failed: -4 [ 2304.539110] Bluetooth: hci0: command 0x0406 tx timeout [ 2306.586097] Bluetooth: hci0: command 0x0406 tx timeout [ 2308.634201] Bluetooth: hci0: command 0x0406 tx timeout [ 2310.682004] Bluetooth: hci0: command 0x0406 tx timeout 12:03:23 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x2c, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:03:23 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7181, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:03:23 executing program 0: ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000040)={0xffffffffffffffff, 0x6, 0xef3, 0x5}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = syz_open_dev$vcsa(&(0x7f0000000080), 0x5f, 0x200) recvmmsg(r1, &(0x7f00000018c0)=[{{&(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000001740)=[{&(0x7f0000000180)=""/184, 0xb8}, {&(0x7f0000000240)=""/116, 0x74}, {&(0x7f00000002c0)=""/50, 0x32}, {&(0x7f0000000300)=""/68, 0x44}, {&(0x7f0000000380)=""/44, 0x2c}, {&(0x7f00000003c0)=""/93, 0x5d}, {&(0x7f0000000440)=""/238, 0xee}, {&(0x7f0000000540)=""/4096, 0x1000}, {&(0x7f0000001540)=""/227, 0xe3}, {&(0x7f0000001640)=""/248, 0xf8}], 0xa, &(0x7f0000001800)=""/155, 0x9b}, 0x1}], 0x1, 0x100, &(0x7f0000001900)={0x0, 0x989680}) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="2137fc0600000000000000"], 0xb) 12:03:23 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x1008, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:03:23 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x600}}}, 0xb) 12:03:23 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x2}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:03:23 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = syz_open_dev$vcsn(&(0x7f0000000040), 0xfffffffffffffff8, 0x20000) write$bt_hci(r1, &(0x7f0000000080)={0x1, @write_le_host_supported={{0xc6d, 0x2}, {0x2, 0x81}}}, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) 12:03:23 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x6}}}, 0x178) 12:03:23 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0xa00}}}, 0xb) [ 2311.249494] 9pnet_fd: Insufficient options for proto=fd [ 2311.258413] 9pnet_fd: Insufficient options for proto=fd 12:03:23 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x22, {'wfdno', 0x3d, r2}}) 12:03:23 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x8}}}, 0x178) [ 2311.339003] 9pnet_fd: Insufficient options for proto=fd [ 2311.344715] 9pnet_fd: Insufficient options for proto=fd 12:03:23 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x177}}}, 0x178) [ 2312.730039] Bluetooth: hci0: command 0x0406 tx timeout [ 2314.778005] Bluetooth: hci0: command 0x0406 tx timeout [ 2316.826075] Bluetooth: hci0: command 0x0406 tx timeout [ 2318.875212] Bluetooth: hci0: command 0x0406 tx timeout [ 2320.923317] Bluetooth: hci0: command 0x0406 tx timeout 12:03:34 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xfffe}, 0x6) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0xee00}}, './file0\x00'}) write$bt_hci(r1, &(0x7f0000000080)={0x1, @le_set_adv_param={{0x2006, 0xf}, {0xaf7a, 0x0, 0x7, 0x7, 0x20, @none, 0x85, 0xff}}}, 0x13) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) 12:03:34 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x22, r2}}) 12:03:34 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000180), 0x1cc00, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r4 = openat$cgroup_ro(r0, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r4, &(0x7f0000000140)={0x20000010}) r5 = syz_io_uring_setup(0x424e, &(0x7f00000000c0)={0x0, 0x1, 0x2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r5, 0x0) pwritev2(r3, &(0x7f0000001680)=[{&(0x7f0000000340)="912729f154a4dcca6ff7ecf3786bd868665c3ded6ad463cd59a5b2208783f62d4d8ca5fc5ec8e329654a78715ef7221bec8712b70cdd6702899c5619da08ffa83d1afb32723f767b869bb041e98ff7827d2f22a26f22ff5d05e879621a214a1612113e124ec0255d4c1955483a0ff64528c06363d8c317f96e9187e0fb37083c7f1e56f9026f7e4f2c6fdc325ffbfd9cbc9621306d04a04bb607aa7d7abf7a5e024cc64fa77ed2713ea1e319031b1ec7eb8eec1158785098a49873365224721bec7fd1e3d5642a1d9bd6cf379e3ece44a2e4", 0xd2}, {&(0x7f0000000240)="582ee38540095a89e3b66d7b0ca241ecf101b193a7764d5e4cb9d709b7875bf492c817ae6e6e99a81fa044cc4be74addc56bfb36a46cc4f034b6e02887cd9ab5ac93375aef4963e2dbf90e45ee246ec19e3834409f8de76f8a2a8ccb476bd55caaaf67ba9a7b60c6aef2ada1cf2150", 0x6f}, {&(0x7f00000001c0)='\x00a', 0x2}, {&(0x7f0000000440)="b3b4adfea09e356f1c050e53e52097ac97ad21dc5122c5c978bbfa2e88648c7c2296f22b293e2e11700c4087f106eb110e24e92e3f1547739f0443c54fb60d41357b8a0b70e64e9fed233b4ece3e3d803064236ed3026e832f5c15de6bb61797279d2ad789e629f6e8b269ce2086ff8afae559d6ec469874678abc52cef89d1c1ca7affb5148ff7a84d24c196d74cc1fc24e5c8584d29928dc6542b76da99f0fb33ef4f12fba7b99c04c399105e8b79cb19f7b4367c96f273e11e773", 0xbc}, {&(0x7f0000000500)="57b5be971be19b8d174e23ead14a433292d24fc85e5013abb127c82894df51be336432c88607d82e0f1dec4e1cb652d0987be769e94451e54c05e79454a96e19a8dd68072c1dec9cc0e3234b47c90bb05c", 0x51}, {&(0x7f0000000580)="3e25c98f8913f9cf7e4bd2141018701587388e10309ddb8954d43a84130018c43fb7cf3a8dda5435a5d269774a093140d6b652cc54510707cc61a6d0e74a3524c7266b18c1df639fc2e97e7f270f28e6a09df6a5dda62fba1ac6e41931b872b33ce8c8f978b60d10b5e775ce3a9af02a82964faa70387f842be355d8985324e32f19a84102e9032178884aa72b1abfeb191ca503062c7cb0f8be18271acf2e9df63df50a221792be7732e901bbb7d06766d153dac7a08fa98b0bb804a37b27d9839ab27f627b794086a81a7ad1d1a0946a43afc11a0a56abadd5e8ab47171a9f4493aa191a011f9de1c42c9f2fe535bf73a1ccacd9decdff43c21708c2c87eacd378053679854e1e82ec36d0a1909e86afc6f2634536a7302a6d9535f7eb117f5b765dfdd1ced610c9f46222f39e2ba48f8623a497378abcef404dca3ef8fcdfe2a5d7a23c27530868425d62849cf733c4665bda35c6edb785e2812a17d4300438c363bf1d99a05d427f52613bc8aa9ddd7a17da6984f79501bbd387dd5f841f6a97ddc34a757c44d3e1f0970e14de30531568472e262552efb6c6cad8903e2ebe1c8b293263425a1bafd5af4fb7f90526dd66ecf2d58160defe3274fca011a653ad69c842525de17783a9d4204b2a222bcb9a2c0434c792adfb743a3d1f2d26183ddcd79d804c0d195774f85f860b0bcfff0e43d9673ab1a3c97cc851cf6078273d10f4eaebc5404511136ebd805f998e6f051c859c702069c61ec8a2f158fdd6c372a38b0d5f3c107b2bc99a29b4988633a56c1abe1df2c61bc5fa9edb0815e9e06c6fa97fccde665d59f6a7a6ff29fdce41978660739ad174f3ba49292335588df5e5ee2e956c0357f6924387e9b83dc7d3945df922f4327d036661548dea55acb5a4b4beba9d676a331d900e9f5ad5bd643114517c48a679b1d8e14338a656bf2d292692c6e73c6e36edd90076decbb5c168cf611e5d21ffc80768c16b36eeefd6dea3ffe5374853cc6d0feccb933ca258da01c1d788c4cd5c4228452e593cd30d9c150756401af7a2a055fd0a4742be40e3031a3045cc317e8fc78d230249c409315b6c25b2e48dcb37802136c74a7b18d8947a94504cfe16b7eae55ae33340ee6897fedcf6c88341f0994385c34085848dade1b90d12f82773e0b4c9f92b314cc06d395bfeb6f3bbf4dfd39a7cb6b68d464e777e0fa07d651cbf2553d3a10205ba1dd57ef6860844954ae7b0d3fc4bf13b1b965fbfd9988dee7d5406442e9ac4a562330aebe9949ff6058df81c7179514cdc3e7ba9ddb53471168ded81ffad5fa159675ae58b04db3574d877fc0cb29963ef14494bcabe984dc20a05afa22f74df0270bf61dc746003d0135f49b105c940639a95e7f31cdaaacc930c362a1a66a2507d06aa69b5646a560675826ea51b3cc33b5a46f6e1c17a30932bc963cde7734746754cf4a1e1ce47c1934adfb0b0fc07dccc03b01601c7d891c88974b4435a2bf15b0cd4f6d23603140886aece6df39c5f908af13cbe7e0fc76a9e001d5c220dfaefd26487f086f9ecc098f83a752627a7eaffc832bc0cc3404cc2b9c6aa783113b8c421b4ec239c1ebfe143a61e8a578df5e8bca5d0e786a3e486976eef7c487ad3703b0561281732ed8d78d407de637f26d007ae8e3dd20da2e2fddde8facba81de10737abdc1816b6ea504144e501cd022c597fbe255f980ed0890297889285804ca3c150dbd5abc2427675c3d2d92465f1dedfdac2575dfeb5f666aa7dff1d37fc52263a6bb86cede2f38f4c7bf4ccc5ad241b8d45ae8eaccb419cce42ce892296b42dcf9b7ba772f77e2536b7d465a3974cbca94a8fb3f78139b58f53fbed1415567d8410b4a324042ccc8e441c027920d93038fb7c316e4559bc6a83fbf39fab8194dc137c1a0ead5c4001603d3d3fbb03e316b8141dee0a5d026cd0924c59ce8c93693c2efa07963dd19f3ef2c66405c2376cd609f701f322320fb6893384bd6cfd95692b0c66250c1cfb9c5e0188e568627842dce02b19bec5947418bf7eddc4c2a36e116c8958998b2336724ab8be5f6d536b026cea57ec56fc62ba80c389349e14080d0f6c0a1b7a3db31ff2455ae531afcd30dbf0f1dd3a1b2606e3104e857dd6df50507a6f2e47b286bc7ac715b2869850f8a6eeed8f5330a5e24fb251b10051011e268bb97ddb00be5718d5ec544d7a91a580561426f305392794c77f0bacc0795deefca88702f5f3ee91d40732312750a4c0da4f1f936fdfc122ade3d53d9b8f01f1b4ddea74f82ebe5539968c430f0da6a7e3727b44b348a7b38a335de5b15d79a767cdbb0efe73ad5f500ae58d5a41cef6837c4a812cca2f4ed239fb956e6feb117db0c18f25ab151abe76fa2a7ba53195aa6642693e08974dd4ec6c59e9722e9d78245334ebbb1c03be460f80cf67ae5d2f431f4303554a2a0fd9734b91f089c14d2dfe0be153f0b0687f2f04859aacf29603780af7862ef262815f4759c6001e6968c5e4197fa62cb418fd14bba8edf233784c17427e2fda5cce4d5e63b167af913f2fd4393273e57b0bd06f26b09a2cf615bb15649243d86579ada4294f3d68c3cd8ae9c5de5e8d85a55fe56f18d65ca3f20e3180f410268d262d6c9ce0bd92a3cedf6b0e63ab87d0d2fe62834a1eaebdf67ab8b7c7b7e0ebedc35cde8ab4199e6298b2fb88ae4a4ad6f0072f41117128a1834a61fa60c175a787699e0ee5f2fbb049d9c548cda96fab693490eaa15957d76d2c13209eb5c53f0ad73df7bf404306a743ca7c46d609d8d08312fd901da8d626bf047e0876d24bd979bdfd61b5f46c15bf82f61baf2fd111df229ae88bb4705f0dc16a87746dd47cc46eb1a71317a31f73a75588b6d7cbe3d88936a72b37282d5a58323e240978dba082cc15774bcc03704db4c9e798bb3ca0c9651d51077d952b36f4b2366eafaae47834c006361190f9c8838589324aaa5c725a2b2d59a007a50fcbc26edb0b2336c5bf6851cbd239c1b83c6fd73b3fadc6bd9586ab8032210f11f1b25ed981d24f64a170a9683ad17a760edf8dcd3f3a3eed840b0b2dc4559deb231d75ca5583b0808d2f0d19afa3793d508b35c9a7d8aeba43cfc0421a43b8b8876b7a8c44e905c392dc5637414c655ad175d84b52831ae4e49fa3b2be4a5b8c712fd00967bd81e08ca4f8eb63e42532b2de5880b8d934bb8bf3e5313eed418ab245ede82a66804f0dac653c750085b9d78445ea68fff86aa047517a5a0d5e7c3ea35ca34425cc4bb8d41f508a5c19167536fd6b19f9aa07302a44bb6b0f07c598ded8c10c06cd9152266a7f0689767f26a41bb69db4307f25265709ae1c877ff775e70a92910423727895961f842125b5f87687d81fdfdeb3b29cc918e97b40e817cba6889d1077254517eaaf075a4184d62e69aaf0f900fecd66be2350360dbae644067ae4648e2aecced8b8ae1b7b49b0a31b2a3bf2c857e9d3ff28e1246e4e76195bf614758f78d5728e2186511c640f3c4d8ba76c4fe141994cb1fa032d12b260c50fae62a499fd3e054a7046e43abc79a6fa6eecc2f2fdcc996ead451f937453ff08227842a17eee957a18b38a575bb499515ff66bf167033ca9a113a5588c4a85f53f3cf02ae08a57229ed7dac214ad3473c737c9dbd57cf5774a61971eeb08484493b7a769e51eb1d02a91fde1470da9d3ec286879dedadbdf134be1069b12f0336223e126383efb2822c3dd07ad4db2ee6a1b3aca9eafbec479dd5463da02ef6279a2abf42bfe68cc88373009cfb086e329667594764c9580db3d4ef4bb45de148f692dc10403774e1c19b99343198fb1d756beba58466ee05ebee73db88cae3e6000b231a8b4a639e99a60dd26b25909bdd10b152356a5b0319742cfc2e8bd1fdb0c0dbf8ba9d41e2c70120c9f7fa0004d9ce6afa42b025be85c6901b086ce29abef7af2ff177c3de8eb96abc83dfbd8b7dcbb1261c108d933d03af6d2e8f98256228847479e45880ffbe51b30d89c080f242190cd9348a27d2b490a921e14f2f5a8c36ed3c0dfd99c7d1475776cc122794f429a4e175d9e11b44342cf2f3810533b3615de1b4fdb64cd22654b857aef2ccdc32878b39908879e0181645192d8bab6d30eeaef391add8f528a61451ce90c81d2d639e66978d34ecf0ee291bc8db1bab99cfff6521ff65a64f30f72e393440e8e53190eb293d69b102f7a4eab21b5fac9364fee65f3018374dfb43f64ce1d3fb465cd72cc8fb52a8278a9cd3bf71934f6502d0e05ac0b731c19fd2c92ae19dc0adb2549cc24543a2bf851a6fa8464dbc6d37e7ce3b17663a519a4cbb00a1c744663c6ff3f5e6156390cc424340f4e46559184f0e28e2b4f344a321f74a1efa504c9e094503f8c3c0e977cf6e84b6ab4bd1eced3deb9e862650583381883deb89ac03a6c2f8d1fbc1088c97774e39abcf0c188e49175529c0c9ff668819707be2d9d181bc4f1ef0a25afb0d07bba2c1cf7a4b2d0d537e06260162e98c4590f8491a88ae066837c75ae3d93aa8aafa0b3eab8f5eab6940ad12f171c8c64a8b51a339876dad6666ad760ff05ffa546b62535c6921437d457b3a3be7d2d3c163cefc567e50db3dfd055e74ee2a4a1de71c933df63363e55c7e534512830b0645d8fc86d9dc38ee1ea5a67d85edc402117469e0fdf9d98e93d0ecd6f12e057d1db23961e19ed5c416f5da15ea5530a100bcfa5ef186c3929f8c2345fbf1d2df1e0595c78e72aa014266d1ff732ef3e4fadfd658f73b5b37db09e49ad171df736e751646149d02ec6155264158b5262c37259ab9ad8b7a91778b667d9c6c44f2bc055ce528291bec4468c92de87efebd7ba8f06743c5ea4d4ecd42656884dd98bde4dacc437fb725362296cf334438aba02d2f264686aba030190eb25a954cc03fee34e39cf5289c8494e13ff46549cb8e4ec2f12b3c6b53a348c3dac8580efd1137a4eae792b1dbe735835070f0f05f6cc0ffeaf571f28916f22df4894fe8dae5f43a06dc5cdae12a396f316e3e4bd621f172bc764f0e2853b4e4d774a416f8430a59ab71d91316f844e3d48bdbe010ccca459e50d7fe05ec4e43d569e0a222750bf347361e5fcee537a3ade2dfa144725d7aa8987edd6ab8842871d23c59e582bb8d88ad93fd908b7db979a5411a15c11ae24e2dd2c82a52abb6b09e13c5c7e37b8bc719917150a6db2c22cfdfad39e7115e653426520e9147bd7c5fdfb90da7dbe59e7098c9d3111fa6ca34d7098443f9b6b7a9715b55bb5c82eef2c4dc669729c932dd197f7d9bf1119b59d1e3766bfefa4d61d61c7db6455ed0a67c7eca3761189482e78b7a445593cee7d013a1bee0a1f017e4f63fd20d36f63a0d468157b5eb8888fbda3a5061e6072f31eae2e6149fc95577c62b9e4d3ae0fa3478c737c53afa2a23a574c5d9c4e5277f08726aa666c2dcc54668823280dba76f9d43efc910c3ef3c05eb0b3ab321ffa40e893f1839f98aaa03ac3d488cc620edd5f72d7ee45484d16cec006ef1be5f964e7b59fcac7b72771281716854aa97bace37c7fa8cd3dcf3a6ef203cb1a115ceb4d674edda8d5ded2400dcda212814a2becb4f8cd8ece7de3794657337209b53c4b3ed8e34dcc9cbc0a4dcf5aa884c044a68096a3fdb54bc6dbcbad19deba428e1138c21d366be57baf708f27eae079ec49f7bc8e412668db260e68f73475fa539fa7337d86c5a6d34ca4796cb0c43b578c18689bcf56fcf1a2c6268cc6a3a72b8e6ae86ec321f249c0a436f2440ac7c022ac11af83cbe7e145ac", 0x1000}, {&(0x7f0000001580)="f46440ff705fac66636857758bd99b49d3d366c29ba1f814e658e912d9e1582f1cc97cf0a14dfa41635d1c51ced293f4c71e88ee48d792f0656559b3de5ac89eaf46cb407e8a03b6a9392f9b0a0f5367652768e8185b3a81e44959e0ad6653ce07687db9b020d88ddbbdaf9832d64022b81c7e139d27825109badbc1948807803f7c5f73128ca35715bb548f0189de5096cf539477f6b06d260c76c4c22867f5fd9661a0b82eba86dae2ce6b05871922bff69f0d48f17f8fcf83fb861c225254e8db4d8aba0ca3e1848b88c43a893fbc3171", 0xd2}, {&(0x7f00000002c0)="658d648f5243045d9fe60ffd35d39bcbb4d416676bb14c578e557cf2f1", 0x1d}], 0x8, 0x2, 0x6, 0x1f) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:03:34 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x3}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:03:34 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x20}}}, 0xb) 12:03:34 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x4000, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:03:34 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0x3) 12:03:34 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x500}}}, 0x178) 12:03:34 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)={0x1, @le_reject_cis={{0x2067, 0x3}, {0xc8, 0x97}}}, 0x7) socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) [ 2321.515758] 9pnet_fd: Insufficient options for proto=fd [ 2321.526084] 9pnet_fd: Insufficient options for proto=fd 12:03:34 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="0133070000000000000030976996d9ae9190f3de933d96f5788651745488be0ba4ab377e990b972a84b9fc0887bb3bf3c6ef59355da6e0e33756e2317b6e06ef062a5aa58def48402583cc583295891f6bfe2e8260b26a0dfc9dc06b76967b8378"], 0xb) r1 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r1, &(0x7f00000017c0)={&(0x7f0000000100)=@isdn, 0x80, &(0x7f0000001700)=[{&(0x7f0000000180)=""/233, 0xe9}, {&(0x7f0000000280)=""/48, 0x30}, {&(0x7f00000002c0)=""/248, 0xf8}, {&(0x7f00000003c0)=""/136, 0x88}, {&(0x7f0000000480)=""/4096, 0x1000}, {&(0x7f0000001480)=""/233, 0xe9}, {&(0x7f0000001580)=""/131, 0x83}, {&(0x7f0000001640)=""/52, 0x34}, {&(0x7f0000001680)=""/113, 0x71}], 0x9}, 0x160) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f00000000c0)={0xffffffffffffffff, 0x9, "45239a", 0xff, 0x71}) 12:03:34 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x600}}}, 0x178) 12:03:34 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x2c, r2}}) 12:03:34 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:03:34 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {r1}}, './file0\x00'}) bind$bt_hci(r2, &(0x7f0000000100)={0x1f, 0x3, 0x1}, 0x6) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000080)={0x3, 0x3ff, "03ebb0", 0x80, 0x7f}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x3, 0x2}, 0x6) socket$inet_tcp(0x2, 0x1, 0x0) socketpair(0x2d, 0x0, 0x4, &(0x7f0000000180)={0xffffffffffffffff}) write$bt_hci(r3, &(0x7f00000007c0)=ANY=[], 0x178) [ 2321.637559] 9pnet_fd: Insufficient options for proto=fd 12:03:34 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x3}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2321.649278] 9pnet_fd: Insufficient options for proto=fd 12:03:34 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x7701}}}, 0x178) 12:03:34 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x22}) [ 2321.727349] 9pnet_fd: Insufficient options for proto=fd [ 2321.740101] 9pnet_fd: Insufficient options for proto=fd 12:03:34 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) [ 2322.970245] Bluetooth: hci0: command 0x0406 tx timeout [ 2325.018066] Bluetooth: hci0: command 0x0406 tx timeout [ 2327.066101] Bluetooth: hci0: command 0x0406 tx timeout [ 2329.114042] Bluetooth: hci0: command 0x0406 tx timeout [ 2331.162101] Bluetooth: hci0: command 0x0406 tx timeout 12:03:44 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:03:44 executing program 0: io_submit(0x0, 0x8, &(0x7f00000019c0)=[&(0x7f0000000440)={0x0, 0x0, 0x0, 0x6, 0x2, 0xffffffffffffffff, &(0x7f00000003c0)="6be0ee1dc24a1f053c7731973c0bf9b53901e36a4a71082b71734a2ea9c4810fedfc37de40273f509c127a17bb1e72a69d0d92a6d640e9df50b9804b2ebddc0fb70ffd1b3804ba2dd4d3cea8158473d97fed", 0x52, 0xa000000, 0x0, 0x1}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x2, 0xffffffffffffffff, &(0x7f0000000480)="9870f41e0aab8d7305d8b2935fa5dea35f28bf869cbad616398d0756e4ff643a3c2e97b55332eb23e346f635c2920c64a9904852ca8e92c73e8f4aa4298c5830c4a8ade00eddc21881107c284fd874245e288958240abe296e13c2376ac97d1406a20a52503778087de756a52d87ad685054bde09c400083bc8ba6b816146221133cd6ad8ef7f6dbac9e5d664036fa1e785ac7c2cf6a", 0x96, 0x401, 0x0, 0x2}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, &(0x7f00000005c0)="38c63bd6a6235054e5a2e348e7d55ef5b04da7653a44c0cb6ed2c6ec5a3c7b3f978d484bce975e6654999bc3f73508e82b56886b29638181005c29893176d9d91e2033568ebe19b0963050a25350c7045050eaee2cf3f611534ecee6461832225e131e666e0a6c9ecea37405b2b80c92b39dcb8e747152023ec8d4a2b5478a9bff95ceadd64323213f71673e13d59d0f8d9f7aebcd65748927fba2fd7cbd939a7c42a421dc68c1b3c617c68d74b9b8fbee0a694496e26b", 0xb7, 0x9, 0x0, 0x2}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x2, 0x9, 0xffffffffffffffff, &(0x7f0000000700)="3d4d0b924cde79c28db553d7a32dbf8ee025777a54799eaa75127c03c02cc9556678ea6f22648b2a74fae58ae05a861294a648137b2ab6c2c12502", 0x3b, 0x5, 0x0, 0x1}, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x1, 0x9, 0xffffffffffffffff, &(0x7f00000007c0)="0ff5c0983b7c3eba858aa490ecfd3003100ee0b4a14f", 0x16, 0x25d6}, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffffffffffff, &(0x7f0000000840)="a885045389c7e155bfe789eee815aa2ac2e132a239d0f408f43bd9e0bf1caa556c58a4df0afc757bc1b65cb99ad9e902b4ed2774ba15142668bd560726f376a06b76faa70c9520b6c2e21378ffe4d1168840aef86c994f6acfe8a942506eea8f2643ce9bf359", 0x66, 0x80000001, 0x0, 0x4}, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x3f, 0xffffffffffffffff, &(0x7f0000000900)="898a311ee23ec6db810cc9b6f2023d89d548cc4e99fc8e66dfea05c16866a6a95170453c97", 0x25, 0xffffffff, 0x0, 0x3}, &(0x7f0000001980)={0x0, 0x0, 0x0, 0x3, 0x9, 0xffffffffffffffff, &(0x7f0000000980)="032643b08b1b3f1233d56efd75c0d57d8afbd6105860e4a0ba40769943e8fab8313624fcfa988b9c21dc250bf644c882048ed43412d5cad173168531c9315585c61928415ce943e1aaf77fbb8ee830ab4608ee5e8694d502e4d3624de2ad05d98a042054a545a38e092af1e73240f45d7e53b4aa0489a396c46a0ed7d773f42be6816998b8134d2b38b2772a2f71e9d460386a90be036e52ba6b7a158cd37867320354fced0267620ee2512aa28d670a40d54cf5ab464ddbcd9947320f16fa329dc3d18015646cb0195c523938aa1e04b6ed028b691e8bb67eb4de559755fbb4e397d41fe9e0e715974ddca6a02b73d5dda30916092c5aa19eba550c645355846727967c893973360c7bbf3f98b7b0e9e9030d5ac3d677d51ac8457ceea638e48d71d987a803d4dbdf0e5edc618df0acf46f66f48c656b57c3cff4ce07d55e6d5be257bfe88d7127ce159767c72f5162f94a31f83c41c751633b143d53b61a2404830334648b0420221a32252c4df21b22216ac9d9a9992c56ea80b0cebc2edc72297d768c362cdd66b9730213b053b44790d7d5f05cf25827ad2d38e08c2b83ae493b1f7de6772967ce92e2d3e2da9f5aa9a3bf73e8aa73f82e98140db50567ef11ecd536593eb9751d03171bb8584aa18753f8c3e4ff6009a48a856869a668741576736ef46c246ad2ab91d818ad4f8943726a8f1b91f84c45a80035b3b6127cf8602a3c92b78bbf80f91be8e55f1f3a5a29d3065f824085a5784da577a2b6ab5269b3031447bc11b2be65ef87cc92ccf75c1a08373e918c6ce82069f822733bc26676c1b39f3e188dfc4d5804928e5e8b980a259432050108480c17536b54883cfabc137c53fb27d13889fd2833a41fda935c95492bbf6098b4760e27062452461e65616546ba087bf576f4973e336b475d904c56079ff3eceb3d34693619cd70d133bf343d9d50a669bb201138728c9da8c2b353e85cfcca1c7590d8bc65a47bfd48041676b39de916cb55011384bba3bcf05fdaf0022483f5da8a0fe43fcc0a200b0c110f381280cfbaf7513e07a1dfa63577dc462790e4e738645180e053de3f5f6df67ea0da9e6f4a8e9dbef7e7c8ee0c70896e852507b30832e317fde20cda3f37730f9b9cd7dfb1f8c47c58a4added2d18fcbc571f00855baea3cb029a11745fbf04dd5de6813884bddce001745d970a31b543ef96e9a60a0ae88f9b5f407214399cb3e81c147e0c3c83d55589596be938a516ec36c4d262f350dc016f8623c5f6a240bcebf741604fed3fb93b83baacacdbd098afd49fc4c53059a15c206461dbe7ed6b58b53b26d85cb3064fe680e748685a1d864e3bc723b363cf590d10d4db8730a772fef49c382f4de870f44d6f29e42cd9d1e9ae58784de86ae381a48278bb757bc9885088bddc42bcfa3e01067fe6a37e640b9b04623d5ec50dcfe231bef06aef523c6ba1b3ff0db89f69db248176a76cf73b37c009304ad09d49e2465ae43e3a3281ecec18b2eb88535059e2337d31940275d471b9e2df16e1a214cc73eb336971d82e06d683ac6f39c0ca7618de8991a8769483c02ef4af9776f15035aa714bff28a8345ffcdc353dfc80e81c5d951e4fa0fed58667fe8a7c1499ad3da47632081d13daefcc8dab872136a749dfbb078b6dfde0f27720ebdfa2ffc5d6a0bd697864aa201dee16425adcc2cda4fc37fdffd976b06d8da546d5ebb7c8ac882ad7211eee1e5a5df551689ec67567977d4a22ca6fe70c9a64625a574a63c38584a4893948f7cc6b749cd0cc8669f2f2baa43a7d6ba71c2f7919ca1d79f45a59cbadd4ffcdac17e956189f99eb176034b027811985693d8a59456873fa2c8bfcb0860e53e087d1418bf50c5c4fdfe56b168679803a8dea5cafac3a54011b0336fe69a0fe1549859a5ced0144f98290e65441a7f56e731ee498da433fc7a9ee02dc2388ad2f7e5fafad713e783e09f71e0cc1b72fbbc665dfcafd02e1eff8191617629c3ab07b1d4be239685941a2a9e9fb95428d78c27eaacf27cd0b80e5ac273da198b3f2bbbdd278953976ad318b2a8044431e7ea5089d897582dcf10c5a68e444126dd5b33432d32ea041c4f07dc364519c0371e17f266f54e78c54cd17a8445931742aafc43c43aff60503f73f941e3489290e0e28260cd0bd452e6251d05e035965a433f3df35b9004af4c26ca46751fc10c6e15f8ba8af15b06eb6aea0ec332685a5cd987b62ca49a5e32400b8c6926facbc68d5c9ac6f86b0eec89b6ad6d00eda18f86a2d19a9ea3b6a8101b6a562654bf27776d45f6aace386b882fbc5b67e139712622c9d38442e644920857fc35eb06d38beaa703acb10ce98ee35583f53a41bd47941681e5d5cd413755aaa19d860ac6a6dfc52d3eb8d25c59ded437d6d60945f462b1a08e8877199b425c8d6182d37b2dab272000c3ad6d2dc0c667f7ceb52cea1e4d2b76213b50d69ff7723e501435c1b22cd5f4339eef294f4057c7eafde61adfcd1f6762e33aeacd2afcfc72f551d16e5282352e5daea97ecfd969923491bfc4e6857bd8002c35e89de4decd01601c199160ba4b813a14a877b9860da3f114f54dd113dec25c65e1beb1efd866cb2580cedbd219409a6a9956d5fcba89488c45a568d3c1d2ad1bb460f115d6a712527e336d3b7542fb4eacd548a5222f81a60dcecfef4980af6ed332346d0038cd4accb71f5ac4e4af035d10b7e274f484e7a4aaf8c971ae0b40404bbc1bf9e32062128fd92726e67d75a73b45b17fdba21f4cad95428d51fb6abf22efb62cbe3b333def55d38a0316fac9059418347ab87627833a0884a34cdf0e8ce2daf38a1b8ae7ce1e5a9420bde237152035e958c60a80d6c35b894ec98ec90895809f7625d0c7d249ef20703efc5da743883b9db12ef9f8a619a00275605283140a507d851b975b3fb34ae8c6d2c42cde0bbc2835a44a4b7b64d69a88174bee917abe2bbae47aeb9c4ad92b94d6e92752c83183630eeabacd3b2258b494ac7c9e678d9b6bcaec12b13c25a7f7cb209596876f1ae65045d9c472ebc269c69521f509b190447a6197c02af535ea997d97659cc75c115400f95bbab8f625ba90c636b2ad3a81e0816aa263d75d37c1edae4ba9bc8969c234ac2d7cddcef798dffd629971a75210654258647bf9d92b261a8ad0f09ee55dfc107497b9cf951e51c53a7f1e0706a31e2b2feb146e322f3591811c1cb0d2b0a069b3f427d658138cd9b3a640b0fea5cfae147b2de5a7a76301df6b89e46b88816860d267390c8058eb09c65bb7cb5d561af869c60e2f3526ba7be2c07d67a469c3d160ee9bbf65ca366a2e1ff2eae8d01f40af03c6c4d857a3b67c78a44699b29952fe2e14156101e624c5be8354d2616cf0fc98d002336385e6309c1e5a2fb0728d893d52dddf6805746389d036ffe1a69310f426d6113d4ea702aca3a43ac732ab9fed529acc582e863d0393829123dccb74fb5360be1065c3f03bf5c6c786e93d64358478ec21dec32251cfdbe7f6a2e8a3bfd81ca36e28a284c8f34d5fdf3532a1e52a68ad5d5a878a08bde8b1151c6b387c68d3f22e08a8ae73a3eeaa4d16f4a09a1faf727af1ad7aff3c13e43f7990d9dba54bff4ed28b3281e3cf4a5365f1a2cc294f66ca52b70c2ac417a978d73bebd57d33d585ec033d41142ef3e090227d0d13ed3ec208946e6ddb084f72871d6681ac7df67bea6c5486e6fc6abe947ac9fdcc558ee1ec2355f29d750e6cfb88726f6c107209456e5f6270b14dca088690fe0e3054b6779036ad2239f28bef25d8720325a20b4610308cbf74804b5d0a6aab7d3d2200cfc9662e67881f25647d85ca822984f4abf7b7c166a16c4cf018edcdafe70c3baecc508ca7c0b3d93726630c2c4f9981b866333c371f21c1ba15d365289eb1c5643154150d6daef7a06028d6cfc4e544c3f74fe61a12e9aa70d7232fa22363b965ba55e9f5847014f07acbfdd1e09c21c69b6a0468fe48906cf66da8d23e2bfdb06cfcdad4f3358cabc96c9ba65475815423a8aa0f2214baec6ff5bb6a9b859ac06c224547b74c1e0f7c36ec404322cf4324b01f408ca8b8267b453dd9bf0ad02e90ac04858bcb19d210a7aea474b88fc058ac395e26f776cdcdf0ac7bec695e120bca172ecd0867c3724d9e2e44570f325a50b415c6a2b55d5014733169efd97675302276a7459f8b0c0d316f5595c5b64b410a74003ab87863ab99dfe32a6a1870b63b153803d93cedb1bdcfe24b9221df696fe6d7702667c163b5ea0cb89ef51bf003723701c755ca09f93c3adc006c66def8ba4735e1a33f4d7a709c1d13ca01fbe269ac35c675e5d2778f6133c97d56f64bb0bc0a595255af5075bd027be4e8ec3adf50f5ea7810b546c575ad53a03534ef2734d26abf4dae970353b2d008df2b6693c037302525ec5e8e5dca8d436fe0c533f1056213b016569bb2be147dbe24ec3224cb2249ff56eb89d90edc5b61128fd4cfdf300a74dcd0fd0b3e0a47cc827150079eceb2b8a36de051725661504cde4522ae998a417f608c6c0660a3a0c82bbc653929d3c3d1c1f128e5d945cbfc161fe166d91a5409da86fe3681e80b3edf7f836d3641ebd317aa52ec6fd978d326ed63030b60ccecc0ee2499c322578d8ba8d962604c3f3467da8c17feae26a7b078f3825ed1bf7686365e3aabcad3954581d96d9a5f290acfa3f490c80b82c26184d5f826df63b2825e9c9ce296cde29e0b63964280b661dca00e3fbae2172424590112afff4c75dee4773a1185f54a425dd62c72cae7247e5ce99775c858c646787d6ba80849548e81f2162f489858d649a306f5dddeade83638d485b0e7c28ceb7ab53818b7a82829b4d6bf48583be7830a5c8bfa77108325728c922def77929365c18a3ea7740d0965ec33c2839594969140be15c02ebfa4af3c4a8554bf08b8641d5fa51901ab81fbf9136af2d081a1ebfb38e9c202ae4e3f8df7da95449c0577f93a0432984f0413b0ff7ba38f01f4f5cbc67dad6b1b044633cc1d720ca3524b8ec0b161b366d1ca658e74de481e58bd920e6bdff1e5dbcb24f0f60bdd0a46bc92e5fd0ac2eab3ce5fa838c1bdd89a88af341391218265a92ebdc1ff3dc9757c8afd03e46b4be858ad35d5d31b975b5bc8677a0845b119c178a77764ed048a92b8cfb21862941a79fd6176c33b2ff2ad44e18edac0e4efb5bb94853fe4089354fd594a8d2f23a639b4b96d9d22a2dde0642e48cefd6d9ed60876f57d48631b55741bd8a80e13d6d742957159550b53ca95e7af2a06026ad3f32fa2a349c9859bf4546e2c17ca7262c4b908a941f22d8387675ffb048a8490d855757d82a451811c05adc69300ba8c4ad4c35d0695a4a345abf3a79f78a07769124fc781d523a28e5507fd0ef7870ba6d76de69ec8088b7562848222a48fb6a3ab5a70f46800be97ad6275ba78e3124d0dfc35eb5d8db4f3d3d1d1226d3d9f3d38200ce7aa3b9e930f0100510fa6ff6d50154e8be5a2d8ddd63d384b46d800575b5b7d83938adeba9a27f08e7c0f536d427a0daa6fddf72c17f9bce80589ab4208e43825bf05ead42444415c1e808b97516267ddef6c29967e0fac69cf32e5f397d092c17ca3ef90647abeade2e4d8e78e6b3fc0a53a48c83f03fc276bfc6d4c0aee38a0ce89be739e3003b887f481033cc7fb79936d8c91d1321b154e0246e874a1cb362d6ce2bc9f1e07242d3e5b4f21adb06405aead0c167dbe4ab872461f78c43bef9afa662e845267b4a9de8caa2c96e55c18666460a41635", 0x1000, 0xfffffffffffffffe, 0x0, 0x3}]) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) open_by_handle_at(r3, &(0x7f0000000380)=@FILEID_UDF_WITHOUT_PARENT={0xc, 0x51, {0x8, 0x7, 0x81, 0x5}}, 0x4000) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) r5 = socket$inet6_icmp(0xa, 0x2, 0x3a) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f0000000100)={0x10000005}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f0000000040)={0x1, @le_reject_cis={{0x2067, 0x3}, {0xc9, 0x6}}}, 0x7) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) r6 = accept4(r3, &(0x7f0000000140)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000200)=0x80, 0x80000) r7 = socket$packet(0x11, 0x2, 0x300) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) ppoll(&(0x7f0000000280)=[{r0, 0x4d0}, {r4, 0x6462}, {r0, 0xaaa1d2a588e5857f}, {r5, 0x8100}, {r6, 0x414}, {r7, 0x3600}], 0x6, &(0x7f0000000300)={r8, r9+60000000}, &(0x7f0000000340)={[0x2116]}, 0x8) 12:03:44 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x4}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:03:44 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_bt_hci(r0, 0x400448dd, &(0x7f0000000040)="376b0220460090a003218a309227b1478f327fa476404cf54d3c675836ec4d5bb0cd1eace74ea822a5f7e276cc3bdf704a8cd0ea3aa41ca0ffabe3fb223eeaadf2e40ad6c6e9eb5fc8241131d124103e88451bb83dc9b2110e67d259399c61ba4051e057eb0c578dc2b2076c87bafb9e9d3351ddc329d2f710baecc64fbc6a3fbbc309e6de2f46da70ad0949fd76d91e") r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) 12:03:44 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) epoll_create1(0x0) r1 = dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r1, r2, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x2c) 12:03:44 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x2}}}, 0x178) 12:03:44 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x7}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:03:44 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0x404) 12:03:44 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) close_range(r3, r4, 0x2) r5 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r5, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:03:44 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x30, 0x0, 0x1300) r2 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r2], 0x178) 12:03:44 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x2}}) 12:03:44 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xfdef) 12:03:44 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000180)={@in={{0x2, 0x4e23, @loopback}}, 0x0, 0x0, 0x29, 0x0, "ca0b27554f1a1cd1d28a7faff36c62161296bcd77cff82caef2ad6f290d094efb98fd1bc4d93c7e6e950fb495b21c1bcf55ca526b631c39d7f26541a1aa6586a93d61b0913621207569ef9de25f57deb"}, 0xd8) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYRES64=0x0], 0x178) r2 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000280)='memory.pressure\x00', 0x2, 0x0) ioctl$AUTOFS_IOC_SETTIMEOUT(r2, 0x80049367, &(0x7f00000002c0)=0xfffffffffffffffa) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000080)={@in6={{0xa, 0x4e24, 0x800, @private0={0xfc, 0x0, '\x00', 0x1}, 0x396}}, 0x0, 0x0, 0x44, 0x0, "bcdf90506333b3c45ee234d30ee431d41d292a18322d7220d1d633067103da01890a622e603743d2bcee3cf49aebebac4192aea22a57ff53c194debd6aaddb6b438e93b7d8eb8f025a31389790b8179f"}, 0xd8) 12:03:44 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x4}}}, 0x178) 12:03:44 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0xf}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:03:45 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x3}}) 12:03:45 executing program 0: sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000001200)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001140)=ANY=[@ANYBLOB="f2dc0572", @ANYRES16=0x0, @ANYBLOB="000428bd7000ffdbdf25030000000900030073797a30000000000900010073797a30000000000900030073797a30000000000900010073797a30000000001400020077673200000000000000000000000000140002006d61637365633000000000000000000014000200"/122], 0x80}, 0x1, 0x0, 0x0, 0x20000081}, 0x2000) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000001340), r0) sendmsg$SMC_PNETID_GET(0xffffffffffffffff, &(0x7f0000001400)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0x66cf08dd27f84a5}, 0xc, &(0x7f00000013c0)={&(0x7f0000001380)={0x30, r1, 0x200, 0x70bd26, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_macvtap\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x44) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$sock_inet_SIOCGIFDSTADDR(r5, 0x8917, &(0x7f0000001480)={'ipvlan0\x00', {0x2, 0x0, @initdev}}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r6, &(0x7f0000001440)={0x2000}) ioctl$sock_bt_hci(r3, 0x800448d4, &(0x7f0000001240)="bcb19621a0e517c17c529a53e14969890cb4f27b8e9a76aa58dee75fa783f4128b5461b301162974c4c496b2aa9c7c9a016e6ca194710d769d086772ba46836b92a670e7df8511e0fd0caea45160f27c7e407018774e8c8f6936d3a29430f4feabbd48e35af6059cda693b748bae966d1afda897db81f150427beda55ef6600a242abdadbb2ad4996f0674c88cf85e8315486aabb379fe6a18") bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) io_submit(0x0, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x400, r2, &(0x7f00000014c0)="67f69212026d5c97c2c9f2cf7c6bb8bfe68e083726c79101c4bbebcbefa1dba3d745f707a50ae2eba35623162708fbf26bdf20cd1415f19e4fbb1a0b3d2b05a219cf51383029d823b40f5d4f32c77ba071a5adce2a976e9d97cd868aa149a400b0677386e9e869348dacc7ad7f7ff1cdeee115070fd533b86db9ab39cca857720c7315019bc261ce7b185533a27efb03d92a3ecc73d30dd4a6258cfc59b0a057ea3152f0ecdae9c5e415043d8fb9ab81e8a2558c53be5e338ddd50c2c44651847701f64465d1d8c8e517ed24cf7548d3197e53b29a9c3da81ac5458d3f8dd1475d5724036202ba0202448487f0a3e3bb341665c3f574cb2129612ffcce63f1ce85514123718ac3b5c50d9988158d6a20f3d9ec443cdb721e4ebcebdffeb7d0eacaa1b3acd2c5bce8edef65e93fc1e9958ee980f822baca23cf06e37f959dc635eb2372970278602d121c3e71b296da78707d23ff7a76108ff88135c5bfc3e3da9d47e9f802380fd27ead213e0a8e16b3c79256e7fe63e6852f0d555ecebf2dc655d9fe07afda14005a84af2d3e8dcce367b3fc4c940f78b1c61af04663b34f51401299369764179d68d64598c008e6ab1a7d3a738cb451c5f580d0dea8796f93b0e039ed60b92fc99df61a4311d357158c52f4f0471ce8fdb909e6c04823e3c5a663b489527c88a7c54a15ba089cd40aa37b5f5168eb7b187982f694a1a0dcf09f751ff3c5c99d8e05a11a3f63937f210a699f45c8ce67eee469f413199904e8c31ecf05c295c728c71c51157713781529de3a8c5b1c00c4739026b7e7551e5b188b0f3c473e73bc0365e67f0000000061995b4eb75d51ed48aa7b6f8cd5df426f0390256dd60dd358eb51b1317882c968a57f10bf943ad48e697911e0e631edf9bf99fcf2e04e8adb52237d67cab298a575a6131ca17963bc758fec584430e5b2b9ec2c766d332dc02469220ddf53c0f7ede1c3ce0502ae6bee60e7e1640897138d03235cf6e9de71bd2e4f5d9a465e75c5e748c393719d824830e7ec68466489a15490b3a9eb63160e3d893e4326bdefe42f285c60502ecd52476e6aa9f3bf3bf56b4c2c51b1602d7dbf854d4d22c493f50172b124fd2b6b5563df85b517f72300ad0416a0964c05d28ec489616c1e6617d169a1003ee1ed0daa91a2495bd66d4de19c8e161f0308f818165acb1152717d4f05b0125f9d1e3261b4e31f92ccc9a2bdccd97a1216fae13290fdf6f5d21c5b47cc01dff45c8f43ca4f6902624d6a1c5252d57b7d28c3f452b8d2c97cbfd679b8bcb6bc041e90bed2b91b2dff9dbb170ca88b7dce8b7ffbe6428232bca062d5b967a387fc2baff6ea28e5f0b9f108e0e5e3fcded8805c8c2d6b75f818d0296a750187427b18ebc71bfc0f8a609b3773cc9623d794cc2132766f74b84cad1885eee89f2b5ab27e0655a03d8d9567d0881bc78c74fdb80412ea077751550e3c7669f7007e17a6e0fe5b68febde0d2a5cce3622ce1ed9a22869975b2ddcba44a17f0f521ff9e4f55ec92d6e76d2612811ba124e529a8042c03c7b22d7754fe51cd9f49870a2e9886ff8cb9b737bcb0c8907114cf4ea1643e3971c54863409c3568e7869b4069f680eff54b2902deb9f1eb600a62c907bc78e0594262e2178c2ba5a8ad6ed540f0b8e9ab3a0ef025944be6b5fffa2a790783763e007d62a560371766c305dc6a1635fb6b721762752ca3f2fb263db15a541600a81ba068ba229787f0a57836b267e9d59d0d51a6e51190c26668e2d6cd566b0f4582c6c1230611de86e9379c3b5141b11eceb3a49efe6704b26556d3581bd6e7296280914e8d55b14ceacd8e2369a765facc6c7fe8689b4099c6eeea5c88630e4db802451b55988c15a6f69d7e70e3536d85def84154459ea7a39e0c63b55e9375d01a0e2a16f7b143fe84365775567372315b213690f4bc19cb9b396a5b154584d907d9fc4fa6c9032338cc7a0cbaa218f77a5f5a639de36dfe26318c6ec80eb47ead952145d0c355010ba1aaf5c92372fb8bbdb884da0d4137c38ed949e8d10006061f4396129aec66125ac79839e42b221f102e6e03f5e43f3e17f365f8688b68690c349287eabffd06320de998e14f111e03b6253ee9dac620f55e755b3c8e6fd7ce66bc8b487f1c24e6f45d153dc960b0c65edf1e1d8612660627bb4c27f3a101704400d4206b56ec52fe0712c10f0f533982576d3b9549c8a50e7ff5d4d06fc4845011d311422109690248507f0b5d4363e153c96423387e8a69a0a259c2e13d2aa65ada348747cff9bee1bbb334b25eaf76fa9f1278d07282ee5c88417ae983b02f73065db41a4ab2df4b5a70ae8296e7aca11c892c2f0526679d925317cbd44503a47b8ed88efdc581e25b5ae59cecd4a8a26172e83a2ab3a5d6f890d59f72e0bc09517956c942f1265f48758bb73dc2d00b2784afbbb5b3bf06d1abaa738560ad63d7eb7b7f7fa70e7454eeb4b46a48c5267de7f522c60eef86caf123b2f3358fe1cae797489c61e5175f07779c60fc63b1a341487a479eed78d4543d47c2552796f684e18cefd11c5db6b79a0a04769ce7f3cf47a90746a61508baddb0770d5b19df5ee00d7f7a0cf85593e22216aa96e0d4397924f7d6c06d589501d21e6769f231504d5bd4b9dbab52c1277685db280e5e8c99dd1a281495c8e516b443ad3ccbacebfc455e95eb96c2820de6686b19cbb3a023a204a63b435aa729b1c8b23d442d323022cd84964af1ffd8f6c3169a49432331779a617ae075d02bffab16ea9f53a4706d708229fb496ac231c0a970b0c66b45f202ad4d3ba5cc4e92913a1276d52ba7e88830c079a8e9a324d2dfc44a4744e9a2b00c16d683086c624a8b8d96e9d2e901c37003b8a93cedaf70acba6aee0b1f5bd675aacee85f0d7dbba393754c8fa85bd40f37275cff765d57f1c42a8bdbc420a4e33615c541200416380823d2b3cd4ddc15303ff657ccfbb32d329a02b9240103def06834e303b9f07c66222954569e0bec34d5ab21f5b2997d468710b762b461fc7528d2456328e6cadcfc2fcae3852f19302756d8f469edc505aa074234c5ea6d15e16a92f1d26bb97decdcf6c12d0c07ef8bc265056d14a90506a9516aafad372439a3b3e116206a71747dca6a017058423694a9838aaf21118ab2cb74e2ef5fdfb13cc45345e2ef1c760e7a858fa4e1f8a8ac534fe5793ddb2f00015aac0eefcd53cdc0b5786ad6843fd81fd2e76732ee713168a45836f32eee08d20d14b56847fc487fdc5f902db50ce445d5624dfdd5f24373174b3f8baebbf9fb4b5d0e941508d30772fbbd04559c16065a44c8b2578b037af68a4cdc5f860bc8d6935bcb9cfb311a0abf31430ffd829a02c062e9f54f6fab7f63b6532e096372ce9d3df8640829e968b808c0133d0cf24451867e592be06d50679f82b2d0cc7674ebccd62e38e133886b7749dfe409e750b440f7656a744cb5077c02995126561bb903cc744820c43823d47e9c3656f6ac3f6989e276facb2a67f24979cf0116a8852985ed0b1baa5dc738ecedbe75af11d378dbf6a1344aabbcb1fcbad017321d8936df255350d6041798b782086131242830a53abe53a6b6788f051fc7630a966d48e11263425d68506f21928293783f7e97de6491660bb19c0900dd7b772a37d70f9b387abf9206a985520283e6a1e3d38ecf0dbef2762c45db814f9ce1ffa80b50df89db9370dc4116da724959f5c999045f8346381eca7b6becadfe08a1f5d9360cb7deaf7c283b0649c97b980bcda3ac7420c108a046c0a9cdeb9e18d113e834bc941f6d007166a0a8a6848499c45000fd162490ad2f3c99aae4e29e2de95392305f9a4e7806a584e224c3a57cf426a637a1206a1576d1a11b06aceeb9ab0d3bdeb1b5bc5ef41031cf46a89ae49cd89e5aac43e30f144b8d3d96f400aa74fb418dbc6033251c17752ee897c6d85f2991266ae7b8554319c19dbd2b59cce0d15f55dedd7234bcd6e300799d92ce0c07c58b18a60dc6e8177180ab454e085b2ede7690a156ba50948c2577ecf6fcbadcb90843e5ce0e7780e760810385414ef2c35c22da7fa7ee971c5fc128bcb4e70f3e3e51bb4338c9133445c97a1b66097e024c5bccc5147e5aa821f89243de0443d60bfffb52c7c868c7b405c376e469dc37c27df3c87b9b03c5fe6901a57315db9a8c4897d0137bfbc49999648bbd43ff2fb24d5a2d1f1b9df9473f9b6d617fa9a7667ca0ee4b3c8880ce45cedbbcf9b3ec88357419311f0b3fcb09d2ce7f92b558139f320a328c940a91220cc59493e3a0121f0ecf69afcd928e776c7b8b956c22a0dc515fb4f3a7f831ade92d98190f7f0fede19263f5066f8bacf17918975dd41422060b495a42ccd9a99d9baf205dd07ab43b53358db39633516b8d20045f3e21f45fdbd309d417c4ec0177019046f68e1e1386f0bcde5b93bbd32610376969e234a96a7f97fd1b758135207d9c3c27243253212ff150a29318ac883834c7c75cf35ae5a05d66ddc1d776b1875b869d6fbc7bb513de0e86be8d58704dbaca38eb6459b7f8ac45816f6af4c07785149b4b014d7f66ba2467db0876a5a197b54988a717f4327f9fe331650916d94d2da7b00872792558f467304b6e09e106c22e85940317c6a63fcc486b4f92784c7d5371e4b21b3fef20b377929373663d3a6824ace35fd066c5f1233ba7a814357a4ec0cdc5a5f2e5524146aab38fb17b3ed2258be108389a9726d9a123c21a349e0ac2cdcd1447280cf789379daecd7e66056a5f5014f29039f77a4265b61a5d9b543fcc695b1d61c6344be90819ed2f79debd677e3c171727c614e8ffece7adf594c3af147ac9d576da8ea93d0c047d15d9baf23e5ae7ba09f7af5900c4fab9df0c16654e88c317ed08337c270b3eadd272936b76586e1c22f455cd05d857ae3ccdbe2db34c7a54ce200017588cddd6473c57ffe85dbda50bdfab14d189dae7612f64efb195f67eda6ba846e364befb45bfeb8e0cb54f3158efb9f713d6d1960b85a469fee04f89233395c307535777b67ef8e4fa8db6cc37b84ddb1d50b6666cecb67fda037a6d600d31bea90828bddde1cb60bc11e27a652187158570886567c70899a5132743da632fab6fa255cf8cb1a9f5d800a0dc329e1995fd3141b11f7924792fbac3bf22c86ee6bef04c867f3b30902b1e4ec55af8e23417a132fcaf88cb9ff9e1321d86b2730561188444810ab6caba5ed50ba150842b45ed2d614d908df54674e79a513d481ae621c85af7000075412292972eb1f435f3299b85a36191a6f167154d77b5af28f31510c1181e01679732e3776f43a13638d62819fe6c6faa21174e0d479ff7589d0abda1afbe23bed451f25d5c9c431ff86bbf4598b47c674320945eb7167d126861919bcff7eafe20f68c940a929d8a837ed86c12017f46636148da3412c0c381bee86baff594cd730c821a5191723ad4825556658dea3edae269d6e2956cf51e67764b93ed5b0bb06bb9661022cf7e3ee7efd223fe965b1118efc090a930ac09636e7c1a432607d8ff2189b14503168fd226c7d54009f6351d03a106a1a395c3c91c71cfd413aca7327bca435f5396c87c4c224e44d784de0286e2022a8721d9136c9366b8f0de0938042191cb7fadd1017e63ae37cc6ad05e8359cb799bfc4ee059146361c80fe3097e3c138c9eaf15dbc30555dcce16e261075a52fdeddf423c543ef2b85fae0508d25804f7f9f81c98c39daec52371479768e06590186b2a361891b72b1ff2bfb23cb6520de482ebbf10cd688d24", 0xfffffffffffffcff, 0x4, 0x0, 0x2}]) write$bt_hci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="11330ccdf144f96764ed4aab04734c0825808498d42adaa59924dd460e7ea9012aaef2350427d7d89326352befc3da4c9d4ec4aadfaa2d16c8b3da50669ecfcdeb1c29ef54a6bb7dfb07676ed3a5c12c8eb8fb8c37c6436d2e24236a0b2ce34374b2f537adef0a541d3626d3f793f8888921f2a0174815cd38e00151353e654ebfdbb43c0cfb65352c4e0e225374584e34a350fffcd96d6fd547278dc317"], 0xb) 12:03:45 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f00000007c0)=ANY=[@ANYRES32=r1], 0x178) r2 = syz_open_dev$mouse(&(0x7f0000000040), 0x80000000, 0x101000) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0x2, 0x4}, 0x6) 12:03:45 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x7}}) [ 2333.211374] Bluetooth: hci0: command 0x0406 tx timeout [ 2335.258023] Bluetooth: hci0: command 0x0406 tx timeout [ 2337.306481] Bluetooth: hci0: command 0x0406 tx timeout [ 2339.354040] Bluetooth: hci0: command 0x0406 tx timeout [ 2341.403046] Bluetooth: hci0: command 0x0406 tx timeout 12:03:54 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xfffffdef) 12:03:54 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x5}}}, 0x178) 12:03:55 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x178}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:03:55 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x49da, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000240)={0x1}) ioctl$F2FS_IOC_DEFRAGMENT(r1, 0xc010f508, &(0x7f0000000840)={0x80, 0xfffffffffffffffb}) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000000780)=[{&(0x7f0000000000)=""/80, 0x50}, {&(0x7f00000000c0)=""/129, 0x81}, {&(0x7f0000000180)=""/1, 0x1}, {&(0x7f0000000340)=""/139, 0x8b}, {&(0x7f0000000900)=""/136, 0x88}, {&(0x7f0000000480)=""/124, 0x7c}, {&(0x7f0000000500)=""/161, 0xa1}, {&(0x7f00000005c0)=""/117, 0x75}, {&(0x7f00000009c0)=""/151, 0x97}, {&(0x7f0000000700)=""/126, 0x7e}], 0xa) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r4, 0xc018937d, &(0x7f0000000280)={{0x1, 0x1, 0x18, r3, {0xab1d}}, './file0\x00'}) 12:03:55 executing program 0: keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, &(0x7f0000000080)=@keyring) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, 0x0, r1, 0xfffffffffffffffc, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) ioctl$sock_bt_hci(r0, 0x400448de, &(0x7f0000000100)="4529a230347cec0ed45c52c465fc314bb7620b87da829cea14cf6137ce406025e1ef4818c1fdc732648a8e43758ae7471169076747cff50671249bed4c6e805ed277fe6a7067f2d64721329e04f056ff68152b7af0b668487dcbbe8f9fc02d94a745bf6251922e6f8cbe5a8fe6b8ff62fd29c1e2b5990e05f4329c1eba9864158317d5bc506001ff7efafdabfd6c3cfaacbf06a6527f01f1c346c8fcca2173ceb291e3e7127ac7ce1e343eb034afc03dc5bc526354a7fc8355c829135d9ee0e65d8deba2d102") sendfile(r0, r0, &(0x7f0000000040)=0x8000, 0x3) r2 = syz_open_dev$vcsu(&(0x7f0000000300), 0xffffffff, 0x20000) bind$bt_hci(r2, &(0x7f0000000340)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) finit_module(r2, &(0x7f0000000380)='key_or_keyring:', 0x3) write$bt_hci(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="d23200e7ffffffffffffffea5dffac907c0f3750ccf040c51670dae68b6c827506ef19e564080553dd921e9c2b12f4456eec33353f0ac62abc38c7267b43685c506ff8c3680ff079fa816471512cd533cddf93283ac88992f9d3aa34bd5fe97c236bdc360b90ed6777a377dfac41025c6032348a45238415bfa99658df091385a1da644d45f1e8519ef0a4babca3b3a85e9275aa6b13ab05ea4001a6fe654fa12aff71f70692bc7e45943081000000000000000000bd5afe29ec505e0024857f0b863ea8ce013b486f5f1c6aa9c8266baebc743112f4522befb3f35c533ceec91b"], 0xb) request_key(&(0x7f0000000200)='trusted\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000280)='*-\x85-)$#\x00', r1) 12:03:55 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x5}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:03:55 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x8}}) 12:03:55 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x3, 0x5}, 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r2 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) bind$inet(r1, &(0x7f0000000140)={0x2, 0x4e21, @rand_addr=0x64010102}, 0x10) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x1) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$bt_hci(r0, &(0x7f0000000180)=ANY=[], 0x178) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r2, 0x80489439, &(0x7f00000000c0)) 12:03:55 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)={0x200b}) r2 = pidfd_open(0xffffffffffffffff, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000000), 0x6) write$bt_hci(r3, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:03:55 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x404}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:03:55 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xfffffffffffffdef) 12:03:55 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x6}}}, 0x178) [ 2343.450026] Bluetooth: hci0: command 0x0406 tx timeout [ 2345.498085] Bluetooth: hci0: command 0x0406 tx timeout [ 2347.547033] Bluetooth: hci0: command 0x0406 tx timeout [ 2349.595109] Bluetooth: hci0: command 0x0406 tx timeout [ 2351.642096] Bluetooth: hci0: command 0x0406 tx timeout 12:04:05 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x4}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02330c0700000000000010"], 0xb) ioctl$KDADDIO(0xffffffffffffffff, 0x4b34, 0x3ff) 12:04:05 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x9}}) 12:04:05 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:04:05 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="0133070000000000000030976996d9ae9190f3de933d96f5788651745488be0ba4ab377e990b972a84b9fc0887bb3bf3c6ef59355da6e0e33756e2317b6e06ef062a5aa58def48402583cc583295891f6bfe2e8260b26a0dfc9dc06b76967b8378"], 0xb) r1 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r1, &(0x7f00000017c0)={&(0x7f0000000100)=@isdn, 0x80, &(0x7f0000001700)=[{&(0x7f0000000180)=""/233, 0xe9}, {&(0x7f0000000280)=""/48, 0x30}, {&(0x7f00000002c0)=""/248, 0xf8}, {&(0x7f00000003c0)=""/136, 0x88}, {&(0x7f0000000480)=""/4096, 0x1000}, {&(0x7f0000001480)=""/233, 0xe9}, {&(0x7f0000001580)=""/131, 0x83}, {&(0x7f0000001640)=""/52, 0x34}, {&(0x7f0000001680)=""/113, 0x71}], 0x9}, 0x160) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f00000000c0)={0xffffffffffffffff, 0x9, "45239a", 0xff, 0x71}) 12:04:05 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) dup3(r1, r3, 0x0) r4 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r4, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r5, 0x8010661b, &(0x7f0000000040)) 12:04:05 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x6}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:04:05 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="f4320c0700000000000000"], 0xb) 12:04:05 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x2}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:04:05 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0xa}}) 12:04:05 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x7}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:04:05 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:04:05 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="01330c07000a0000000100d0e84a3b4d38aafb862799be0e7a8c9de64eb4"], 0xb) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x20502, 0x10) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0x1}, 0x6) 12:04:05 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = dup(r0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x0, 0x4}, 0x6) write$bt_hci(r1, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0xfffc}}}, 0xb) 12:04:05 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x2}}}, 0x178) 12:04:06 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x3}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:04:06 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:04:06 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x4}}}, 0x178) 12:04:06 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x8}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:04:06 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) r1 = socket$netlink(0x10, 0x3, 0x9) r2 = syz_open_dev$sg(&(0x7f0000002ac0), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f0000000080)={0x1, 0x0, 0x1b, "fc"}) ftruncate(r1, 0x1) [ 2353.690251] Bluetooth: hci0: command 0x0406 tx timeout [ 2353.719739] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2353.736222] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2355.546108] Bluetooth: hci3: command 0x0406 tx timeout [ 2355.738106] Bluetooth: hci0: command 0x0406 tx timeout [ 2357.594054] Bluetooth: hci3: command 0x0406 tx timeout [ 2357.786295] Bluetooth: hci0: command 0x0406 tx timeout [ 2359.834077] Bluetooth: hci0: command 0x0406 tx timeout [ 2361.883015] Bluetooth: hci0: command 0x0406 tx timeout [ 2363.930056] Bluetooth: hci0: command 0x0406 tx timeout 12:04:17 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:04:17 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02330c070300fd0000a1d654bdcd870270003250c44ee1a2c0162ecd2d27c1b4eb048bffff0000385f207924d666d6703473ecdd554a13309486dd8757240ec3cf72bb600c6b1776a92baab18ebc62a155dcc19be01554ecd804afdf"], 0xb) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000080)=0x7f6, 0x4) 12:04:17 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0xb}}) 12:04:17 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x5}}}, 0x178) 12:04:17 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:04:17 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f0000000100)={0x1, @le_create_cis={{0x2064, 0xd}, {0x3, [{0xd0, 0x4}, {0xf98}, {0x9, 0x3}]}}}, 0x11) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:04:17 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:04:17 executing program 7: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000085c0)={0x0, 0x0, 0x0}, &(0x7f0000008600)=0xc) setresgid(r1, 0x0, 0xee01) setgroups(0x3, &(0x7f0000000340)=[r1, 0x0, 0x0]) stat(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_unix(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00', &(0x7f0000000240), 0x1020, &(0x7f00000005c0)=ANY=[@ANYBLOB='trans=unix,cache=fscache,dfltgid=', @ANYRESHEX=0xee01, @ANYBLOB=',dfltgid=', @ANYRESHEX=r1, @ANYBLOB="2c646f6e745f6d6561737572652c646f6e745f6d6561737572652c666f776e65723cf65bae0ce2b5174a873a9f04208a920873e5a92df409c4719bcc2bea335e8ed0eb40e8c48ba79954fbb14b30935fcacd76bbe2d3bf7351476b82feaf806a9d1e7ef48c9cb08efdad3ded59fcc95df86f840e727ac1b9f0582cafb4a364a5a32461c7a7840965624a1502931820665595690265068d98c751fb42fe391789beff7f43fa7f1cb48c7838245efedb934c33568af75deba3495595e802a14f4e32a79e728adc68949f2ea6c2070f32b46408d9700adae9dab1fb2c3a6487123d868a812b5216d72b549260d421b9f236d2660732092b54160e29db59e824212751832727ad16b5455202ef89f099c697c386bd56714eba109c39a7c8554fbc870641afb5eb1bbe987ada919d7dc3afb5b1fbf744e9e59732e4", @ANYRESDEC=r2, @ANYBLOB=',\x00']) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) r5 = dup(r3) r6 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) r7 = dup3(r5, r6, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r6, 0x7, &(0x7f0000000000)=r7, 0x1) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0xa8cc0, 0x0) epoll_wait(r8, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x7, 0x5) 12:04:17 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x6}}}, 0x178) 12:04:17 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x10}}) 12:04:17 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x5}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:04:17 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:04:17 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x3, 0x3}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:04:18 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)={0x1, @le_conn_param_req_neg_reply={{0x2021, 0x3}, {0xc9, 0x7}}}, 0x7) 12:04:18 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x8}}}, 0x178) 12:04:18 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xd}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:04:18 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) writev(r3, &(0x7f0000000280)=[{&(0x7f0000000200)="1d18a42d81824976fc2eab6df1761bcc03764f9babe8941f565e392e04c1f748e6c656ff40b3d2834745ece1087810e57df184e47df922862e168f1574db11093af2c7f46b54bc3fcdfcefa2fca0fe4d1162e2", 0x53}, {&(0x7f0000000180)}], 0x2) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000100), 0x14100, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) memfd_secret(0x80000) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r5, &(0x7f0000000040)={0x20000000}) write$bt_hci(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="81672003c80009f6fe90974f8a438b09905d3d98356badfb616895a5c3de33706f2f0340a84a9046de6c59a688a6f430fe0c6da863606bf93ee1082038bc9211cd089849e4b305889048934b6eddf51ecc131ffc5e592723e0fe317469446b110886884cc2496326526e1469e1bde204536427378e1d6c5d19230937466e94d3a609e4e0290ead7daf43cdd967f54db80501bcfde7d591961baa2be4f3453c2035333d341befc399da1f36ec58ab343d89f460f57dc735acd5784e84afe746811e5260527154ba0eae90cb65"], 0x7) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:04:18 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) io_submit(0x0, 0x0, 0x0) 12:04:18 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x6}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:04:18 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000080)={0x1, @pin_code_neg_reply={{0x40e, 0x6}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}}}, 0xa) [ 2365.979114] Bluetooth: hci0: command 0x0406 tx timeout [ 2368.026049] Bluetooth: hci0: command 0x0406 tx timeout [ 2370.074032] Bluetooth: hci0: command 0x0406 tx timeout [ 2372.122123] Bluetooth: hci0: command 0x0406 tx timeout [ 2374.170009] Bluetooth: hci0: command 0x0406 tx timeout 12:04:26 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:04:26 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x4bdf, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0xa6}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) epoll_pwait2(r4, &(0x7f0000000040)=[{}, {}], 0x2, &(0x7f00000000c0), &(0x7f0000000100)={[0x2]}, 0x8) 12:04:26 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x11}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:04:26 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$PTP_PEROUT_REQUEST2(r1, 0x40043d0d, 0x0) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:04:26 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x8}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:04:26 executing program 3: ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000180)={@empty, @ipv4={'\x00', '\xff\xff', @dev}, @private0={0xfc, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00006}) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f00000000c0)={@loopback, @dev, @mcast1}) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000180)={@empty, @ipv4={'\x00', '\xff\xff', @dev}, @private0={0xfc, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00006, r3}) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCDELRT(r4, 0x890c, &(0x7f00000000c0)={@loopback, @dev, @mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3}) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000000180)={@empty, @ipv4={'\x00', '\xff\xff', @dev}, @private0={0xfc, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00006, r7}) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCDELRT(r8, 0x890c, &(0x7f00000000c0)={@loopback, @dev, @mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7}) sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xdc, 0x0, 0x10, 0x70bd25, 0x25dfdbfe, {}, [@HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4011}, 0x50) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r9, 0x800448f0, &(0x7f0000000040)={0x1, 0x2, "7353c7", 0x53, 0xd3}) bind$bt_hci(r9, &(0x7f0000000000), 0x6) write$bt_hci(r9, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:04:26 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x177}}}, 0x178) 12:04:26 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000380)=0x1) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000100)={{0x2, 0x1, 0x4, 0x1, 0x9c6}, 0x1, 0x101}) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) linkat(r1, &(0x7f0000000200)='./file0\x00', r3, &(0x7f0000000280)='./file0\x00', 0x400) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r3, 0xc0189378, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r1, {r1}}, './file0\x00'}) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r5, 0x40485404, &(0x7f0000000300)={{0xffffffffffffffff, 0x1, 0x4, 0x1, 0x1}, 0x82d1, 0x4}) r6 = dup(r0) r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r8 = syz_open_dev$vcsn(&(0x7f00000003c0), 0x557, 0x101000) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r3, &(0x7f0000000400)={0x2}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB=',wfdno=', @ANYRESHEX=r7, @ANYBLOB="2c00198d86c38bc010b3aa19848ec74fc4385d3e21a9f68b05226cc5f72682f29a7e023a4774301481ab5e41282cac3326d8a514e22b9916b2f5ee9fad7bc92eab574156a1405268424e8502d88e4d11ad2215d270b8e92eb0e6ecf067c49ce9c93afb3d3d4b8546f004aaad28c8a3bd96e8abb0ced8b2031d114f"]) 12:04:26 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x500}}}, 0x178) 12:04:26 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)={0x1, @write_class_of_dev={{0xc24, 0x3}, {"74bc52"}}}, 0x7) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:04:26 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x10}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:04:26 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) [ 2376.218050] Bluetooth: hci0: command 0x0406 tx timeout [ 2378.266173] Bluetooth: hci0: command 0x0406 tx timeout [ 2380.314040] Bluetooth: hci0: command 0x0406 tx timeout [ 2382.362043] Bluetooth: hci0: command 0x0406 tx timeout 12:04:36 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @le_set_ext_adv_data={{0x2037, 0x23}, {0x9, 0xc8, 0x7, 0x7, "88be90f865d46769d67f327041f02ac9408f39e42648803bb48aa8c6289d18"}}}, 0x27) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, @out_args}, './file0\x00'}) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x1, 0x6, 0x3}) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000100)={0x4, 0x2, "80d534", 0x3f, 0x40}) 12:04:36 executing program 7: arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000040)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f00000000c0)={0x0, 0x2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:04:36 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x300}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:04:36 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xe0}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:04:36 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:04:36 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x248400) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) chdir(&(0x7f0000000040)='./file0\x00') 12:04:36 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x600}}}, 0x178) 12:04:36 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="02330c07000000000037cee08e393d000000d2a3ef1fa0fb434bc8ee2cffe76aa048a399a3c3dc5978fd461adbe1d3ec7462f1c6d000d82eeb0080c26323ac02311805598552929098a82b7940abd8ea832dae21abdc6d056605d89dd44eca63c5ff7d64ba9b4d522055df7458dad241f407000000000000002a8c80dfd9b9c136321d96fb850cc5c466426c434d9f270da50857ce230bbb2b4f85a6cd89c354d9305bfc55a34fbea3aa77470be8a7b30f7b62f92b7dbfa8b6cf84302447b0520596d9945cf04878811eb55f8c3501b99c76da78b53352d2045057e93f05f71989e233060fd68b7cfb46eafa844f60a6befb286717b252b68810eccfa03951717c78dfdcad76703493557b6d24646d2995f75bb07f046544573040d0b1f158222d2d4f53af98"], 0xb) 12:04:36 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x7701}}}, 0x178) 12:04:36 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:04:36 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000280)={0x4, 0x5ade, 0xffff, 0x0, 0x7}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) pwrite64(r4, &(0x7f0000000140)="9a3f45aff6137b871d200e765e265e81e82db024ead8628437cee68825225cb89f8fad392686", 0x26, 0x6) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f0000000240)={0x200b}) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r3, 0x40485404, &(0x7f0000000040)={{0x0, 0x1, 0x7, 0x1, 0x5}, 0x8, 0xb6}) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r6 = dup(r0) r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB=',wfdno=', @ANYRESHEX=r7, @ANYBLOB="2c00b47d8c3802007188257167b90aa3f2975fe5fcffc8ebaf712fb659f99983e38f9fd127d3351eac791653"]) 12:04:36 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x500}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:04:36 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xf4}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:04:36 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x4}, 0x6) shutdown(r0, 0x1) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x1}}}, 0xb) 12:04:36 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) [ 2384.410027] Bluetooth: hci0: command 0x0406 tx timeout [ 2386.341918] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 2386.346726] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 2386.351664] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 2386.361677] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 2386.364717] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 2386.458195] Bluetooth: hci0: command 0x0406 tx timeout [ 2388.378516] Bluetooth: hci6: command tx timeout [ 2388.507429] Bluetooth: hci0: command 0x0406 tx timeout [ 2390.426068] Bluetooth: hci6: command tx timeout [ 2390.554998] Bluetooth: hci0: command 0x0406 tx timeout [ 2392.474081] Bluetooth: hci6: command tx timeout [ 2392.603039] Bluetooth: hci0: command 0x0406 tx timeout [ 2394.522059] Bluetooth: hci6: command tx timeout [ 2394.651191] Bluetooth: hci0: command 0x0406 tx timeout [ 2396.700111] Bluetooth: hci0: command 0x0406 tx timeout [ 2398.747046] Bluetooth: hci0: command 0x0406 tx timeout [ 2400.794037] Bluetooth: hci0: command 0x0406 tx timeout [ 2402.844003] Bluetooth: hci0: command 0x0406 tx timeout [ 2403.753071] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2403.754799] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2403.812733] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2403.814025] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2404.890051] Bluetooth: hci0: command 0x0406 tx timeout [ 2406.938045] Bluetooth: hci0: command 0x0406 tx timeout [ 2408.986635] Bluetooth: hci0: command 0x0406 tx timeout [ 2411.034072] Bluetooth: hci0: command 0x0406 tx timeout [ 2413.082048] Bluetooth: hci0: command 0x0406 tx timeout 12:05:06 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x2}}}, 0x178) 12:05:06 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:06 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x600}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:05:06 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000000)={0x90000000}) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x1b) 12:05:06 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x300}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:05:06 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x400, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:05:06 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000100)={0x0, ""/256, 0x0, 0x0, 0x0}) bind$bt_hci(0xffffffffffffffff, &(0x7f0000001700)={0x1f, 0x1, 0x2}, 0x6) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000300)={0x0, 0x0, {0x0, @struct}, {0x0, @usage, 0x0}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000700)={{r0}, r1, 0x12, @inherit={0x70, &(0x7f0000000040)={0x0, 0x5, 0xffff, 0x6, {0x12, 0x4, 0x1f, 0xfffffffffffffffb, 0x101}, [0xfffffffffffffffb, 0x7, 0xb5b, 0x2, 0x100000001]}}, @devid=r2}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r3, 0x8982, &(0x7f0000001740)) 12:05:06 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x1}, 0xffffffffffffffbc) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @le_set_ext_scan_params={{0x2041, 0x26}, {0x3, 0x5, 0x9, "8802e2a82c60cf33237508df12a9f8416e440ec2176b6cce3827a28d69c882555b9232"}}}, 0x2a) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syzkaller0\x00', 0x10) 12:05:06 executing program 0: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000100), 0xffffffffffffffff) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r1, 0x100, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_LINK={0x8}, @GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_TID={0xc}, @GTPA_PEER_ADDRESS={0x8, 0x4, @broadcast}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_NET_NS_FD={0x8, 0x7, r2}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x800) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000000), 0x6) write$bt_hci(r4, &(0x7f0000000080)={0x1, @inquiry={{0x401, 0x5}, {"04008f", 0x7, 0x40}}}, 0x9) 12:05:06 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:06 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x46) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x80082, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@posixacl}], [{@func={'func', 0x3d, 'CREDS_CHECK'}}, {@fsmagic={'fsmagic', 0x3d, 0x400000000}}, {@obj_type={'obj_type', 0x3d, '{[&,&,-'}}, {@fsmagic={'fsmagic', 0x3d, 0x81}}, {@pcr}]}}) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) recvmmsg(r4, &(0x7f0000007500)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000100)=""/108, 0x6c}, {&(0x7f00000002c0)=""/247, 0xf7}, {&(0x7f0000000400)=""/28, 0x1c}], 0x3, &(0x7f0000000540)=""/172, 0xac}, 0x100}, {{&(0x7f0000000480)=@nfc, 0x80, &(0x7f0000000b00)=[{&(0x7f0000000600)=""/217, 0xd9}, {&(0x7f0000000700)=""/199, 0xc7}, {&(0x7f0000000800)=""/248, 0xf8}, {&(0x7f0000000900)=""/164, 0xa4}, {&(0x7f00000009c0)=""/79, 0x4f}, {&(0x7f0000000a40)=""/153, 0x99}], 0x6}, 0x9}, {{0x0, 0x0, &(0x7f0000002080)=[{&(0x7f0000000b80)=""/108, 0x6c}, {&(0x7f0000000c00)=""/134, 0x86}, {&(0x7f0000000cc0)=""/191, 0x106}, {&(0x7f0000000d80)=""/188, 0xbc}, {&(0x7f0000000e40)=""/27, 0x1b}, {&(0x7f0000000e80)=""/201, 0xc9}, {&(0x7f0000000f80)=""/4096, 0x1000}, {&(0x7f0000001f80)=""/252, 0xfc}], 0x8}, 0x6}, {{&(0x7f0000002100)=@can, 0x80, &(0x7f0000002480)=[{&(0x7f0000002180)=""/205, 0xcd}, {&(0x7f0000002280)=""/157, 0x9d}, {&(0x7f0000002340)=""/1, 0x1}, {&(0x7f0000002380)=""/234, 0xf7}], 0x4, &(0x7f00000024c0)=""/34, 0x22}, 0x40}, {{0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000002500)=""/15, 0xf}, {&(0x7f0000002540)=""/227, 0xe3}, {&(0x7f00000077c0)=""/4103, 0x1000}, {&(0x7f0000003640)=""/1, 0x1}, {&(0x7f0000003680)=""/64, 0x40}, {&(0x7f00000036c0)=""/13, 0xd}, {&(0x7f0000003700)=""/137, 0x89}, {&(0x7f00000037c0)=""/96, 0x60}, {&(0x7f0000003840)=""/147, 0x93}, {&(0x7f0000003900)=""/203, 0xcb}], 0xa, &(0x7f0000003ac0)=""/11, 0xb}, 0xfc0000}, {{&(0x7f0000003b00)=@nfc, 0x80, &(0x7f0000004cc0)=[{&(0x7f0000003b80)=""/4096, 0x1000}, {&(0x7f0000004b80)=""/58, 0x3a}, {&(0x7f0000004bc0)=""/217, 0xd9}], 0x3, &(0x7f0000004d00)=""/217, 0xd9}, 0x7fffffff}, {{0x0, 0x0, &(0x7f0000005380)=[{&(0x7f0000004e00)=""/123, 0x7b}, {&(0x7f0000004e80)=""/19, 0x13}, {&(0x7f0000004ec0)=""/17, 0x11}, {&(0x7f0000004f00)=""/141, 0x8d}, {&(0x7f0000004fc0)=""/254, 0xfe}, {&(0x7f00000050c0)=""/161, 0xa1}, {&(0x7f0000005180)=""/210, 0xd2}, {&(0x7f0000005280)=""/215, 0xd7}], 0x8, &(0x7f0000005400)=""/192, 0xc0}, 0x7}, {{0x0, 0x0, &(0x7f0000005880)=[{&(0x7f00000054c0)=""/118, 0x76}, {&(0x7f0000005540)=""/66, 0x42}, {&(0x7f00000055c0)=""/143, 0x8f}, {&(0x7f0000005680)=""/251, 0xfb}, {&(0x7f0000005780)=""/245, 0xf5}], 0x5, &(0x7f0000005900)=""/74, 0x4a}, 0x6}, {{&(0x7f0000005980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000007080)=[{&(0x7f0000005a00)=""/214, 0xd6}, {&(0x7f0000005b00)=""/149, 0x95}, {&(0x7f0000005bc0)=""/185, 0xb9}, {&(0x7f0000005c80)=""/112, 0x70}, {&(0x7f0000005d00)=""/4096, 0x1000}, {&(0x7f0000006d00)=""/230, 0xe6}, {&(0x7f0000006e00)=""/156, 0x9c}, {&(0x7f0000006ec0)=""/211, 0xd3}, {&(0x7f0000006fc0)=""/162, 0xa2}], 0x9, &(0x7f0000007140)=""/255, 0xff}, 0x101}, {{&(0x7f0000007240)=@rc={0x1f, @fixed}, 0x80, &(0x7f0000007400)=[{&(0x7f00000072c0)=""/106, 0x6a}, {&(0x7f0000007340)=""/183, 0xb7}], 0x2, &(0x7f0000007440)=""/187, 0xbb}, 0x100}], 0xa, 0x2141, &(0x7f0000007780)={0x77359400}) 12:05:06 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x4}}}, 0x178) 12:05:06 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:06 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x810}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2415.130047] Bluetooth: hci0: command 0x0406 tx timeout [ 2417.178036] Bluetooth: hci0: command 0x0406 tx timeout [ 2419.226065] Bluetooth: hci0: command 0x0406 tx timeout [ 2421.274048] Bluetooth: hci0: command 0x0406 tx timeout [ 2423.322101] Bluetooth: hci0: command 0x0406 tx timeout [ 2425.370025] Bluetooth: hci0: command 0x0406 tx timeout 12:05:18 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0xd73, &(0x7f0000000280)={0x0, 0x0, 0x2}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:05:18 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="01ffffffff"], 0x5) 12:05:18 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x33a}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:05:18 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f0000000040)={0x1, @remote_oob_data_neg_reply={{0x433, 0x6}}}, 0xa) 12:05:18 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x5}}}, 0x178) 12:05:18 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffffff, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:18 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x1008}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:05:18 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) mount$cgroup(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x220000, &(0x7f00000000c0)={[{@subsystem='memory'}, {@release_agent={'release_agent', 0x3d, './file0'}}], [{@smackfsfloor={'smackfsfloor', 0x3d, 'rfdno'}}, {@measure}]}) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:05:18 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffffff, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:18 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x6}}}, 0x178) 12:05:18 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1, @le_read_remote_features={{0x2016, 0x2}, {0xc8}}}, 0x6) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=0xee00, @ANYRES32=0xee01, @ANYBLOB="2e4f21a40661db5094bb1cc9aa642f66696c653000"]) ioctl$sock_bt_hci(r1, 0x400448e0, &(0x7f0000000080)="17fe70764d839cef27a1b2033442f524a5dcbae230b6") 12:05:18 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x4000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:05:18 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x3c0}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:05:18 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="7472616e733d66656646340bb3e7ae", @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',\x00']) 12:05:18 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x2}, 0x6) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000100)={0xa0000000}) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02500c0700000800000000"], 0xb) 12:05:18 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x8}}}, 0x178) [ 2426.211718] 9pnet: Could not find request transport: fefF4 ³ç®0x0000000000000004 [ 2426.280557] 9pnet: Could not find request transport: fefF4 ³ç®0x0000000000000004 [ 2427.418045] Bluetooth: hci0: command 0x0406 tx timeout [ 2429.466022] Bluetooth: hci0: command 0x0406 tx timeout [ 2431.514028] Bluetooth: hci0: command 0x0406 tx timeout [ 2433.562025] Bluetooth: hci0: command 0x0406 tx timeout [ 2435.610248] Bluetooth: hci0: command 0x0406 tx timeout 12:05:28 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffffff, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:28 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x500}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:05:28 executing program 0: ioctl$SG_GET_ACCESS_COUNT(0xffffffffffffffff, 0x2289, &(0x7f0000000140)) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x800) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f00000000c0)=0x7, 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = accept(r1, &(0x7f0000000180)=@pppoe={0x18, 0x0, {0x0, @local}}, &(0x7f0000000200)=0x80) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$bt_l2cap_L2CAP_CONNINFO(r2, 0x6, 0x2, &(0x7f0000000240)={0x7, "e73e08"}, 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYRES64=0x0, @ANYRES64=0x0, @ANYRESDEC, @ANYRES64=r0, @ANYRESHEX=r0, @ANYRESHEX=r1, @ANYRES64=r0], 0xb) 12:05:28 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x11000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:05:28 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x177}}}, 0x178) 12:05:28 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000300)) r5 = dup3(r2, r3, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r6, &(0x7f0000000180)={0x80002001}) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) syz_io_uring_setup(0x74a4, &(0x7f0000000000)={0x0, 0xb27e, 0x20, 0x0, 0xe9, 0x0, r5}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0), &(0x7f0000000100)=0x0) syz_io_uring_submit(r4, r7, &(0x7f0000000140)=@IORING_OP_FALLOCATE={0x11, 0x3, 0x0, @fd_index=0x2, 0x1000, 0x0, 0x9, 0x0, 0x1}, 0x4) 12:05:28 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="2c5700646e4409030091426f3d", @ANYRESHEX=r2, @ANYBLOB=',\x00']) 12:05:28 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000040), &(0x7f0000000080)=0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) [ 2435.735150] 9pnet_fd: Insufficient options for proto=fd 12:05:28 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="02330c0700000000000000c80d13be485a4457995c46bf0509c07e905f584fe6966c2af98fd9d2f96385c63405e8a34dc3c2619185b2704f0a72b627708a4f4c4f51da380cfb53e8fbda5cccb59f2ffa80328fb7d71d33f0e3369b9e715743533a674347326e4356112da38c4376c9efcf"], 0xb) [ 2435.748161] 9pnet_fd: Insufficient options for proto=fd 12:05:28 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:28 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x500}}}, 0x178) 12:05:28 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f0000000040)={0x1, @read_enc_key_size={{0x1408, 0x2}, {0xc8}}}, 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) ioctl$int_in(r1, 0x5452, &(0x7f0000000100)=0x9) 12:05:28 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x34000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:05:28 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) bind$802154_dgram(r1, &(0x7f0000000040), 0x14) 12:05:28 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:28 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000100)={0x2}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$sock_bt_hci(r1, 0x800448d2, &(0x7f0000000040)="224cbacb35f6415058aa7624f9afb9240fe2d89b2f0d36ef1b21dd6c") write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) [ 2437.658040] Bluetooth: hci0: command 0x0406 tx timeout [ 2439.706039] Bluetooth: hci0: command 0x0406 tx timeout [ 2441.755166] Bluetooth: hci0: command 0x0406 tx timeout [ 2443.802020] Bluetooth: hci0: command 0x0406 tx timeout 12:05:38 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x600}}}, 0x178) 12:05:38 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = syz_open_dev$mouse(&(0x7f0000000040), 0x1, 0x80200) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) write$bt_hci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="02330c070000000000004adef08546ec8a67fd265a04c4e2a8008ff69d5db07a33419f18f9bd8eff09884f2ec7b2f36815509e8c2787d5f891f62595a2d7d92e483399ff08186b1f0eb774a7201215be644d70c0c8cffb925c089b1849eca582071ca92ea546a8c1392bdadf4f0de54f44c1096953060cd46a28c6a1710c0c"], 0xb) 12:05:38 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x600}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:05:38 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x80000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:05:38 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8982, &(0x7f0000000040)) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:05:38 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:38 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) r3 = perf_event_open$cgroup(&(0x7f0000000440)={0x2, 0x80, 0x9, 0x5, 0x8, 0x9, 0x0, 0x6, 0x8400, 0x6, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xa32, 0x1, @perf_config_ext={0x40004, 0x8000}, 0x8000, 0x8, 0x47f, 0x4, 0x7, 0x3, 0x1, 0x0, 0x80000000}, r0, 0xc, r0, 0x4) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f00000002c0)={0x8}) sendmsg$nl_netfilter(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x860080}, 0xc, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="58000005130f01012abd7000fe59ff902c7c99ebe46d957a58ec303709c51708000000cdaf51abf6f73987c63d3e830840498ba9e3ef832395520219f422c5e93c83855355e717794b6105c6a68b007c345d82745a620cca6cd369955f3c0d52f007e8b889d199f884fe572b8a6f3960be70dc079e9e4f866f7f702ad6268e99664aa93cce221bf5d20c848be17fa787a5efabe4505c19f76c130659d62db42fc7643c6825332a5ed14036f29699c9297d820c649504fdbc6a0b4731a57a21ed54d1adc38f1af133a04e8da741000000000000000000"], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x11) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) r4 = memfd_create(&(0x7f0000000000)='\x00', 0x3) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000040)={0x4}) r5 = epoll_create1(0x0) r6 = dup(r0) r7 = syz_io_uring_setup(0x7184, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x2}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r6, r7, 0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:05:38 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r3 = fspick(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1) ioctl$FS_IOC_SETFSLABEL(r3, 0x41009432, &(0x7f0000000200)="0f9041e3f5c9afc4ad23cad05a3a806a4508f9794b0eaf6ac7d9950dd6e61624d6e76d9963e9bb63698d7f7127a455ad996334aa3abe5e2c055fd87e6a1b2e8309937529e0e3f4fd4c78f98c12bbe55e21f2015a1ec103aea44b45b831712c61568d5dfb24803674c22d657b08063602a3a670dd8c4f88c20ec5ecc9e4f372f0a30af0268eefa46a3d1ca867ab24e124529ac3cdcd6e081d4d4a60cba31a2b28858b89f7b9c1c94f64b901d2b9afd90e79ac26e32d3604549eb2ea5bac065d30d9cf9e3d9f77249e4aa949d931fcb67c9d9c6fd595b185a960f093e98930a0ee417af0cbe5bdcb73f26ff8560eaefdc554dccbd51e891bd8ff1de2b5e524fbb4") r4 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000140), 0x20000, 0x0) statx(r1, &(0x7f0000000300)='./file0\x00', 0x4000, 0x20, &(0x7f0000000400)) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x30, r4, 0x0) fsync(r0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x10820, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="06052b26414fee8335678e92c0684047d5ed81a3f80b8510751e5ea0a8f13eb68a860c72228799c3ef868ef8a9b32188c0f489286100"/64, @ANYRESHEX=r2, @ANYBLOB=',\x00']) [ 2445.643835] 9pnet_fd: Insufficient options for proto=fd 12:05:38 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:38 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000040)={0x3, 0xe1e, "76c364", 0x81, 0x2}) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:05:38 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x100100}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:05:38 executing program 5: keyctl$clear(0x7, 0xfffffffffffffffb) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xf0c}}, './file0\x00'}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000000c0)={0x0, 0x0, 0x4, 0x0, 0xf}) r2 = dup(r0) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB="2c776664df6ecb55", @ANYRESHEX=r3, @ANYBLOB=',\x00']) 12:05:38 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x700}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:05:38 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0x7701}}}, 0x178) [ 2445.850639] Bluetooth: hci0: command 0x0406 tx timeout [ 2445.883777] 9pnet_fd: Insufficient options for proto=fd 12:05:38 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) [ 2445.904321] 9pnet_fd: Insufficient options for proto=fd 12:05:38 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) pwritev2(r0, &(0x7f00000012c0)=[{&(0x7f0000000040)="7b9875f07c74028d1a9d2ecae078043198b102e644732c409a91610ba8d048fd47bd202de8b570c88e3fd3fda157494df84b224b9c5967bd86d084d1fe9e80a33b764f87c7bd1f5984cba315a080b597a1f0aecc2cadc976302570ad870623117f40d0e7243304edad8d42c809bb75a93f48279a4b60b82b3e", 0x79}, {&(0x7f0000000100)="c5176a287ff75dbaf42d7d66a61103a390b66530c52d0f36a16145e4f54ebd4171f901eaa594e1e9b8541028d39714af6cd7745dba45678f3fa3967fa17377149e31de54d129d0d0265484fb0726c4b4800638bfa7d56237c4fd11d49ca055860ce01010d5a28791642672b8d21912f2621e8f738e0158d23f2f4e271fd1a0427b3f12150c81e4516e1132e89f17c64eb0262c92b0a6127cdeba9606f8f01a4ac7fd91411f4ea29ac5e1132babdda8f9031b7accbdb9d01e1b32e0703576a66c465b46ef714f079b8e6019da6872f417e622b9edc2dd71d008fd2e3e0556d266d338b1edd15c26b56e8f2bcf05c1f1054a1c2103f7ba869a4c375cf7826348", 0xff}, {&(0x7f0000000200)="39b34b07f6a9eba07bcb528a943ff0fb6cfd5b0885ccb5865986935dedbea6cf57a2eaff538ad3fa50cc0080e6276bca24a8cb7f94ab061b987c2b9ae5535bf275e8fe903a4c04169ac432d64f4392b4eea76dff49dde160099f6bfb8aba3623b29670e140524947c3891d80f4a2d2b62017f1405e94ca4446dbba3344676f9967b88c11ec81eb4beedece8e9b0523214e1f35c260b07433bf78df467f2c377935642c388eb5850ecf2c386cab756f27cf1c3ccee5c51e05e56aaaa1d6bb70df5c40cee45e4cd761fd9fc8cf7acfa65044a44f1ad0294667a57b4eb50aaa52ba9b348538cdee440b8b48db3321b2dfd76a4a9fd4426b289bd0c56066cd9ad5921969c117e86f50bd00ea375660eaa3b94d31fe6d539302535e029bd75b92dd719ea874aa8f4c89d4e0de5236728e3e5b66f99299cb80389c7180f2702e6d2e8fdba3e89c66b9df0b0946096d63ef0fd09bb430252b85acbd41d9f424d5145bfddd6e9fcaba3d0b5fc7afb06e9f1a719b5477c48018e1b38e2bb9d7dac1659cd3a0c5acd32a17e8da6c1972cfe2b13fe4f721fdf4a02b2482cb8f5246a239370275204806928604f82ec79ea3faff337038dc3a8e7052b397e36bcc8ef3b8568037a4bec35f49ec90bdb884bd9339daff53ea4227b79d7c26891c716811f60eb8665026336c3f3b785044931503bbd07e4c4cdb97b4aca8db118439f57ee9b071198a98426f074d3bc67ba2095fd0b64f5fd722923603a1302d3661ddc2a646e9a8bf810609e1f41c2dc6748fee41b4975e6185e57b984ab713e635249d45c6f0493855b94e3a0f636c7642e376788a5093d35e6f36b3f13b028ba952b9d3f04884e6bc27cf1626288893638863c60fc7fb3876259770c465e55a0c9e2d46e9c83d3e76170becdc035a2c39bd022d2fc07b6c44407f3032815797b457233ea3b4ccf5b23740a541bf47fd65a28935ed25aae32092e474e60d9799c3295e3023e506a9be7ae1b99a762000ebc031c56f769829e51c572a8d326b78ebc82403d241b7dffc2ea8a2e96a0558ab0c6e35175dd79c1386e4e172faf12f8b12413b3505e37984694d3aba77074af1e46bed107f8d55597e078d0d32a5701c79c4d0b012902dbb80de0e659fd0f506dcac69f78a8ef8da52304f499a977c7b7f3a40fc4fcbe49953d3c0a3d6ffee1a56d77c1d313ae90c972576d5df28cddc0f7e4b0aa4b955ea47de8770f12639e20a3d5c8c3d7a83540fbbd26a842a236abe1a4138ae6f6fe305712045a54338907e2c6ca250c1d0d8429843894d844d9d672b31bc0a646408abf95e3b3bc860051746320f3e69fd1bdebded6283983b213bb6e433cb9449aedad0efd3adbd48086243cfcc785dca2ad65b9548c62ff8dbac26cd980f3b44fc0f344005fa4cdd48ce7a64e7ca63b5d39c59cc25b4fa589e4e46a5378d7d20a2a60ce8daa0c190d3861274ab6ee21d07f4bc00d29de2d4d8e49dc16e47244b19b9c7f41dcbeb2a2db0b29ecf03fdd254731e5b34efbb415e17d2bb225edbb42c47916bc899df2a917f3a0abe499ca67b4eff7b9bb55a38e4984087ed36bbd32b7c9f72b29c5bcbd63bdf349b697bdce7214b80b79e278716a4b1834635fdfc895df0afee974a9fb35800ced89710f5545f9ebcd8588b785d2ec4f35ceb88168a267da7a6f5c3c63113e0b6824fddc3d43f5eeb993ec771b3beeb367b93252524ebf5e316ea17fbc48402c6ac2e030a6e464b9454b808cae735a92d970ab6d4e235c33899a3f269b6ddd9558e147c80847c4066c25c9200356b0d1d19b4c016ed14419b8c6cb15ffa278334cbe1719db3861af2f6723984b931b7365ab217a097e9ae5677f39ecd950aa90c3706710a6871e355278943d7f352b384e087e2f900fc1607c63a47664ecc4dea18fafaef3a10280466b9c96a3dd3ba6f10a2c2200fc989b9f3a3004c1d4f8650077a8c14513309aca5580d77449b0b90462b97375dc62fb01f88942d64c30ea80ed42dd84eb9ac3a4a8614c61eed99fc1ea37ba948281f4192d847a6cf34aae22497d595adaf9c5387cfc29fd5af5eeb5a3ca5c80ab2c6cfdcbf77a97cf11a7874f5167935e0bd5f67400e82badec63a741b9de710e067903997f1994914a14b7d58db8e177a784c851df08fd1e10f9660f378852b7eda7ca28abd97187c9e1c5c82b1dcf4aa01a41f24a8d39bb00cb6ff5f2b1f788375eda0b4bb42e7fd0083aeb77d4177f37ef61ca7eb797abbd8421c734a6e199cb1e85073668ba56db79b4f433cb6965ac93bbcc092e5b494718577951b9d9546f903a428499df1504866ddf3bfca15ccc95b57d578d930bb11f4982bc6a5cd1828277790823b28f63adb9344fdebaa7b21649fdac9f245367e3007ea885a1fe02574d329b1a64559f85845ba4af7f847a4bbf7ed112b3e0fbb9818e06b01114c224fefe29a99dbb5e3fa55d5188cea55337e6d04478e4e2d7561ad72f1a0d62590acf7b2e0c2dbbaad9ed28411f246ae9c3fe8c5104ec70d07fe37056f65b594221f4149e321a2b19791e63eb64cc48a6974ba6afc715603b319af81a8d6c7e98d178e36206c589d77b8e5036a9a65c318caa6a87ea277902a988e658c5f773b2c179a0f10a1575411675699f3cfea5a037444e2749cf7b28ad0500f592acbd8f555a86e208d0d38c83c67e833ce23af39f075dead03cea886a218f59357b3c422414ef5a30ee3dac849fb09362e17b16e4fb0bb67758edb7b1b63763efee8c083e79fe64117be9320962a02d9c36a48e48b2e9d94ee7900c809fa08db59c08101975ef7392f7bc560c213a5f5bc341af9c7a7fd5adf35e7452a25ec0d75521a0552060232ac515dd68335db4b405a8360da320b78feb074b6cc414e2e591a66f02f172f6be08271ef2c950c9a1d1552e7aaee04e9b9d0019cf2cd8b07c1ff8b59463431147962707c280fc6faddb68549f5589db9da4b1ed8ecd482eb7a7acc5351619742c8b618dca7f069f4a3daef87b1348a9ee28366ea715ace1e1f4dc4d6a6ff017a8d1895cfe75201eb4ed4cd7c157a5041bb3e19efc89c9208ab51999dd9a430219400cf2c345a95370b4b31bb3fe83a6f1ec9bb1ce5bc45774fcbc899bec317470de24577ca5ea02dd458b1fc3fa831ccf6ac3018982c459f6e09644c89b3783a853ec166a6fcb9d2f1268adc596dd6d16aea8cbaf8eed94ac3d55d427158293882d570c3d86e23d8b7f1747ea52dd0f577e2cf8ddd6ebe366b207ff83403e3b1be57a8ccfc878c4526a1bf21e71c295baaf03e0a080d000dac6a37a1d78d899dc56eb4fbf1c8e617f116320ac74a7cbf62a6d7d1299b0166d003463140a838609494f8bcab70e5753129170c3c1772e609d5be1713ad60cfa937fd0ec9fb18ac41931bf7d1af111be3a9b7399110fc72d091cbaf7e68fad7b23862e40b4c9abd9959b5d1d4cb062c6e6e6964448223d398252a67ba9ae6f5ae467748554ff9dbc672db22737eb01462aacf3ddda137b33ec06d15c7d9b8caf8ad4e07a4aec8bed92f746d7f815f14c31e4254c168607b092dc5647f9c901085b648cb2b4f11e5b445b3d6b5022408627443acf22cbf9ec75e518b274fad21c078745c1d8c6fe7b40a0366b8df4781a0b4050a26d197d22bbf20b2c60563e606a7a25680df5658d66f50001dad02bd42c663ff48d4e768d2adb4de21ddd55b6a0b1c8410c97c2811bf7c5b0705e641c0546320644b203710094bc5fef99f3f8f981947246b8252687bc5ebac20487de4fb1fa7fdcde4d27d43300dc55cb6d21a6f02fd6dc22475d4410df4bf4562d78e3881573da9057408b832a1a657b680a73bc2bbc6dcc4eb8ab101d258248e89cf9dcd297de0eedb5e2c5d4c7d419dd0622781763ddf1cc5cbd48f5468c9c4079ec5296381f5ef83fcf31e3d0912890a655dbc1cf8f289f57bd85afabe14d39c5cb67188b465be2fae70629892fb7a74d32a0d026f0974cd810cd61beac77c82797274b4044f596593e4239c92fd7eb68b04008ebe9e0c1d11ed26c7ae80d7550c9184fcc457b0c043632949eef6f8c592a008d557710d6a3e42708d4d44b68d4cdf8ac2b1e0bff40be14d5ac9c53b51623f4c972448fddf8fb8d5484c8a3fc5e04eb901644dc72d43a685cef8ad2df4e71c9cf634866aaa41313f21d5ab74a8e94c79ca47e982871bac13368fc0ab33dbd469c100760999080174dd128bcce8a9bf47fed238c2cec149c8157fb8f337c1cdac9724958c2f6e7a242efc8e5d8079196012863951ec5697830ebd62a1773f01aa35af1bb289dcb2c5f3080f3ff879cfc1009f1cc6221ba5401494a40982e2d3ffc7d7ad4185a28993d517430fdc1ea368eba3a7bcb28def219ef5a292742fc8791862cc0e32950851a21df21142d5cd59c2f71e19164bd751a5643e915d0b555db04bd53c6505f639df4b12fe5a39d64cfb011610d4c88fce97dcfb667606c13ba84e21c873ff0f4705391147dc05674a7269bc1a289fb06a9c4daf70466d83a539e1baa69d9c93a7a27cfa6b70ba4b1be4cb1cef3d57f51060ffab06dfb405d18994c411944798081b3c75026b873ef5ce0d21ae19a354c673d6b1ca5c80c3066c6a558b2b4987347535c736d832e074a96409680a739f87e98bb36177ef7c17cdd5abaf262e638c42531f3a2fafc059e7deb590bb420e536b4bbf8fe7333b8b87dc640850d41d779838222ed920b0fc7ca7c589a0b1ffd61017b41372039f19a5cabf6c88871d448967b9aa3139592bfb0d52500b26b4455ab5a7fc779f91ea51b4801495efa5d110ba38dbed147ddd11160a05ead5688fccdac587d28547d8bc0475e392e09fabb85f587de0e87a7540f8a7865c5722abda03b8c8d2e106f5081176d92c16c578191c25047cd7f27f6a90927be901c6dc959974c0fe10c3207256d8872d80c7825da5b53853be3ec7836a53b81c7595f2d1e177c764abd3d51a160a003dd1789d12fe1677abab3ac56bba3182ced1cf552c2363bb1df4ced7a930cfb3a93bb2c05d94005b4ac469465fb65833cad3429a1b03ff5315041982595ee74f99bcb6ec65f618a739a67b3a5ebf9e33ca9a9d32f7512c59f0a6cd47201234f5f81ad52ed29f74358c8c63b2a0df1cacc3200a2b01ec0831e932e38edb17c0dc2dbdeba74e69f49f764760918a6e7ba32f3b2fba65b5c4babdc01444b5bf578fa774683da60feaa2a576ee327c64c1287181023da05bf1ccada86293d70c07da1b65a9c5c9cc15fa9ea03ac8ed272a8c2403676bdc58ad8310d134a2cb3fccf880df3aa528a898cff9d45dbf228966ad50bd4e5f5f580b2c3e14fae716a432c6b72bbc9a2ce32854cdccf6463fd630339fee3c14eac26e5ce52e5174a72560cf1f627971d1268ed476680fb3a2c61f0c0a9e4c13c0099bdf105096f2db23c7ec7b63db5dd691056bdb54fae78f7a0c00f2ed832ac217c17528fdade8a4b44bc97c51ce1368be87048cd11b76ac2a7a3e6897a2bfba8600eb2509a330874c8e42db26ac4d7f202738e0aa8bcb6c90a77b1e3c1156f30df9dbd3b1d3e76def76cc774cb3c8f388e39ddb6ebc91eb7b49f841a74b79545b235ca5458f94fd3cd149af8ec58ca45a05230606d45da12a5c1200cfab037a70c98d9a2f8b8c7d6d3bc07bcad4772514339b978daf46b9d545b7cee96f0680ee2f6a5541ad1ac3986df88eef6807bfb7d6ec14b98a3adfbe2b8f1ed9d7979de4acfa35d3c2fe57b5af5d496566563110c7eb33d7adbb0539a049d0e63e0f0b46e68c", 0x1000}, {&(0x7f0000001200)="82097b4d4d8dd221a9b87641ee9e4e181a5d2edce4611055ad3e4e586a16ae2914fd9a7b4ad26a8a9528d98e6c2063c318a2d636199b4ba7fa36cb79a5f85ba8c5a67bdd247a1b580053bae24bb08e5003e7df7f59161dc0c7507e743d3df92ce52a53df4137d528774d0bb533824fec31a70c224066157eaa191fe2d344a8b6dda32071411316d6", 0x88}], 0x4, 0x5, 0x5c1, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000), 0x6) write$bt_hci(r1, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:05:38 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x400300}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:05:38 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x3) 12:05:38 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) bind$unix(r3, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000040)={0x0, 0x4, 0x9, 0x0, 0x6}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:05:38 executing program 3: pidfd_send_signal(0xffffffffffffffff, 0x33, &(0x7f0000001080)={0x32, 0xffff, 0x9750}, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000001100)) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x1e, &(0x7f0000001040)=0x600000, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) fcntl$dupfd(r0, 0x406, 0xffffffffffffffff) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x800448d3, &(0x7f0000000040)="84d3143e0146f8a73d21092289422eec8233f2c76808e5e63317e8f76dbdefb423e825f0eb25986ae89e932ae00e0a2e503090b622ad3f572f368814b0f4d57358b1ee04452620676dd9c4a23b689498878ff1447924254763bce0083fea03dba6b801d09690dd426f1dd207f835d86e395fa95a3acb554a3e2f4923eb56e66d63b81ba20430c19961d8c6cd1637a3f4e5835f1e06b79f9598b3655ecb31579225387a525e1cec6e8dedce243beca6fbcfd5bb25b4da1a7fa710e935865a7b77e1cc3d53d0f7d13845f70e7eb9522626532d1816f4f727332c0b3d076404dc1d1f2498d2bb9778af9eedab27eb340c8ba0139b27506f1ea41a7bebb71081822e3f9418c0c37157735e5bea0ca204eb3f24c075eea44f55490f6819e72979dfbbbf69daddbd37c18bf701bb52cb1fc6184938ee974f4d8a46d1e36a61e1c9ab01efc1d39c4488672fc8358b6dd8df279817e89340fb68201f7dddbad9347e1f5c2f62bbf9a9b7ee9f94e0e35a44fb290f6acba40cab24be62d6a5a0a60715277a79ab2312a8782d0b9ca81b16dc719d708d3df346bb28318ab5cc1c13c1fbc1603992eae953c7b8c5218bb511f06a026f6671e58efc67c43ab8244fb7f901f2b566333e388fb912ab7c8a1ccf255a1a686b1b45121a8cd50b0474a72535cde028dccfec6341705a261129e291e8eb846c20ec6a92dfb7ab3b1fe05170e332330a9253de7ecdf2eecc0e97652173c6befbe83b23315b01f4154c357553fdf3aad6d65e1debb2088f884321f84f97df2eeb84e268ea185145af77c2d8503ebe401f3bc04bbf58bd0a397b9dda3269bcd0c2c3026fa753aefbf8e0fdcf13689537ab6b2c269487f4105d418700431c626aa18f212a23028e9d21b67cd8501834af4cf890bb9032448fa60069d080b5114377ab0a6245c0e8d05d4124bccb0bb2e4f5227b41396ddb909e637a6f587c559448ef2ad7630d790e1b810294f5fbf446a92867427b1fd9a934578b2b47edd1702c15108e7904e50350dac5ae07250cc77e2186bd4a42dc2537e3cb41bd5dd9c1c5ab3beef31ae006f2d97688aec23f7eaaa49b3fc8afcb253928ed058c5d8a2d03df4e799259e77295dcf7ccec7bef3e9fc8258ef3282c3a390d5ab32ea6241afd03ee7412e2da3bbb9480295d5374fd4d101cb424829100e39c22e9c4854b4ae033d6e79c2f766124b46755eab4ebea0f56dbc23219ab215953ca0a711753d55c6ce01bcae3dc3e20c65a6f29bdfb1d290b6affe75ac31a952371cfa370de4df985e6270addbc8b608a6acbb24a611232397ea6a6cd28189893cd9295aa324afcdeb5bc3da28dfb0e7b1d53a3d69bb1c3abaa24801bfb19a3fc655cd9f02503b174cd74eea0de3c80daf832325c154bead7382237f232f1a0f9f5dc8a78c37c55bb15cd79727366db0300df03b91f39fa57952541bad2a6277e8f877919c5aee41c8a293b307406de5d77a5fe8d4f3f94361e87094c6b93ef20f8c7f2479658a9bb0d38a980fe383eaeb480e9fb864cf7cdf051b6823c004ce577111148d8e01d3a7aaf93db2ecc20c4ee93cdf6b955dc341254b48f1d426fbb1a89c8b072e7d24b790c1d340ec06e8ec91e0765c12aabba89ccced373658141bfaa0609ebe6a10b735518399f729157fbc20e62b0fe88b9d1a680c8e8f507fe649c356e1a23d635a926fa55c820f89662e0fb2be2ddb628054a4332b2eb3d967b616f06413d41e5d5ce260fb91dcf1fd4b6750da072fc41305da6332f843ce9aa79e744a08df7f4397ee21fc39032c5b5c1e73d5cb89fd1fd4e3a540312c95573585b594d6729252ff932bbc9ee272a1285836d5f6fd74c5e064915d9a85e6a89bf92d0fe7c55a4c5988bee50bc6eb5ceffedfe0f147a2f79577b85a6351c0af071dec3bd4bf733bbe36b97892fd9c36d26d450c68285b879435e5e0167f50ec97af05724bc342baea5ae9b02b31f67880704b8ee11b0f8d96d354a6e48cec942f8c42c7fbf2d992f9caea80f2ffa026a1cfd7a0639f6bec098d7a93a830fb441c04859ac91315ea06dd5f7290caa6f534e5021582a79b1f8dc3fa5772274c3a1d3f84e003e499743d02e2071d2b19805a51e6a246b48ace5bc29ea294e4041ef7826545b99f7e3693b3b63be900ea7b55dc44857d3c6759ae04c0b385b2300584b6c1a875997558d3af0c850128ee6a9172ff70b1112d449b0142ed46ceb8d86eb76a87111e3a4c04ca627515982569dbc1ca71ce8548ec7fc8abde0f0b563915978b07b65cf8ffdf2caefeb81391ceaf32bfdfcb7a38c58fd9e3e3db1ad694ae63f9affaa9e0fe1b473d265e0c46cb3c7084097b8f252b2b7f1192ef1d4172e7a4e9b1097ccbd3183ed3383adf683492cf34a78778c1eebe51eeba85c1471137b64d65a2373716d537405765a47fd470eb601ae89c643b354fdf33998c8c5f81cffc2082b75f3be16104d66e5b13de1a838ba79abf9d36311a3a285f31470420bae0951c577bc01fdf5c95dbba63c04fddbd652e352c889e9032358c68f7344eacbde6c2d08709c9535152b30f285e153764ff73e819ca0d16da3b38da80948191e70354cf6e8a270bfcd4ca48cbf43fcf9161a6d521401677fd6ab8e432dd08400bc3413dc8d0caa1c4d4e13b66b257996d5681a36cddd3747cd02b5d7ac75454c786426dcd2858bb8672c65dbc0eece549e09d6f7fd152aca4d7bc34b4e2c469706bcec5cb8eb3ea641d69ca6a2171c795daf8ac74515ad0893699fb7e6f527efb1966faa4701577ca81a821f8298e8cc2b58dfdcecb4ccb2766c6b6810783865dbbde2b475e861f0ffa7590050ccfdd4edd4b9244f60f3617e9634aef335a6d5b879a745286f11b9b3d180f57e8c3f86b54347843754d9a72f4c6d6fe7fc4c5787688342f3355fe02c2f0335e3c1940b2409e5de004cdc3aad379ff39359d9a2768d41d5c46ccef1df766425adaf668442dc7df9dba4cc5be91c8de67c38695054af1150bb4f3dca3e67ba35f98a94cd5890fb89776e59b554a971130eb792931e2e0070c407ce0098df909c81c4a43d578977fa268299ba8dd417f262ab6476c5afed7bb749bc511ca7fd1ae80a48edb3ee117b24b575fc86328b0038fb90ccf4c37f1ac538df9cf415a2bca1d92025ec6839fc02449f95b959c8ec6a69d782ccd6f7efbda1289f175731d81cd88078fd93b035672cd97b1ef17b702fcb1a98e585a17655d24d27e42b8cb8f82029f14d2f05c5300d8efd620fe6f209faf115e1d8b6b8f28bc9de1e8a936bb6f6b34e05112fc6f64733531ac5f7c82dffc057144f7fd99c175c2aa192e8ddd43c92931b22871438d6107176d28ad567b95d70d508533afad99a95b8a4c2c9ea7a1340a23802d9daa552602304f72d79e355733985986b250da46ee0859cf6f4612de18b5cb09c10957571b325889ae49ae21572a4805f9d964267063261d7355ea57a903302017d1ec992fdaaeb2bea6d0a0522c6cb9f88ced1c34a99e8f726b29265350ffa4cf8fc7fad9ea9ec4f31e726988a12450c818dfd07c21f3488da38bd768ca3cdf405e86b761adba27f0462708735eaf06820a5d31b51bb981d884b447847704de68b02dbe19084e373ad200fdb87bdd94dc6878a3618e52f698af1c61c6ec1b4a36dbe3d3f4b89f2a4e3ef5b8e0be8c6a4af583832fa73c548942ad4ae2bcd74ce399078dac0d641dc137b114a0dc267af844a90c442f6c80861a74013b31c8c8a8ed380cae12513a9c637d19ba8267af50f3a857f902639daef0eee7a7c1f6499b8014851a680782f4fce04a46fcd317509de8654e8184b35494a1f24f1f09d5b0469f12b839318dd109eaef92aa284be51bae807fab8e0e4b57e3a62951e50430de183266dbbadf7aeb846b194357fbe54c6fd178d2f456d13d5257d22020d6c8f1b488adcda1196333eaf8326791e853ec13a881e18f58b8a4d5024764665141e96a1594eddbcd0191817393bc78a121f6b9fcff63240854dcd45fc43c1b9dc91661d448fe0d19ad2617493f366b07244965e55967d620f7d64675922bc1e2dd188d3562376e4f513afc2ba34cc44c9a187b75c064c8e3afc3d6c5f7a138797bd1247f3d329e9d10253bd21eb6ad57e1558b29e547591ca9f7986d6acd8ec703d428d9f4488ef67dab06603c9fbf801b0142ce9e48e5e4d6ce2621fc6f6e26a4b1a4ffd2772edb2efa7bbf42c442a98359effaad0455d035723de51312c7c5e63a31a0c0cf1e65ac70bf174e82e8a7550b25064ab09b2a158dc99d20d44d18f54c938b03d15c92a08f5ea9722a261aa02d1834ebc3db146f4d9b93fb6287b9ca3085438320943dff8945273eb42e5eee2ef5aebf236d4e283ac7e4c493513830f9f183e78e381716d7366d00e89ce3b6a8e6ddf63c468acd290d70036c15bb55bb00c793039fd6671edec9d4312253fd3a4a42512bb946c4157270a2b82b3d0cc7c6848e1e9c03c5a0c18f31c54604e1f47495fd9039273c3c9702ce3a00d423d5397fd28471a75b9fb0892bf727c9cc9767588120ad08391af5f92d03dca329229efecbf266b71c87d2c6fe12da666b4dcde92f4ef7b4f5a2fba6e11b9cfb96cb568e0d0e3ef233b29be8777ac228b99e822ab3246cbd669b6856d934dc842779804f6e4233802705c80099f3fb9db6edb1e20c9884a1274271adc87bffe6614f4fd06e2d41ac1e5a3d2e3e23ae6cc568c104ef113edf95d32f7e8913b85f3cf6616c7a79f2e839aca5d1281c8f4674a0cb6a56dbe50954792f189d21cf55d57b2184ab9745a9ceb8213fd7a5546997796382a9125c487b4c11162e4a92743d575fdf202ce8cae85589063d1b694d33b6c4b5f7b216e0d09a0085cb5d531f1b43c8cd940ab9d64d4385c6392941352d89ca82e7b8a5697d921542a4edd9f4e259ccd99fff7ffe3325469935f15076bb94a86f5394e6068ae34dca78269c56479fcd0b2bbddc17da21850a6d9e638e4111e54bd5661ae8f9dc1006b60641d60ce2788673321ada686cfb94f698c4f7956a381e8844271a4e4d37c47ff82a905f5bed94593b73b39ba301c4720b2583305139ecd4c3fd872e5c4f404105e99497071981c40d76eb5044fa7e0161bb1d5a61fcac2d15941875f349c6b575358493182bdf4ba36e8598a3229132b34c7f82fda00d5876bbb4f75a4c1ca26f5f1eaa2cbcf6b33d404bc1c0734fca4ca970a333061f029d7b0105a03a5da98e539a47254abc442fc93db81707117e683119b80221bef9da85770f5ac389324ed496f02e415d86778f1c884c6be983d731c73f2c9c2df549363403b5a5f941613e5d4e7229267dff98abb74c728f9fce2b7e5abc35ba9b54e51844712443347e6287638a81c7d0470d6688ba553bfdddd00e6d643af9a7103a53f55e5628a8d33bee1a24690410ef0b4392211425e75a6e85de2d451cd350e069669749f2d00ef6bc4e96ef46eb13c63139ba44b6bb033e93232921ccb630cadd76b89bc3b2ede5e286eaa16aee60a5cb2e4e03e3caa112fc72450a3877d05495d80a50eb1d32a9adbec2ce1e3aaa22ca0f34888a4040cc24877b21ac07f21ce62ef14efc6382abd677049f70890575a4bdab81627a28d4c83b128f918829392da6e72f94333dbe1684d996cd563f84542f208aab3e86a87c1053b0fa6fe2b00a5899628a24164b7f2e8efbbc4ade142e899ccbe314babe6204133820d894d07945c7c23ddcf2dd46c21379c9c5452b225bda476d7c75a380112e0d797075b07b089e0cfa19c7d2b25") bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0x2}, 0x6) write$bt_hci(r2, &(0x7f00000000c0)=ANY=[], 0xb) write$bt_hci(r2, &(0x7f0000001140)={0x1, @le_conn_param_req_neg_reply={{0x2021, 0x3}, {0xc9, 0x8}}}, 0x7) 12:05:38 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) [ 2447.898025] Bluetooth: hci0: command 0x0406 tx timeout [ 2449.946493] Bluetooth: hci0: command 0x0406 tx timeout [ 2451.994147] Bluetooth: hci0: command 0x0406 tx timeout [ 2454.042036] Bluetooth: hci0: command 0x0406 tx timeout 12:05:48 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x900}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:05:48 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r2, 0xc0189379, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) sendmsg$NL80211_CMD_STOP_AP(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, 0x0, 0x20, 0x70bd28, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x1ff, 0x6a}}}}, ["", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x50) r4 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r4, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:05:48 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) ioctl$RTC_VL_CLR(r1, 0x7014) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0), 0x42004, 0x0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:05:48 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:48 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x404) 12:05:48 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448ca, &(0x7f0000001140)="a7fbe5f004020af7c341f9497f93c1856595acca417e8777e0f0e324196e4b64b9c7df6c6dbf3cac57155610a6963bcd5720d998dda236a0ba0e71a06d190c984c89fce279e74885259d8783c3ed25092d9d3a065c8a47a01acbeb2c70a45fac7088223861112168aff719732b4531d5ac636435b3efe3b2bf3c626ca70cca1784bab57303c120850ede87ff613c79fd790ca1224bd14a510c28a3e74f1f8bdfc34ad7ededc8d6fde53a3df04e84232984e3bc3fd2f5920e098b7f54c79e0c8ed7a4bdb83cbf48257ece11a1b4194b912fdf7333380e8ba3f4547e75f974bddbd9dc8b5d8e1a0608bcdb993146e8b50b3bda7b5fcff228d5ac1abc5c6a58af82cad263a89fe73e5f3c4075bfd7976d6ab8f7863aa0501b3de11e55145c4948f3f4966a85c257a304ed4de5716f54bee2b33480cb60bec6296b7a4cee2c022bebbb2f49af273d0a2ca960a3f9d6f8e7be73c300ce46c0caba170115a3148b0b622faf0129a9732639956ae4f101ef69090b1716916e213667ebc81a37b7b6f7ef55871a5321873200941cbed74749653909dd8dde564c5cfc72ba59a61bc3a41eac20a4b221cded3cea2ba27af854c172abf38d609828832c20c095514b5c181eb61e676237220dcff36b2e310deb61df649a3021a13632aad75c50cec37dd9d5617add129581db199dc1611de240340660bd3e5eddac7250620b71fab54fa7a4b3357301ee7aff1826972d3775f264cc267c9dc0802307fe175a655c940beed89b4b66741a506897255a2987ec6fc0970b304238c319bb1e38d5988944a740700e2850013789839257c979ff5b6c4724b717d3a7bd21f66fcf281206d0dd938eba58b405d151b88dfb114b9437d61071f8dc7a42a831eb0629798ffe604c5422d0eb848450aace8d7c42d8c1cef3834f0f2e20f8f65828ec0f05bd2bf054e1b1c306bf07c59ed18299fa3d1d9441ccd1bbe626003d686d0707d557121f580131fbce2cee72ba9033233a34c0977c32c5811a531b511ad4cd0b55d7d53dd703e69a190e34e2c2bc41885e5bb10a3d7b53e2029d28e4dfd2e74141a8b03d6e20f75137aa2c27b3aa578aa0fcc07fd9782b876f7546f6808908a4a6ecf5d681803b70e435d97fc94986cc29fc1a76df9c1db70f7f9e83a6f45deba4d023fbaa4b9a74978dd152ca2278fad106de71fab37b4a898720f35f5f2fac1425e3580bee11f71abf728ffb8033b044e8ea9d3d474b8540925555ed8e99ac5125a7dd80c9050763613c9a4b36d8540febfe521f2f075651b6e44217d43a08c83104c3f9de3e7f59de47350185d24db2ff9423d7135475c4d506c88f59e983ae9e52a89fa4fc81bd10cf7463a10372ecc7590188610d49125f9a10a8217cfb3d71eb768f6b874c9c6e75a3841b68e9c92d1f1ea3110dc328f864813ebe2efce2057774af5b287487b5bff5d11cbd13e4bca105ffe1cbeade984254abdfca181ff1471d97f72e49efd2ac6804507d73d2d7f9e03861e5d6a105d710b27320e21cf8bf9750b5fe98942214205ebf921e4cc2b2632fb1ab57b3f56b7dc41a84846cccbb2e189e66b1be8b769bf27785c7da4b9bd5bcd7158e94db409697fa978e16a17cf58b15e397ecb5ada5be84b4f4d6d812179d18d435499b2456566a6eaded9830a6928f3e2fa752ed6ec5a92b0381c88c710a1d955653019b682c7054fb5fb8cf71b766cdac29c9a657801d54face43d528b9109cd9fb00b801606acb7d02ea28a656ab32f8ce96b045df359dbed4dd40dffade7bb66d9565cecb702a6ea7f51d730054d4138230be0352c158293a0099b84181160e9a88f32863d924936af7dcf90631dc9a17cd0afde5de02044ce088c44f5d79489d0a24c63dd15bd394de7500e5b7a3acd4e4f775ea6d270b4ba815d1e41efcffe50000008000000000ce02fd13a4980136bd07f4f34501d3c7fdff20832602e301df1d1e271ca525802d4b94a64326d6260481f725fb1b2bb3cf221d56f848f9c36e5a09e01dc7c18a30175c92a9cdf3168b38539a1b7059c4f9d4bc62388c6bc31aedef78cf653fb4cc092a5a0edac7b7c7464ccdf5563f28652097601c14b015c69197e95f2198e349550db802eb0d3f7e1e93e61acaa520762055f1be17ff3a389a033738beda68003d47d55d0184aeb3d9c819193e66f0d9c339bd395ed594b4ca66539dbddc6d3b18f58654c998e989f84d5c3c4406c78ca9385c3e02d31e6afc56c9664c105bc4f9655b147aeefab1deb21e61d9407638561830d7a916b712ada8e2a6bb25006ac7b8e3f1e124f749572657fbefde84b542b2583b181fb7f5b2d910b158e5906803fe024f11e17b4434c8fef234c416c84ae38cd58d15a8d26d8547a26fee03acb05b7e3bcfeafe9b7f0c7c0000e3b94ac86711914261152bab96132c3abd1b775d036d0e8f3f612e98b20afd53d10c6ffa22c9c0bf98532d6338c453bd308bc43bdc6e75aba98b555c299181ed3739603fe1239c9ad7c3ed24dd189b0ea07e328dbe6dc5f3619a5f8ef16ea5e6ac7298a7cfd7138ca8d79c229f72451cbf2e7c4ace57528fb1d7301df6d7a7981d943daccf5b5301f2628fe1796bb03713499cb46249f917fdd4d66b5dc195e34efb836a4f108e0c4984abf7bde8bc20ae40b61751f6ab8d17ab1ce079180c14621a1eddc70cb8056454b64daae7af242ade1d6d84336f4ab2a7aa1d16b23445c3dc6c620a2fdeea28af864119a601f781a59f8c9a40061e2a20cc98aa57a275ba97187e94797a3bb4c0e6344b00787f3eb1bc47dc0baa92781e1c209fdc140001ba1a97e1296ff2901e7e4dbfceaf22d4ff5804a065ef97e59dd4248834e07f7000aee191d5b76f6f18e65f3c465842786851bcd28af08fb162fb41bef888f4d29a52efeff6fa31b77c884e07c0d3e59a787cc301ddb1db43701de9ef94c88544254e14aaea6b02a57768c80656f8407c67ea4a65d2476141708023c893355657896af2a62061f852356fdaa295806f4b4f38ca40ac1112bbfc5e7310d62622108703f0d48a558122cb76823417d6e9829d3214641cd550efee4d03a9e62cb6ebb68756cac33543681da401e77cfe45a087d5d1bd1eaacce5da8d385f7a80416db9fcb7bc71ea1cd53dce757b5012c776245fd061865b9f32fd180d8c47f05703f3f46ea01724c9496dd1f5315035fa9069be199a303b516ed452474cb10374399c493b9175f30440b70a5a6b2aa3cf821db00960cda4a16e0a97f3dc3d463cfbc3e97eb0250cce8b94213b1682f07c1930b9ce7601000000000000ea33460f4af7555dfe863992e5143b580414a4f10a729e8cc29d4a2e71d455ae4351f91008602b832096158efbd4925a87442f7adda6cc6d016d1f242e945d3c63a2d6d58a1728606b14c293b1c46048487c2ce2e4f608a25339baea571efde556f2e6518cd2d147271a075853e86d59dbb0f47dc04a026fb81ec8b27fcfc66f5a1d3f00886bea9fc3db32173f8901c27c604c4024f124e14c2af35190d14b201b9b2e8124d14dae68ff01c8f11d478e876575e1950226dd198bc0f3e84bc2f43b6b1a36206079a10f61d771f48be7a86595f8d7fccbc849781b6300f4166cee4da88419d929e47c97941d250c50b5b20da05d679a9b4483db085861543ee2f354bc85eeb70a0cc479f64570c1fdad6e69eb340129e1d87fcdf016581133d30a0727e8a4490f13047b5a82e803955c898ec2c2f9bfeaf2003a8f052d745a11d9b3c9bc98cb9a79565e911f81206f5356c5577570277a071f5a9dcb3e1c00cb211c2d16a45ea7f8e6532f7d2b07410e91aedb370b9fa17cbcb32ac07ec11cefc3511c2d5b680bafd5b7195f3833a2985aa5b175c96a7b110b00bb2d68861a2c9743ecac9b78ef31d1f35fe6f0af04e222473eabb68515a6d804ea22cd3e73515f6470e81314a96643b36a7baf40ecf4a920f257d0be772a3cd652caf416f67264a7ab3680acce89e7f345003e8e2c76e76e8f163e1591e65566b4695af381cb06c4d51782c66bfdcadf7a3b567961ca2ae4acc078e325ab24e9423fb242b72efea4637b9ebf437c09bb1e5eebab587f850d7c6085ed85a189f7809a39f35d00872d5d44dfa9c94ac0a4dbfd0fc567374f20f0c57fc88468dc23b036fc90b3c43d8a0b66bf677dd705a59430b1525759cf35c11f2116fd33bb839e5eeeff5def51e3a7ec406ccb249c52c9b8bb535476760881960a023479b142d63e8ecd91dffbfc7b8600e193dc7c1fc34fdf2ce66374136fce90928191850aad493d0eacea38152d8f3888565ccdf30b4375b6abcc2d1059eea85d17191e617b1dfa7f075c4fc760f2e03ca816ed17096a0a7d18b9efc5f4eb5a72d1afd612e7979110d94d92829d113a0f623f4f54687c5a783b0f526c3ab7ac84ed481756a06e24a13c560695fee2e1d85cc7ba86c0b4343e2a5f94949d3a786a888cf4241f1e52021747cc2d92953aafd101381d15a5a689a80f0e288ac5df7bee4c25c9fd3d524ea75b8b0ba5de7c8ad549e1d26921f7f93d222d28be0c90a13ffda4f6bcec41e5266161f61e6568302902af15058661845be67d13a6a1ab2b5ecc5e2b58f62c16652d2a40c51962a47b8bd74261575ffd20e8a45271ebae7ae8b3361aeb016bdff7087fa12a132d378b67e5b588d8507e1c3e98144c392fd9041310f8b38a0492a56f1e493db457b30cecd038c1b3519c176101003d295d5c4db317a94472f024aab0fcdb718f6449a4a3a235f8d74796f2fc94d02e539650b53b443a7735baceca9b74c3544dcc55ea30fb81d14faf1195e576f8edcfa05803989e0d51b4cb2ab08f063fca1de746f46f803a255dad7e78feb55b44d0abcb962768ed866f992854afd4e43f0d8b4a79b82ca00453b7b319d23f37cc1dc2a236fa3324121b63af283cc691a45dccd31d49b8c254a8979a64ab6fdd57a453eed1b3f930af3e79bf85e314db57854a75751e713a2968bb944db44d1a0565e2e70d58af87785de812c15e72b0b830522c51ee59ca4a9d54c338c63d40c04b2a2b6b46ea831377d8ad6d6d2240008da5fbfda166d9b06fdd58091b779fe047b78b2cbd2fa6764f81e37c125d7c873d0af138cad3daf9239ed7881ec46baa0122e5da2aae507e36e5f4802b11c16066dbedac832e4f7deceb669bf8abcdb1fdabe36e0992779fcbceb66de5add7ebcd0b486ff1b0a8785b32e4e49f54fa2b248fb9f5ca8267d1b76d87cb0a81526c7fdf0e0be57cd06ae1e8d538a71b0f9ceb917893900fcc0e28f4f30a20673d1aadf61e6af081f3d947598e0ebcd063cb1cc75460116ed7e1a6aaaee131d90173915324ef0ad00ed556c822cf940b9ea0370139c19be76e777bb663efd9c0f2f982cfb831ef2b18a870572634ee8731bc49d19229f5e416b78c827b2499bd5ca6297c542d1a5cef0a74fb3494eb81c8e2acb803c75ccdbed0dd864386335c3cb943eb321704ff91fed54ca2cb2064cf6735b7f3a46fe4bfdc650395e007c0ee7fd739ae4cbfdf3629cfb40232193f5efa8f40e000bd7be1d9827f91d5b941e88208b1b7d03f41532af068e5186ee5ea00492958fb869bf51a6980dc94e07bc58a8f6e345c98ff7a3f184d608360dbafa603cf95494f1ff30625afb270ad6a705d68417ca88f12e01bbd3a8ad98019540dba05fab708fed2a7a5710a1e15fc9a80b362bbc4e04c94358f2523ad978d1ed11e5cea4c57f8567e6f7f1dd1a4784aac2b817af1ee3becc12e2fd0352e118c10bc2405b264143e340c1f0422180274eb68b0772dda8956aa721028bf106c588546481d4ba216f12e2feafa9db12c67cfc82862386644b8c4edb314363da4") bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x4}, 0x6) r2 = dup(r1) write$bt_hci(r2, &(0x7f0000000140)={0x1, @le_add_to_accept_list={{0x2011, 0x7}, {0xe, @none}}}, 0xb) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0x4}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000080)={0xffffffffffffffff, 0x81, '\x00', 0xf6, 0x4e}) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200"], 0xb) 12:05:48 executing program 0: r0 = open_tree(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x80000) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000080)={0x2, 'rose0\x00', {0x9}, 0x6912}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000), 0x6) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r0, 0x8008f512, &(0x7f0000000100)) write$bt_hci(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="01110402c8005babd165051165ec2c362615166a90d5e04374297f85c0de7a902c0962b1848394764d6147e69847f4c79fa064b3df4a9a6f9baf258241d460b1d042aedf93d7bd68601e62071e5edad8b5d690a419b4b67a79fbd13121290b8c67b7a316e06142f9aa0b70289d0adc328002c4a2800399362ebe8ff493101eaa829066a225360cf569ea2ecd1a380e7f75589735749a72d76a3e02a5567c14bd7921c59fef0d080e4b8cc687e8c2c62e1809ef9af29b46812b27afcbfbbcf17a975956e94f9137e1bc5f3754d12fbaffeb8e0e80de312f3790e5f2d59e923428e7687b025cc3bb150839e7a0e56c99e1b5013f1cdc25c6e2426a076749e4f1a8e12f0571c489b7ae7378c21087aa5f183cbde14e09a69377b07a7139c7361a70d7716550ce706d401dd16468d48b8a68d4ee8ca4f999179fcb19112d40797a25fb181d6142bd9f3428f557e17a2b646dae344e4089ff0a99120c55e70d6b220e5dbcbc7869b68d73e3f237d8b0b73a8dd416edea1e126de7b548673d61d7f9f80b4c1e9a8b177f9f64b1861f83694b482ddca3de4c763dba23c8c008528429968a18c7d91315bbe370de3841b460de5903932d0b129eb9e5b1c100febb4bde56da81263cb95028c41d7ba141f448da661c0c70ea392f5fb2e2461cc94d26c5dde542d9f531b62a4a866464450990215efb5b72e17cdd59b85bde2366c6c6df551f5d14faee598f76bd9bcc33ddda893b27b12b9e36598d98a4e4cc5215f6e0dd52901cbd6a95c84302e9b04012a04b8b4ee5382b2806967ef0572a751f17494f932eca858f983887216d15743b3bf5112ecb3e68246f55df26d3d6d735d3b345b42cb53630ae2977e5bdeeae9638dc420357e347b97d45a3bc5c452e87ef1bfd863113da0c"], 0x6) write$bt_hci(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="01330c07000000fa000000"], 0xb) 12:05:48 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x1000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:05:48 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) [ 2456.090081] Bluetooth: hci0: command 0x0406 tx timeout [ 2458.138048] Bluetooth: hci0: command 0x0406 tx timeout [ 2460.186157] Bluetooth: hci0: command 0x0406 tx timeout [ 2462.234034] Bluetooth: hci0: command 0x0406 tx timeout [ 2464.283009] Bluetooth: hci0: command 0x0406 tx timeout [ 2466.330036] Bluetooth: hci0: command 0x0406 tx timeout 12:05:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$sock_bt_hci(r1, 0x800448f0, &(0x7f0000000100)="1eb2405f407cf0222bacea3c2b555ae7043b45b046f0cf859cee67123176ae03fac043983f61db7e1a46aae6607b5b847276ab8fb95a2bd40dd56e57cb94a0114a28e1a1cf657fc655db02e244b27604285f77d354a74a83c3d742e7ab4542af13217bc5ab8967ae6f331012728fa4dc914a17374c18d448635072070939536d6dd82c68fd3bbc10aa8e34b9ced9e9337c05d5872d9af3adc808b88bdc92899e1d116875ddad761450244a41fc4d74d6a11d90f7b9b6ea387dde") 12:05:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xfdef) 12:05:59 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x2000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:05:59 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:59 executing program 5: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000180)={@empty, @ipv4={'\x00', '\xff\xff', @dev}, @private0={0xfc, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00006, r3}) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCDELRT(r4, 0x890c, &(0x7f00000000c0)={@loopback, @dev, @mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3}) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000000180)={@empty, @ipv4={'\x00', '\xff\xff', @dev}, @private0={0xfc, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00006, r7}) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCDELRT(r8, 0x890c, &(0x7f00000000c0)={@loopback, @dev, @mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x5c, r0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8e62b514f7c439dc}, 0x0) r9 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r10 = dup(r9) io_uring_register$IORING_REGISTER_BUFFERS(r10, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/138, 0x8a}], 0x1) r11 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r10}, 0x2c, {'wfdno', 0x3d, r11}}) 12:05:59 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="0133ec0700000000d7000000"], 0xb) 12:05:59 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xd00}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:05:59 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000300), 0x501040, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000008600)=0xc) setresgid(r6, 0x0, 0xee01) r7 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r8 = epoll_create1(0x0) epoll_pwait2(r8, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000240)={0x200b}) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r3, &(0x7f0000000140)={0x40000000}) setgroups(0x3, &(0x7f0000000340)=[r6, 0x0, 0x0]) fchown(r2, 0xee01, r6) dup(r0) syz_io_uring_setup(0x7181, &(0x7f0000000280)={0x0, 0xe8ff, 0x4, 0x3, 0x207}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f00000000c0)) fsetxattr$trusted_overlay_opaque(r1, &(0x7f0000000000), &(0x7f0000000040), 0x2, 0x1) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:05:59 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)={0x1, @le_accept_cis={{0x2066, 0x2}, {0x1}}}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:05:59 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r2 = dup(r1) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) lsetxattr$security_selinux(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080), &(0x7f00000000c0)='system_u:object_r:sysfs_t:s0\x00', 0x1d, 0x2) 12:05:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xfffffdef) 12:05:59 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x3ff, 0x4) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:05:59 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x3000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:05:59 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:05:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xfffffffffffffdef) 12:05:59 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$binfmt_aout(r5, &(0x7f0000000540)={{0xcc, 0x7, 0xff, 0x375, 0x384, 0x7, 0x28e, 0x100}, "1635e119ea0794f320dada20ac1400e8d6a6d15a40485d3e31fad9af3b2d74169a7e4380795975bfa677dc0024000553e0d4fe78845031a31f8f84bb3d97b28c66ad4e53a8", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x865) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) ioctl$EXT4_IOC_GET_ES_CACHE(r4, 0xc020662a, &(0x7f00000000c0)={0x1, 0x5, 0x2, 0x7, 0x1, [{0x2, 0x4f, 0x2, '\x00', 0x2805}]}) r6 = syz_open_dev$rtc(&(0x7f0000000040), 0xb228, 0x4280) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r6, &(0x7f0000000080)={0x1}) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:05:59 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x1100}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:05:59 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:05:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) r1 = syz_open_dev$vcsu(&(0x7f0000000040), 0x1, 0x109900) write$bt_hci(r1, &(0x7f0000000080)={0x1, @le_set_ext_scan_rsp_data={{0x2038, 0x23}, {0xff, 0x3, 0x49, 0x9, "d5e501a98f28835a4cbce730fe94d16708016ccae2cb17358190cb867b5a1b"}}}, 0x27) 12:05:59 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) dup(r0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000000c0)={0x7, 0x2, 0x9, 0x0, 0x8}) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, 0xffffffffffffffff, &(0x7f0000000240)={0x20000008}) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) 12:05:59 executing program 3: sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x20, 0x0, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4081}, 0x4000000) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:05:59 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x4000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2467.046102] kernel read not supported for file /vcsa (pid: 22586 comm: kworker/1:0) [ 2467.070853] kernel read not supported for file /vcsa (pid: 22586 comm: kworker/1:0) [ 2468.386795] Bluetooth: hci0: command 0x0406 tx timeout [ 2470.426037] Bluetooth: hci0: command 0x0406 tx timeout [ 2472.474142] Bluetooth: hci0: command 0x0406 tx timeout [ 2474.521996] Bluetooth: hci0: command 0x0406 tx timeout 12:06:08 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x2}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:06:08 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$VFAT_IOCTL_READDIR_SHORT(r4, 0x82307202, &(0x7f0000000340)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) r5 = open$dir(&(0x7f0000000000)='./file0\x00', 0x5a040, 0x80) read(r5, &(0x7f0000000140)=""/109, 0x39) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:06:08 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x80) r1 = syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r2 = dup(r0) r3 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x4001, 0x0) fcntl$dupfd(r3, 0x406, r1) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) fchmod(r4, 0x19) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r5}}) 12:06:08 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x2000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:06:08 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) write$bt_hci(r0, &(0x7f0000000040)={0x1, @write_sc_support={{0xc7a, 0x1}, {0x7f}}}, 0x5) 12:06:08 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x5000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:06:08 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e1, &(0x7f0000000100)="66f991938985aa102b79d902828fe72aedc786606e2a15c40577ffe0eabeae0f9ea8d3a6691b778f01fe7f9d78d6b80c4f51e6b927e95e3c602d78902fb4602fd0038646aab18c8d675b7d6082b5b128aa3263ef3aeb199f7a57cb1ebf1ec3167a48b42c5a156cf38203bbeee141faa6c79f4ffdad7cbda9bdd309dd137520dfd8541886340be192ad96db6194f06d67997c7afa250d3991440286258da520cf1159fe5373d6e58ffd603a1ad02ac4789392c078891768a6b7e0a1b4daf3eb801e78a258f5ee86b631ec8f4432") bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="0000000000000000800000fd3595990aa80234f14001e3065038c8e1229ba93c5677428186e524742ee5c2857609081dc96e827268c268579c3b778c00003e833266ea9c34831e351d06ca55fb55c23a1b61a90d9efb51b9d55483cb0185f61ee5a5b2d5c96959faad39720af4acb18b640e507cd6861520e53820e0887368a01d72bb5478a4cf"], 0x178) 12:06:08 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:06:08 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x3a03}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:06:08 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2003, 0x4}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) [ 2476.570850] Bluetooth: hci0: command 0x0406 tx timeout [ 2478.618657] Bluetooth: hci0: command 0x0406 tx timeout [ 2480.666038] Bluetooth: hci0: command 0x0406 tx timeout [ 2482.714299] Bluetooth: hci0: command 0x0406 tx timeout [ 2484.763122] Bluetooth: hci0: command 0x0406 tx timeout 12:06:18 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) close(r0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x2}, 0x6) write$bt_hci(r0, &(0x7f0000000080)={0x1, @read_clock={{0x1407, 0x3}, {0xc8, 0x20}}}, 0x7) 12:06:18 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:06:18 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) sendmsg$AUDIT_GET_FEATURE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x3fb, 0x8, 0x70bd29, 0x25dfdbff, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0xc040001}, 0x4005) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:06:18 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) getsockopt$IP_SET_OP_GET_FNAME(r1, 0x1, 0x53, &(0x7f0000000080)={0x8, 0x7, 0x0, 'syz0\x00'}, &(0x7f0000000200)=0x2c) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000240)=0x9, 0x4) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$sock_bt_hci(r3, 0x400448e0, &(0x7f0000000100)="6b780a766337852f288d1fb60087c89945fb239e398b1b9b64a3f13989805bd8cac09a1aa0be960a9444d08c7d289312a4aca4e990b2526c023e829a03da133e9cbe441843fb3c3b76946a3200264fe5b0ff5ee7b87ca6dab6f25b49814c74e162760447f949b8f64f8de8d29bb85fd12f84abff822c49f84666e2d59f7a26c8ef2685bc3b45dfb22b93e5fb06272676a9c549c970a5db0658b2391c4978abe808a91dcedc2e5145d7a12c02916b79ee75bd7d3ccd5a40db6812760fb42986103d") write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02330c0700000000020000"], 0xb) 12:06:18 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) ioctl$TCSBRK(r4, 0x5409, 0x800) ftruncate(r3, 0x20) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB="c800"]) 12:06:18 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x3f00}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:06:18 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), r1) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r0, &(0x7f0000004840)={0x0, 0x0, &(0x7f0000004800)={&(0x7f00000000c0)={0x14, r2, 0xad4e344af954d6f3, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000640), r3) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x38, r4, 0xd, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x38}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r7, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_DEL_DEV(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0xa4090440}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x54, 0x0, 0x400, 0x70bd28, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x54}, 0x1, 0x0, 0x0, 0x8004}, 0x4000880) sendmsg$NLBL_UNLABEL_C_STATICLIST(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x54, r2, 0x4, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_SECCTX={0x2c, 0x7, 'system_u:object_r:udev_helper_exec_t:s0\x00'}]}, 0x54}}, 0x800) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000000), 0x6) write$bt_hci(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="01540c070000000000000065380f8c4a75395fecd51b3ec09eb6cd9aee8ed1bf520752c70d10603f0000000007000000000000000000007e0b2227dffb8bfb22f0819d13a8230e2e"], 0xb) ioctl$sock_bt_hci(r8, 0x400448e0, &(0x7f0000000100)="22df9ebe819a1c87aab3df69e2f6149ede40a7a34adf0f5932ec1621297ebe53744ceaac837233309a14a8bd36f1b8b81af7c6679aea260a0d054eaeffe07902aeee7f2528509f97f540c28fefaffd51260ff8023a185f11c9ab4b04e4f767dd5dc121fd13844c99729d85bde6670651a0ca24627477c9daa491080e619e0b83b250f053fec99f001fc837e9da0f64f9") 12:06:18 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x6000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:06:19 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000040)={0x1ff, [0x3, 0x10001], 0x100}, 0x10) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) [ 2486.474185] 9pnet_fd: Insufficient options for proto=fd [ 2486.486403] 9pnet_fd: Insufficient options for proto=fd 12:06:19 executing program 1: syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f0000000140)={0x14, &(0x7f00000000c0)={0x0, 0x5, 0x23, {0x23, 0x1, "f366eb6da2808d052e214e499c6b2cff0a999038162caad5caccb0a0f6731377fd"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x809}}}, &(0x7f0000000380)={0x44, &(0x7f0000000180)={0x70, 0x3, 0x4, "a4e6307e"}, &(0x7f00000001c0)={0x0, 0xa, 0x1, 0x32}, &(0x7f0000000200)={0x0, 0x8, 0x1, 0x42}, &(0x7f0000000240)={0x20, 0x81, 0x2, "8797"}, &(0x7f0000000280)={0x20, 0x82, 0x2, "16b3"}, &(0x7f00000002c0)={0x20, 0x83, 0x1, "03"}, &(0x7f0000000300)={0x20, 0x84, 0x3, "681606"}, &(0x7f0000000340)={0x20, 0x85, 0x3, "16777e"}}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000080)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x7}}}, 0x8) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000040)=0x8, 0x4) 12:06:19 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@access_any}, {@version_9p2000}]}}) 12:06:19 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x8100000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:06:19 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:06:19 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x4000}, 0x0, 0x0, 0x0, 0x0}, 0x58) [ 2486.810021] Bluetooth: hci0: command 0x0406 tx timeout [ 2488.858212] Bluetooth: hci0: command 0x0406 tx timeout [ 2490.906026] Bluetooth: hci0: command 0x0406 tx timeout [ 2492.954313] Bluetooth: hci0: command 0x0406 tx timeout [ 2495.002042] Bluetooth: hci0: command 0x0406 tx timeout 12:06:29 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xc003}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:06:29 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f0000000080)={0x1, @link_key_reply={{0x40b, 0x16}, {@none, "2e06d254717b40aad91ef6986d8ef287"}}}, 0x1a) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x7f}}}, 0xb) 12:06:29 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) ioctl$SNDRV_TIMER_IOCTL_START(r3, 0x54a0) 12:06:29 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:06:29 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0xff}}}, 0xb) 12:06:29 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x10000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:06:29 executing program 1: io_setup(0x4, &(0x7f0000000040)=0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) io_pgetevents(r0, 0xffffffff00000000, 0x1, &(0x7f0000000080)=[{}], &(0x7f0000000140)={r1, r2+10000000}, &(0x7f00000001c0)={&(0x7f0000000180)={[0x401]}, 0x8}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000000), 0x6) write$bt_hci(r3, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:06:29 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) r4 = syz_io_uring_setup(0x718c, &(0x7f0000000000)={0x0, 0xf2cc, 0x10, 0x2, 0x13e, 0x0, r3}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f00000000c0), &(0x7f0000000100)) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r6 = epoll_create1(0x0) epoll_pwait2(r6, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000240)={0x200b}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r1, &(0x7f0000000140)={0x80000009}) r7 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r8 = epoll_create1(0x0) epoll_pwait2(r8, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000000240)={0x200b}) r9 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r9, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r7, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r9}, './file0\x00'}) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r4, 0xf504, 0x0) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:06:29 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xe000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:06:29 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x2, 0x4) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:06:29 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:06:29 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0x2, 0x4) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f0000000100)={0x2, @write_eir={{0xc52, 0xf1}, {0x8, "84ebe6c48a78300e03820871ecf32f5a7d46667033e26d4e13b0a6b18058bd7345cbbbdaeb8764af9352b102d6d23b21640ad15c68d21982f778476fbaebc8179ebdfa27957fa58d881b18a8bf45a5ce04072af3ddd4d44be04fa6ac704e6a019128ed1f0cc19d0f80e4048d319acf6788d19d0974bc8d4f084edb36837739b57240de10d0fbebc77b9d5138a2babbbc10db4c1a6641ece10d5dadbaaa95ffddea6f6730d495abe45a8ba7a09c244e74a7296aa69855677788441cc7aec4895f2ce058b6cf90bf2ce6f3b66047a3cf6e23480430b600af60a91127452cd3ced6d34a8f451f913d5b6daa4287adce073c"}}}, 0xf5) 12:06:29 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x40000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:06:29 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080), &(0x7f00000000c0)=@v1={0x1000000, [{0x2, 0xfe}]}, 0xc, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000780)=ANY=[@ANYBLOB="00fb420806149d5e62103e289e7c8102c0469c3ead1c062925e0446fb930c1f90760934a7f6f1dc924963d4fbcf5c2988ebe9a5c3f7d218080b9e119f255fb1f2e4cff82c397b380cc31ca05ebd5b7dded24b423cd9265ab5de6bad85131f6d5fcacf4beac6111090081c0074636d4610af6cf261ef92d46d77afeff6b92276575359db707328401e8a3765965f1322fb8639b7fe2b5154b52792ca3b0d0b41756dd36946ad823f614eae2559b1477196e62acd08489d8464f04999407e10795e860610598a31bd60189a800f1ad137fa60b4fd12b4ff97fc563546c6a95d53511b2ec2c765c6aceb6d6314ded6bc2dfd33ecf36793d200e6580cce7b21ed07210ee209f9cd567d052cf1b9e692ebb46316b14f8ca9bf9ee2ed015414a0639b32c1a98c2e84b43aab895a7f6d52b2da1cd8d408f438f900c89ac54db39f4230df8583d5208ac39fbc263d88abfacddaef4858bfb57775e9245780a08eb0193f8e91d27befede01335fd48535efbef603a64628fca07f0b8486b0023b87ca546a5894eaf694a073ab54e6286baced4ab04eb688861ee26d31e5e7be845c457dedc9731370e796be748a55543654acd7efeabdadf32a99975b97cb196dcf89a2143b45ee93a8bd839362c1b67da9be733b07b8f8b3236e759dc7dc8c5e3792319b308d2bc8bd37c480a9f8d50d853633e2a6f33f6644f29bf1f290a702b98e2a1b511e01361d6c570a09bdf34e32e0f193ab636800000000000000005df17b5d707f3f4e4f63ada3f8338ad606acc1aa025671afa3c6813917706ff40f7351cc3c8cb6bda4a130d4125edd5e805c81b4738c4ca35401d148eeb88f0c031278535e49a16657499f02ce1b25c7ee3952b23e3f0f728e985f77b327e3eef2ed2df558bd4f73bdef730d9e2d6d38738ac0e75dba"], 0x42, 0x2) r2 = dup(r0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0xc2400, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="fac13142dd72c1070000006827012ab1d187b6de4979576573798cdd74ad90"]) 12:06:29 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:06:29 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xf400}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:06:29 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x2, 0xffffffffffffff0d) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xfffc}, 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r3 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x103242, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_FILES_UPDATE={0x14, 0x2, 0x0, 0x0, 0x4fe, &(0x7f00000000c0)=[r2, r1, r2, r3], 0x4, 0x0, 0x1}, 0x1ff) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000180)={0x5, &(0x7f0000000140)=[{0x7, 0x9, 0x0, 0x2}, {0xfff7, 0x0, 0x9, 0x8}, {0xfff8, 0x9, 0x1, 0x9}, {0x258, 0x9, 0x7, 0x1d5}, {0xffff, 0x8, 0x40, 0x7}]}, 0x10) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYRES32]) r6 = io_uring_setup(0x6aff, &(0x7f0000000140)) r7 = socket$netlink(0x10, 0x3, 0x12) ioctl$FS_IOC_ENABLE_VERITY(r7, 0x40806685, &(0x7f0000000480)={0x1, 0x0, 0x1000, 0x29, &(0x7f0000000380)="81da9a591188e36ee4d7c2519e7e2fabc7f19ae1fd5d92707499e0cf4bb04384e2e8334e7316f9339e", 0xbb, 0x0, &(0x7f00000003c0)="4c5b941e78e8cdd6182a3be5754a2fb5c8dc7fc73a4996af59e0b7282ad14101cf5375fc2f212a81555761b96ea99b09a909353149e8e4397a0e1af01d91294136d50862d481bdcd1345b3b2785379df0807a5e40c4de210462b5089f6c367a99ee4a56c9e4f86daf6e8103541e9c953938d99853654fce5da4dafa659e795b9d8945e8421924ef213f960713f8df63a162bc981b083fb2f0e9d80994d460fdb2ec05d6c2449359c40f32d97248645e2514b44399ef2ee2dea247c"}) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000500)={@local, 0x8000, 0x2, 0x3, 0x4, 0x100, 0x8}, 0x20) io_uring_register$IORING_UNREGISTER_PERSONALITY(r6, 0x6, 0x0, r8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000340)=@IORING_OP_STATX={0x15, 0x0, 0x0, r5, &(0x7f0000000200), &(0x7f0000000300)='./file0\x00', 0x400, 0x5d00, 0x1, {0x0, r8}}, 0x5) [ 2497.015417] audit: type=1400 audit(1759579589.567:17): avc: denied { add_name } for pid=27420 comm="syz-executor.0" name="27421" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir permissive=1 [ 2497.023610] audit: type=1400 audit(1759579589.569:18): avc: denied { create } for pid=27420 comm="syz-executor.0" name="27421" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:kernel_t:s0 tclass=file permissive=1 12:06:29 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x0, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:06:29 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = dup2(r0, r0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x1, 0x4}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:06:29 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x8000000000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:06:29 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) dup(r0) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r2 = openat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x604000, 0x44, 0x4}, 0x18) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) 12:06:29 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x2080, 0x80) ioctl$sock_bt_hci(r1, 0x800448d3, &(0x7f0000000100)="04f6fa56ffa540b6cb145a81fcaea1cbd19bb62fc4862c539434ac9f945968be9f7c770c5c15f6564cc43178e86825cdf7826bdb0971a6e378008e71143ff20bcdcee75934a6a70c4e5a998fa6c6480463f85ec13d7c1cf4053febc5c5a0e148ce98705fa765cf752eabba6f3cfe180a01c6c79a2a7503bf7eadfc8d1f9a1ecb7df09c224eb088371c2bb81436a4be634e5917ed0f929bc061a5c900e0b33553cd32db0b73b0a5c0e842b5757915333bdcc09f0dc56d14986565b41ebe9fe6e68950ea9913e47588") setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000040)=0x7, 0x4) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02330c0700000000200000"], 0xb) [ 2497.242348] 9pnet_fd: Insufficient options for proto=fd [ 2498.778063] Bluetooth: hci0: command 0x0406 tx timeout [ 2500.826108] Bluetooth: hci0: command 0x0406 tx timeout [ 2502.874143] Bluetooth: hci0: command 0x0406 tx timeout [ 2504.922019] Bluetooth: hci0: command 0x0406 tx timeout [ 2506.970078] Bluetooth: hci0: command 0x0406 tx timeout 12:06:39 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) recvmmsg(r1, &(0x7f0000000740)=[{{&(0x7f0000000040)=@pppol2tpv3in6, 0x80, &(0x7f0000002a40)=[{&(0x7f0000000100)=""/222, 0xde}, {&(0x7f0000000200)=""/238, 0xee}, {&(0x7f0000000300)=""/202, 0xca}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/55, 0x37}, {&(0x7f0000000540)=""/40, 0x28}, {&(0x7f0000000580)=""/79, 0x4f}, {&(0x7f00000007c0)=""/4096, 0x1000}, {&(0x7f00000017c0)=""/55, 0x37}, {&(0x7f0000001800)=""/4096, 0x1000}, {&(0x7f0000002800)=""/168, 0xa8}, {&(0x7f0000000600)=""/124, 0x7c}, {&(0x7f0000002940)=""/194, 0xc2}], 0xd, &(0x7f0000002b40)=""/174, 0xae}, 0x80000001}], 0x1, 0x0, &(0x7f0000000780)={0x77359400}) 12:06:39 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x0, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:06:39 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x10010000000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:06:39 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00000000000000030f0000"], 0xb) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x200, 0xfffffffd}}, './file0\x00'}) ioctl$sock_bt_hci(r1, 0x400448e7, &(0x7f0000000100)="acc826536379c02a8d23c43eb6b8862cf820cc03889cc1448f2ae0ff7f22d3f8d5f9c80a117b1f8b4d7038f3af12f8b675e124be4492e84690b0ed968991e4ebc0c18937e56c6befc68c45480a93d1ff198d382bd25e8587ad4e7572fb21b33c0d3843a6b9241018581f06d0d8b01da57e4ad1366b051694834234ec2dc81c4ddae3e5a48d4c610d81135708ab4934fa45522a72782d9aec6a68e1adc9feb9c9ee4e0ca508d58e20318e545dd3680a78d342cea72a76c0e9dde8f0c15520941a134d1540719b91cf39a30e1c3f5e4fbcdab7275c87011dc8e5feb3f5604db4317ece3503d9a4727d") 12:06:39 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f0000000480)=ANY=[@ANYBLOB="01350472c8fa06ca9bce292dc05900919d2e3eea97862835c5de46dcb79da819e2eee1f0b05dfc3171c662e514e2192d558e591b423db5b938c08f4f8ebef0d468f4b486a9b43e123210f8a7baf71be82d1d0dd4134ac89a8759b534b9b8ffff385161c09a8dca50487495a7c0f221ed982e9d4d9f0f864272faba830d6c417e1f7ab903e14c0bc5c69d7694dec9c5f67d646e763b7514ade99ed822ec804c8595ba0d78ca61dca4e7f05d55aa66bfff010000e7abeb9e9ee9dbdd41bb86ac723c3151f2c08dd41d446acf34f6875d5e7ef59320c7e9b979c4ba2412746e5d6a0df86d795eb3063bd7a7c00ae8f343bbbf3492a0c8b006"], 0x76) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) recvfrom(r1, &(0x7f0000000280)=""/230, 0xe6, 0x22061, &(0x7f0000000380)=@llc={0x1a, 0xa, 0xc0, 0x80, 0x2, 0x5, @broadcast}, 0x80) write$bt_hci(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="0fc77a8921009be7e08f7f8d0a6d30d8379be6f73b993e0e156df83c4998c1bfd549df21cae7e43796763e162cc09c4000d8c9bac9aacf7c7200abdc6e4cdbd4aa27b16e15e328"], 0xb) r2 = eventfd2(0xfffff9cf, 0x800) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0x0, 0x3}, 0x6) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r2, 0x80047210, &(0x7f0000000040)) 12:06:39 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x20010}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:06:39 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) ioctl$NS_GET_USERNS(r1, 0xb701, 0x0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x1000) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:06:39 executing program 7: sendmsg$TIPC_NL_UDP_GET_REMOTEIP(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000e80)={0x1f0, 0x0, 0x2, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1ff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x627}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1ff}, @TIPC_NLA_PUBL_UPPER={0xffffff80, 0x3, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xffffff01}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1f}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7ff}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x13}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}]}, @TIPC_NLA_LINK={0x114, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe0d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2016}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}]}, @TIPC_NLA_LINK={0x70, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x4000010}, 0x2) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) r4 = dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000e40)=[{}], 0x1, 0x0, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) splice(r4, &(0x7f0000000100)=0x9, r5, &(0x7f0000000140)=0x2, 0x101, 0x2) recvmsg$unix(r4, &(0x7f0000000d40)={&(0x7f0000000580), 0x6e, &(0x7f0000000b80)=[{&(0x7f0000000240)=""/19, 0x13}, {&(0x7f0000000600)=""/212, 0xd4}, {&(0x7f0000000700)=""/132, 0x84}, {&(0x7f00000007c0)=""/35, 0x23}, {&(0x7f0000000800)=""/133, 0x85}, {&(0x7f00000008c0)=""/118, 0x76}, {&(0x7f0000000940)=""/161, 0xa1}, {&(0x7f0000000a00)=""/200, 0xc8}, {&(0x7f0000000b00)=""/75, 0x4b}], 0x9, &(0x7f0000000c40)=[@cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xd8}, 0x40000040) ioctl$sock_inet_SIOCRTMSG(r6, 0x890d, &(0x7f0000000dc0)={0x0, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x28}}, {0x2, 0x4e23, @remote}, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2b5, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000d80)='gretap0\x00', 0x0, 0xd3e, 0x40bb}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000080)={{0x1, 0x1, 0x18, r7, {0x9}}, './file0\x00'}) bind$inet(r8, &(0x7f0000000340)={0x2, 0x7, @dev={0xac, 0x14, 0x14, 0xd}}, 0x10) r9 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r9, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$inet_tcp_int(r9, 0x6, 0x7, &(0x7f0000000180)=0x7, 0x4) 12:06:39 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x0, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:06:39 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x800448d7, &(0x7f0000000040)="e1e5ddcbbf4e0870afde53ceb2381241f5580e6a02db47c4f2b6785eb69ae647f67a37e4ba88") ioctl$sock_bt_hci(r0, 0x400448dc, &(0x7f0000000080)="112e3efdb9") bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:06:39 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x40030000000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:06:39 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0xb03f7cc436b9e52a, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="7472616e733d66642c7266646e6f3d682e26d20f4c1a53f10fbe7bc1ee6d5ea0dfea24cb7ef5c84f2840346708dc6d6b697a3ebf6f67e785b03e15ad05f9562479a6efc68f7f95c880415a85134f12271d99b5457b00846085e22e401921eb8a31aae6d9ac8b7b6f0001e35c", @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',\x00']) 12:06:39 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @write_def_link_policy={{0x80f, 0x2}, {0x7}}}, 0x6) r1 = open(&(0x7f0000000080)='./file0\x00', 0x2, 0x20) write$bt_hci(r1, &(0x7f0000000100)={0x1, @le_set_adv_set_rand_addr={{0x2035, 0x7}, {0x9, @none}}}, 0xb) write$bt_hci(r0, &(0x7f0000000040)={0x1, @role_discovery={{0x809, 0x2}, {0xc9}}}, 0x6) [ 2507.447608] 9pnet_fd: Insufficient options for proto=fd [ 2509.018212] Bluetooth: hci0: command 0x0406 tx timeout [ 2510.171456] Bluetooth: hci6: command 0x0406 tx timeout [ 2511.066058] Bluetooth: hci0: command 0x0406 tx timeout [ 2513.114158] Bluetooth: hci0: command 0x0406 tx timeout [ 2515.162174] Bluetooth: hci0: command 0x0406 tx timeout [ 2517.210042] Bluetooth: hci0: command 0x0406 tx timeout 12:06:51 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x20200}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:06:51 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x100000000000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:06:51 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000002a40)=[{{&(0x7f0000000040), 0x6e, &(0x7f0000000240)=[{&(0x7f0000000100)=""/194, 0xc2}, {&(0x7f0000000200)=""/11, 0xb}], 0x2, &(0x7f0000000280)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x118}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f00000003c0)=""/129, 0x81}, {&(0x7f0000000480)=""/208, 0xd0}, {&(0x7f0000000580)=""/111, 0x6f}], 0x3, &(0x7f0000000640)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x98}}, {{&(0x7f0000000700)=@abs, 0x6e, &(0x7f0000000940)=[{&(0x7f0000000780)=""/237, 0xed}, {&(0x7f0000000880)=""/82, 0x52}, {&(0x7f0000000900)=""/58, 0x3a}], 0x3, &(0x7f0000003d80)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32=0xffffffffffffffff, @ANYBLOB="14000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000000c3dc546056dc5e697f92a036619fe939e40879d9ea5c43dabad675fcc9b542228b61be2c5adf888433e71c05d3edd808e1b0fbd2ac59354f6c04ad09c1084c19840779dbc5c045c240be642c411781d461008e1c49edb3f81e1d82e58d5547bfacc9899d1a83625596420e56a2ddd259d69faf7f0270279cfd53ddacffe28b6b3777e19884aa819d8579f8bb0b69dcbfb47e315722050cb5fcaea950fd696295bd9fa09e26f915e166a8b614f0aeadf0f249ab81fcd3efb8e59268fff115876b5244f65cf9e"], 0xb8}}, {{&(0x7f0000000a40), 0x6e, &(0x7f0000001cc0)=[{&(0x7f0000000ac0)=""/1, 0x1}, {&(0x7f0000000b00)=""/104, 0x68}, {&(0x7f0000000b80)=""/139, 0x8b}, {&(0x7f0000000c40)=""/4096, 0x1000}, {&(0x7f0000001c40)=""/126, 0x7e}], 0x5, &(0x7f0000001d40)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb0}}, {{&(0x7f0000001e00)=@abs, 0x6e, &(0x7f0000002040)=[{&(0x7f0000001e80)=""/210, 0xd2}, {&(0x7f0000001f80)=""/85, 0x55}, {&(0x7f0000002000)=""/25, 0x19}], 0x3, &(0x7f0000002080)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f00000020c0), 0x6e, &(0x7f0000002540)=[{&(0x7f0000002140)=""/197, 0xc5}, {&(0x7f0000002240)=""/210, 0xd2}, {&(0x7f0000002340)=""/8, 0x8}, {&(0x7f0000002380)=""/37, 0x25}, {&(0x7f00000023c0)=""/106, 0x6a}, {&(0x7f0000002440)=""/251, 0xfb}], 0x6, &(0x7f00000025c0)=[@cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xe8}}, {{&(0x7f00000026c0)=@abs, 0x6e, &(0x7f0000002980)=[{&(0x7f0000002740)=""/6, 0x6}, {&(0x7f0000002780)=""/235, 0xeb}, {&(0x7f0000002880)=""/223, 0xdf}], 0x3, &(0x7f00000029c0)=[@cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x60}}], 0x7, 0x20, &(0x7f0000002c00)={0x77359400}) bind$bt_hci(r1, &(0x7f0000002c40)={0x1f, 0x0, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = signalfd(r1, &(0x7f0000003cc0)={[0x7fffffff]}, 0x8) getsockopt$IP_SET_OP_VERSION(r5, 0x1, 0x53, &(0x7f0000003d00), &(0x7f0000003d40)=0x8) setsockopt$inet_tcp_int(r2, 0x6, 0xc, &(0x7f0000003c80)=0x200, 0x4) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$BTRFS_IOC_ADD_DEV(r4, 0x5000940a, &(0x7f0000002c80)={{r3}, "3ed449f1d7629379a3fedc5b89af607b5a891c94035e010f7af76cc55a770bacc3c0c672a7a727173b6b915b21bb41fa92eb4f563eaf868bc912201595d06159a2245cf0dc458661f45b9b74866d516ee3729a34a7f59304471fb8b5e1e9ba60b505bae4878c63c00b5d68a239848f70eaa8fbc263aee7558b014c8a62913b63beb066ab1805682525e346434a139470c0849a07513c9948b33aa0e828ad183248eea05ca3b5cf66aff7b799c0f489bff874ce73cab4572c02a909ed43f2bd62d101e01e0207d1d014937ba76e02d2275ba1015d04b37ec7092d6fc2262c7fbb8609e4eafaba49d496a91b9db251ba99e46dca5068100334cd9485381325ebc7fd11cb71a5b1e2d38d1a3a493a354397bbade6a25fcbcec4597463f9f0f9940d07f52623e9c3614379cbb7f7a6ca59f12f079c1bc7cefbd70e7e60c39635c05b9fcda770ebe87e78e9aae9a4d1a3a7b0e9bfd13db1349341e18d6bcb95f45928c29115e2c0ca6f79260e9908f4ca4181be1680b4842c18a8446ef5b21167113457fa7ca79831cc62315754439627cf84294928ca9add37451ef811b4db6916d259103b62a99630a0c33b52cd52ec5a96ba83a0cbe6a5bb259f713c339b9118045ef3540482c4c995fcf462924678b7bc791177a31342af835f0dd2d7c7ec0c45a92da2f62d7b50a89140dda4ae6920be2e4c4c33ae1ddc5411f0a5998335ffaa41540227db3e6f57618af37ba08e306e576108d252dd5c5cf3a652e7e6f3449e6f56ee3cd6e9a17360147425a5ead99e6944d4f70fb27d87af42a35520dc02b2f304aaad14b936dee7404ae7469fb4588ec965d080b83fc10b7d327e027b49e68533b1a89f45ae363fbee9f47bf66fb3b2de251941c1d9e97192d3f480ff7704428588285bab435413d5c9176d5362a31fa750ba571fbd9674516dea14f88171a88539050f203f2ba0ba6d98212cd8f944f345e3573d9a77bf7cf033b60d4d109c746727574966c683071375b72a0203ac5ab6b7b36a195597487ec52382dc756cdfbd8fa87b68d467a5501deb5b5dccca4434f432c7c403e332280551c69b69adcfa8f0e97e838c4bc88a658e0cf5f81e0fc8ccdc336a71006a78376e5df1026f377f0ad923ad70ef6e4ec1e9b91a9f3f71b3f2ef54b0aaa0cfd69b5224a55fa84e2ecfb158871331cbe056a7da76e71fbd5513be17ed04736d795d0d3167b26a593a0b81628cccdb45c66db3461204936cd511736e0907aaa3b7d9ee0f0376a8d8020edca20553b5288a7abed9f1a60cdea14ff6568252d274995f4c2eae0171c7173ca3d597a7405ef53e8dbba86a3179c2eb39a36121b90c85028c7b559a8a5ad605aec7b6c0865984e4fef88f0c261c29eb5370f2aa3478b924ddc85f59fd29014fe97fcc4aadec8c14edf20605be95aa576de0c086cc795a2b86012db6dd06a7de8a6368883e35007af2ac5d55ec4d9b8e95a4a423fd87fc26f7a61054eb73134b90a6c9666563fcbeaf251a6a13e6db934d88a70d7ec24615aef5ffc4cce168e16e3ffd42ea7d74850473e3d4acf481ddec8dac9804d765638ca684b83c21e531512d6f4f8e67e91aec3ea0be13732b8de8debf7f732e2dac60f8e4825a81a8acfa15e16a1c1fc95dc3c8ae6cba7dd011c1592ab596597eaa57c18ce4abb78cb5092c356a931d5be0ff01873dcad69797f4e396a32473dcf8bad6a12e9de2216231e7daa1e0a20101f8fc2e0779b07417c788b127535a4e05e476fdd291af44849796c50680fe8f27783f6c7f014ee4586ea716409c1ad6a00c6e64ae8af89aba77ad0c61403a127c585efb72aa22eaff1c25da27042f69b7883fbcf9ca5474f2d8fb6b272b11fdb450f9aabdaea22ac6b5aafb60afe42920418c9a874ad176830eb65c0fb3cfdf31710bc2c90901d59ba93242e0741282c54b9fdd90a354e46a5c701af8618e3df36f819ea3c704eec165bc9e70b9079e5777de400ff6937e05b1964fafeec1ef17667b9724f40e749700abbf8139f3bb1c81692756bae94d816a486d5c8176b02585cea9aca100ca4accf730a9d70c7b681267b3f19705e219fa81af72e8ebe0903fccda359a73f395d13bee8545987cef10fb72d7e07cbe50baccdb6650ddd40dded51c09b132ff3bdb1ae9987a195edc552641de46188a882e064e569f9259635cb5d996274de4d35dd9cec56dc63c9ef7aef985cd802898c6d2e66181891467af174be316f340c763cba6a0a0e436db7cb053a7e6aff1144681f5a84c3cf916124791591cf428e363cf3c29880dfb66329fc1a0d0b0e060fe11ba8115758d7472a9f5cade3ee37a0f009417805db4349a80d68a16db507f672e2304d3b6c54e7c924854f5d126cb8d58a4ce7234d79e0c653f64055cefe2d6feeda9ffae78c08f653ed44b3cc73a0f16e17133e6d93ccb0a86e5cd87321c773c46bf10c12667a6b226c765c392cbf7ba0123a015984088244f35b7431feeaab3a50aa50ef540b7bf682d55b08d80aae58271c0ce882bce6bbac8c03de7086810847cb5d5f95ededc640cb4deaf7f6bc4a973ca7c8b1339fee4767849af16ba377aae686fc7359b26b573364198ef2078fa39bbcf8ef8ddaceadc925b78d75e29d1269e2f0cae1ae92f54f6cb0860bb5dc292c322dd068477f51c52b6aea0906f317d639a8a54c52d126cc3baaffc85d939bfb07e2c15b32ea2c01e5231bb767a27bf287d11052e443d842c40a20529638ed2e9fcd707da161993256c553481ea68579d516548a9cf2f4866dbf8981419df62bc8173c4606df6e12830a723ab290f420070d948be6aad4de9bc4997d816ac00c6ae189e45e6c11d5ae3c844624769f0e5902cfebb204843432bda20996934dffe602a77aadf162317a331f7c9174103e770f40df977175cc88a87b40098b95c88303e0bc591cefb1197f7aa011a37925eaa0ccae014337fea6cde8051a9bdbf46e55ed8310dfe95eff59253bcfbdf4b178fdd6dcefab59b0e929653f147c14c3ffc0c61d55bc7766d815336670ab461241c8639bc5d0d1d6937890c7a5f359e43a0398202bfb3dfedeb5376cf6b3abb48c5e6db2dff11b8b35f1a95871c1ac7a45f588eb682ec24331e55e8871f0cda0fe313ea4e6c7035874e4fb903be13f06598b898e86b70fff9463bf6aacf9bf5d849f6e56d5537d4200cabb6233f408f9fb5a574c894f4c3283a3bb1c5fb1b80b68cfd94308e3bb7ef80af569d0615db24bc2e3963fb844ea0330db11f8713348d7620badce8b36160dfdd400eaa8975e9c0acbf177f5de5e3faa7fef04658ca1daf98e4beec5933bea462ef64023ed8a7f6eb95ee2f4aebc2095b8933f6b462ce3c251698993b54467c753d383e6d9f1aa0bbacd888c275d8f59bfe6376c37721395bea3d39677c541d00befb117d7edeaf2fc038a1d48667184d4444f40e9e0e0bd5d4a9b732e92185db73efc9a5f68bd6bdc48717dba4132b3679be5842b9f7b00d7378e5d7e2ef3c7e114649b1cffdece997614488c2eb36efe029343c778befec7dc5fad733baa943c1d0e38e4b74045faa140f15562752c821304bff690cb1bad4b806182004ca3f651453ce047d8e93d7ab4921612344b53140055db22d8a05d8099244ea2999cc22cbfeeacfb5013a8127d3cadc920702886a1dec89e6c3096b29c4cc47a12c927f159d461e78354eddcb800ab31686e8c437cef22369d4f5a7b536738e169d2af5f368d5b2c2f9b3cff6aebd53f778743e547a41540f0eadb423efe48b005faa9b971dd34ca86045217c0c3479144cc702d932a3dc29ea7a0fd46b20bef245999eee01b455836ce406e2a74d21deb4d9976fce15bc8568438cbf3db3ea37aa7f28c080a482b60412e2cf3f5c44634272e61cfaabd5eb8326a6f56f62f1fa754269405ed38017c472ef3c79dac51e0d1f122c0b9fd7115be08da926c8c9b541e74f3e4b13a3c8653f7056a42a4c3f59b3c684202edee79078e1441b7fa8af73fdb9ef54f5c24be523ed4379923d31659077f266f3c219abe7a7d65fa7ebe93dbd26c7aaad8c3e8c37d2ff1e88f581dddd577b301dfdab76ca7e6b0737f934c6dd85ca4caa17df980d59a2398514c2244f497c069c6329e3b390b8aa0f1d32d4b983e8deef2b15bccec53480d4c886a75e9ae1efe7f0fb4045030dd53ff31d763c2c04170a4ad3147f683f1f57e2c84ececd95a2638391a8837c9f1efb949e54f111d6dc6e305c40141c1482b28be0d2a8e39e84f7c6bb11ef4f1b37bcb16264006ef79a7889851a435f47c9f5c90a47ba865e4efce28bec991ba66f62fc4afa810fdcd1012aadce1f67a484cadcf5ebbaa6a781040a54d5d9b7562e871989bd6bf91035ef2ccbd128d926ccde6ade9e5426ee2ccb81b23863e8e81bad4ce67426605b81b268c77856fbb7ecb5cf3db15fee72c714ba3df960f0d8183f8cbfc042f2ab4a349a8b3e4e76c88c685b3deaf71d8b28ffd7a2e57016ece724afad8e471a4867d652646364db638287a224355c23a0d468d6ef1f28f88a01c876f518277337280e60264a1e10831789567a063b73faf73a741fc9bc349fb2ad6d80f243c1366a55267c4478792a5d71f20c1392468b18317e3e0af5380bf90db3eb8a6e400071d09f2601326b5b50b0d0fd2966daa09a76a274ff2a18cb6788e80fa3e5a88713a37f4e6ff27cc2f49141b02492f0def18d8692f15adfa4586e028674147b264c03ba0f66b8a8f7b273eb5bfba487f3bb0bdaaff1771e4888bed9e021089585c2ace34624279f62c2e0cb590687536bfa58c3c3a705ff227fb66a1025009d39856add1f7d6ab79503657ee67387c712d9281c2b03209292473517cf3ba4e77280eb4bbdc5d3b3907e2456143d0539803b2af0fe4c0b3b3a0b6e70dfe15b24cd4e61a66227f1271612f64953d270a3a35525b9d6f1c88a18bb10be1c578c06c0a40f1a0c2c225e6e24c67092cf3bc0c8d3ce7e0a30d430243a7aa4c7c5967b247b44463a0dd029b9e0c1945b4a254f2fe862cce06b043f419b43ce473a556bf1abe54ab6f3686937224a5036dd717a4beb963528d2eb929abe883095a13568cd4c21eac7a60d6f6157e34fd52f57b2ff1e13bfcbfeb6d3dfb464d5505c6a9b216c4590f5f350bfe73e51c8209aa766e482a438cfdf3fce0fc4be2bc6da1563246d240692e30faa83ec5bac56cbcba81e3d90bfb3f834c1e51c1cee3c516c97fd0205f3ed53dd465e70b214b6236192133d029e8320aebbcf3dca0bcb3b9e60bb33a4f1695448c328efdaab223fcfcdece2089ea0c217ca40559fb60996c51bedd8f0b0f72567911780174ea81474172ebf7bb2007c430e4693d374fed9ea83279f2533e26f0c38b3abdc9ed924e837508c52336562055a2a8157b6ac82be5d773d488916fe7c8857cbf2bdd582ad4f632c1f04137228071be590cb42799fa7e5a0121379a04c16ef0cb1944328e7c181ffca60f5bdde19696f0acfd9436f5824d0bd39c0fe6a1224908561feb7360a35980eb9901f0b1b277026606c06432f798801f3a7c25c02c2a0066f4f58cbf455b2f4b6f7edc2b302f2efe2206a46f2f522f89f256ba12c73590878eae0d8605308dcb5e5657126ce1d499335bfb9e755bf2048c3abc0107eaf092412528f0a5a13f667996f546a43df5aebd123dc095356bf271b0a7aadcda6d38529915dd7f515f41bb417b7f9d84c98e6894cfbe6981a0b3977d330d38d6be9e8b104136bbf528f247fedab4644211cbc803449b685b133b4"}) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:06:51 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) r5 = io_uring_setup(0x33b7, &(0x7f0000000800)={0x0, 0x5221, 0x0, 0x2, 0x265, 0x0, r3}) io_uring_register$IORING_REGISTER_FILES(r4, 0x2, &(0x7f0000000880)=[0xffffffffffffffff, r1, r2, r5], 0x4) dup3(r2, r3, 0x0) r6 = getgid() fchown(r1, 0xee01, r6) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:06:51 executing program 1: ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xb587}}, './file0\x00'}) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='nv\x00', 0x3) r1 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x800) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000040)={0xd03, 0x7f0, 0x1, 0x2, 0x13, "4fea8842dee42168f5bb22f589b4202c62617c"}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000000), 0x6) write$bt_hci(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x178) 12:06:51 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, 0x0) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:06:51 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) write$bt_hci(r1, &(0x7f00000000c0)={0x1, @write_class_of_dev={{0xc24, 0x3}, {"1c7785"}}}, 0x7) ioctl$BTRFS_IOC_INO_LOOKUP(r1, 0xd0009412, &(0x7f0000000100)={0x0, 0x9}) 12:06:51 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0), 0x842, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x4, 0x7fffffff) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r1, 0x80045400, &(0x7f0000000100)) r2 = dup(r0) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r2, 0xc018937a, &(0x7f0000000040)={{0x1, 0x1, 0x18, r3, {0x100000001}}, './file0\x00'}) bind$802154_dgram(r2, &(0x7f0000000080)={0x24, @none={0x0, 0xffff}}, 0x14) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) 12:06:51 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x80000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:06:51 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x200000000000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:06:51 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01fcffffffffffffff0000"], 0x178) 12:06:51 executing program 5: openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r0 = syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000040)={r0, 0x8, 0x5, 0x48}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) openat$cgroup_type(r1, &(0x7f0000000080), 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r5 = dup(r4) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r6}}) 12:06:51 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, 0x0) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:06:51 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:06:51 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x300000000000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:06:51 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)={0x1, @set_conn_encrypt={{0x413, 0x3}, {0xc8, 0x5}}}, 0x7) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:06:51 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x1}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) r1 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$KDADDIO(r1, 0x4b34, 0x4) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r2, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r5, {0x1}}, './file0\x00'}) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000240)) ioctl$KIOCSOUND(r2, 0x4b2f, 0x7fff) 12:06:51 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x101000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:06:51 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x400000000000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2519.258033] Bluetooth: hci0: command 0x0406 tx timeout [ 2521.306138] Bluetooth: hci0: command 0x0406 tx timeout [ 2523.354118] Bluetooth: hci0: command 0x0406 tx timeout [ 2525.402138] Bluetooth: hci0: command 0x0406 tx timeout [ 2527.450083] Bluetooth: hci0: command 0x0406 tx timeout 12:07:00 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x500000000000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:07:00 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x104000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:07:00 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x1, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:07:00 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x781202, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) pwritev2(r0, &(0x7f0000001400)=[{&(0x7f00000000c0)="26654dade0c675a6d1bf3123eda48aa1c45c978209dab56b864ca40fe343c046351633379ce472a6100803554dec0fb12f92d3acc08b7dc5d05dd6db0ebb8bfe2a2c39c1e5e2e46fc6277a31b721c041fd14d37bcb81ab526cfeb90445fe276e68682a7039d31df5", 0x68}, {&(0x7f0000000140)="0c09bde6c850b6fa0e8995eee20d2d17a69b239680bb3d5d1dc2f717e2f667eebdb780ae27b0ed3233b42d4c7096bce9f8c3b6caee8d6f79d243adf96549e84dd8c33dfea6e82694c95b71ef007b87a5f1e1d1c8a075bfd39a5c6567c45bff2926e7e6b0734d19c787aec826dfa4d5f254922cdecbc6c020b2686635e713", 0x7e}, {&(0x7f0000000340)="869b338019c20230680932be974c8e1c1b3e360f466b5cd2566d5cebb65c357c2e296413c50be3225aecd9e06c20bf40ea445543a7ed15f1aef7f9e92f9a5c8aff1457d445674e95b96a808349b2eb847e0c2a2c52e2b3f53b1ee8dffb894da6914c5c46d697bb56632c6795bc1fad09b8f0f968e0eea52b919586524393bb31453e18f29a6a1c85948d10e8d282eeed42ed60fd4d7245dc158e375cf521258cb04d52cc5fe83e7c2f2698819dcbdd9b93e98091f260b2b8f5f3f8febefd8a236fa7376f0a0cf8881bf52720844358154bf586ce28ea6757f4992b404318364d124f7929fff179d03fd79199ce2462651d456819a3be7557fbf03edbe1e87bb3d33afede785f063da5e4d76d848368c98e9c34bb33e56211c0b4a6968b231a68e9148a0c2da48f35f3085ff99c0979a968861972b8ee10f1e3e3a14f438087e7850bdfbe5d94b3805b89815a33f7e6058a2e40aebcab42829e0e36e979606d6b25eb75eb277994606af3723096fb86f5ac62b582ac23459c1cd8d23854ed429bae4291bec57870ae0647000c9fe7a29e7505854d08cea2b969063421f1d5d83bda529f9090201e0667925308b9cbfc33473c4b7df899a9245f13965ea917fd95bc532b7ea6c5db7e39a14565fc7801d02197169fd8347d325c39ebfd90035061d332bdd68422f8f0ede37b386d5abed170a9d035665d0f3cc757ba8801bce219e6cb6c1807d6f129844761d597cae13f699d298c4ef1324aeb9f4a2055d15c2c078c421de1c8afbd82afb5221e3114fb3ab2b4ffcc003eeb9a5accbbf8c52f608f18fa668b7f75beb909c3462535d41a1463d6a57e7e471be69171949e2ed36da0bdae5971bfdbaa8bd0ccce36077d88a95cfbbb56834ceacdc7df288dcb78b41f11767a8d8f469f88f5b93e59142d2ddf048638acda691fa6ff302fa6fc72a1b2ccdacab556635b23e98a7dd3dc595647057ff17343155a2450724f9107718d80a3832214b4ef0c50c6a8537d5721b585b6bc0b6c4bf16d13bff489f8b8aa470f3989b10af5ba11bf6d22bd807ef1934f342f0a48c9fe0e7f243f715993e76f1ec3762f1da5da3e635fd85754de587503675d5e79ba8ee71d7d4620d222ee50e6a10d3398477a4d4013bfcf64aee7a7218d5a6a07491fa357aef0f83a547e274bb4dbb4f146d17ec32cf49bdf5b2b4da6f8329d2401d670aff7e5a42fa0e9a75413424e0585bbecffbefef51706f86209d578e23ed3d09c5f316758f15070669d3468285fe6b93ff32dc07b320775e03b38832e689e8129832a44fcbfe0fcb238bfc2e4cc5f5ac4a9275963268d01fcd0f27b9675f7d802695ad303de40477f42bcf0a66b08a4804d9681094a17fd1df035262f465a500be523fffd41bff2cff817748183dcfaf7b413cb93709b56204d9487917fadae2318f48e139358b9cce5efc4bf2b66cf66a1d22df93c55c72fab6a406ec8c7c93951fabe826f517414c92ee503235439c78862e24398d4f20fe8fd41e6681679d6872b104fd2b510bbd9df64df8d003a0c86d3e65d53f926efd11be94212008298d57eb4f558c174111912103a74152b5bb811cd7d6e10df53457e9f903f37cfa78c4ade54c7743200ee4cf25aaaed91534c1454858a064cab19513435299ed1539ac0e8b941616805f9359e0eaedd5c3a3347706a3193fb10160f654162147a41551bbcf792fafba2ba7f4bec5551a264d33628090b5bc9f1db3d78472ab7f272472dbf0fd5c3cc1c2f66afb4bf8cfad8019e6158116fedd2d37f4f205becfca0f6e5437290e33d09ed275e3de8e308d20da27261efedaf01d165e1370240c1f4b61321bf01aee347d22f8d5523b8d419fff94d3bd99007facb853a514e14c24c877debdbfb421c014971ae4bdb22273943a9e990cdc4495fef09e9aca98c0eb931c54440f13a6844b3474b07e7ed3ee5f8aed508d4b0367878767089f502fc48d9fe31a09f5c61c6f453b138d8ba850fba4b194302af1b548d49b7faa4ca90e9013c0c8ed9082e985ff406267bfa1c957f8f5bc7146caf0efd2cd3c20f854d0c3219eb9f0a1b3b5023585d6ac71e017aff5411d3fe8b5c057833618ac026ee01963a8e1a5a7cc266264466d72de3f7e69f08a8f1164aa40855b294175240b67e02469a20390d22259295631c80b5b1a5c84f486a0091df0dfb68bdd435c1e5712ce0a650a2376cf2bec10b4c3fa7c10e8b371c6cd7fecbd47cf95ed3af73c3b93cfff68efbcc5fff114007be2e490b766052115c7652626996d1032df98a46402dd2bd7de987902f4fb3c9141378f2b08c5fbe8195b86a14aff3b614cfb12690dfb730455a49c5ffa75d7a94de2eca85abbb42c974926c49c3353a1a4e51900c3bca9aecf8136af533f22944fbdfd717bde89a6088fff8ffb449371926fd93f1133384b489897dc8200e6747d83be0061dff965ab0ea6e81cec3e99da296c58dc4dda9d847318b4b516b8d0c7751793a15eac01821a627dbb85a799076ff3791a687c2e9537e4f9e3df3c143f4ae7beac573b0ccb4341e3834f7d7c630faf607c08447db64fb34998d47541326d726b9a855e9b1ab6b28482f360936033219093b4b47f12fa41bfb3a2bad1e60aa4cc5589e5707fee89e337e616062ab2ae9025ba3c5a13fb35b4f90f50eec11015c53e29f33ad6a9989619430ebcc55d46da9c3ad1fbf2f79ff3c433c49d9cca3ca26892df309d561439085e1afc9a9a07b510397973d0c9193b6ba7281153c768bd4b6255b68b1417259fe1d9fd2d00a9809dc01288b9bf144ab47ff511f0665e38ca0e93c5964bf01f53f91985c4ad583b9054e9f36b711b162d57ffbc15727a67fd8de21ac8863851995086532d6083b7b77227999214f3f87d0bf80f48b9295b620014fd755038c4cca11b6d0c842bbae03b013bbe7f085419092629ee53174f65cd1584667c100accceed1143a15d8bcf3366f442e6dd24e8c960e3719fb18b812e43d5d3cd4ac70adcf43ff5f16284e0bf3bf9115200e31c9e27ee1185ccfb152a40dc5331fc157b74eca43adf773883488efd5e4d78b47239f7c2a7317e3f8e1e01af6befb4d7b36a20ff94c905d072580bceed6356154d08ca0dd12b417dba314f30d906ffa2a87bea07aa083b6b8a673a245ef4170c10dc832b24ac3ba25689b83be440505f39ffd1420d02df5c344d02e97a22abfa952b926768a145a2e75471814c8235b75970f9a4a13e833e14a73cb19bff259b90bbe4d6111ad1ff86311820199194ef3d008d8a7f21f84a8eaa5b6d860d3cbac5a31588f0ca948d8ae9a0ac3a555725304792f0435abbf39d405aaa077f20c52175afa4966b34feda6b44f90eb56498aa906268437508cbe40d4ce90db8b72e9646e1237aeda01edc2bcc073c633584328a0a9aedb0f649036998072c167b94e9e0c62f01bd3b01bdd1e3a9b410d1fbb7e2cd6805d8c201f4328d24a9ad9f688a7e3c16fa39956b6a57d88bad77468e0b531ef4b08fcb7727f69b533c1ebbe8a1f96aab17bfcd79958da200cdf78a304f2f8948887b86c7dd3875ab23743424930e8d7e1c49b547ff137da03f8e5bb448b0283cf1606655ec50c8525a65cda16e71825d7c09ebdea07a5db7c5b324c57d6aa901d6ba9b6fcfa8b9d1ef2dec595f22127df0cd6ab249127fe1a9862c80a3ef28ea2648f634d274ed0c1d556b847d3003a872bdb2a9717f5b23203fd0ba15b7d8cd152a12fc6101f4e70df2add194929fab117cc07adc08fab239367d83cfa1b3fdb7a6989049ed577a7644b75e9d58b3f8ee05005c1618edfe733c214853d70209c06f390a4514d626909135cac518c64f07b7544330380850e1e464aa357eae22086cce761a9640f9ddae6a632c2331207a8d8ad09178d2fe952824276d9e9da58a8ee840c2148b005e36ac0c6a46e23079f6bb04d5eed7e19ad85bf78ec3fe1237221a279ffad26b038593a8bd12be095842ee10972b91a1594a08661d48793c55a7757635da9ebcbbdccf45920095ddbe025ce1f977d49e123f8d264930742f80c0299eff4bfbea145580b1bc4646919b6bfbed894406398e531cb4f576d4a4d6f5fbd750ae20f71245cb6175fa8df9d7e719a92d89321e78a2e1dae2122d1edd09b74f15376680cf65f14326e53aa4b84c242379ea9991dfdd69f7a63058f74399f8ad9c70b2e57da40142ce037ba875055e13658a1de4dbf529e05b278119b4108348407d111609a9030af126a2291fb87b9aa1d69d8d5d13329ced26ce2ee160c68e3a398fff0500bd0e1833bdaf52c590a622a5ce3f11203263ef37aef8093c08bf475313719f3a40d675badaf85bcc8d847f78767fd25a139efbdc076e8913ba1617228ecdb00532ba5f87f390ec13210af3e7eb6ca4460d1e651b491e5934da3a1a6f23081256642024c6ae8069360818a27cfc3b787009d961d4734801f1c1d83e51a6509f4bf47b3687c440bec2d49c41be65f6aa470b48dc2f0c64a47346e941e76b114c64fc410d04901dec37cc006185291006ebf6a5325fcf60edae7106a866f6b6e74b51d727a9e8cbb4f6437a1ce793d3154e6e170a96d080c287f1cf156a611bd779d6ce82fad2a286748b6f514b3f5a5c872cd2bca51459cfa848c577f95113c21461dfe5a11fbc33e1cceca71827f33b264910d52a4d7e0e9bcfd5baf8cc5ed056eaf77cb586a6bf6d8f38e75fb40565f3d4865513ece3651a42a81ab062542e4cbd3fc23d0c81ec13f44b8eea1113f5d43ca048fd3d7e2fd463e32f8ee8499340527755575bb3151449a028f250bde07e4de2f422e8e5a2835da81384d7ffc10c18c6ec2fddcb8ae00258f3d002ff9a97b211c3bfc429f824391a76e06b21c3798cad4961fcba76f165305126857d50c99b3571712420ee05d6cb5c6d7f3d6587adb2eb88e15adce99c0a5aae907509f400575dfc5ecfc1b0dd94284ddeb628e0bfd4118890b877ec211f585778e9bec944b8e0a009afbc4dc3a096b7cbfec04dda53c7f749dc95f3dbc2b0118b20f12c0c08003ea863563c9f595d6a0da5973c79072450c2b2736caf355fc8dda8440a37462f0dcf3ac742b5dfb60865cdae790ed5acf73d0c9be0a4e48eb83dcf6760d9aa66806bfde2b2a23e751ee92614b2e254d3f69c9033b07a9688edce0969d5b431bf045f64ff1dc381033c73efe82154c3addf2b34b23007cd208a04ba49d4ab1492f38e66ef34f6198b82adb304cd5201a9b740b04d192f3cf2624d0f77d087f1c8928055ef413b8faf742e97c3b4f9bffc1ff19d56e62e89384898e7ad6f611f876ec0e35c9eb1ca6bf0ff2fc10e7f36ef124d0d82965d1f429e3488fd34399bf32dfd353bcec57306b368b54ebb0a41bd80cde5d7784e3525bfd7d2eac6e30cb39758377b16fa7439a6c8727c530333b1e90a6d5999b6bc40e13d12f3f55373adf4e1954a653bc49fb0e4b5222ad8ba30f1a055bf42a2071ae562c244db5bbb7ac1410cb4e4b62ceddfdbffe3d930cf4b864cafefbf9f4956ad02144c6dc3c77f1174ab2c0386358f553c9e5054cd20f735bb0ec27e56bad0b731d9e3cca7a9d79ab2804ef4d8228d82ee22f707147d41af757a8ad3808503ac969397417d9b0ed7257084a0fc4ebbeaabe05fca57ed491445956a38f15481f0321f1611a7ede2e505a420b49e320e003859e3b6364d3f652a4bd36ef7b5aa6ef089c7732032f6a34c3521bba0d3ffbdb007f289d1730dffd8643690ff26998c30c98ee9e08bc2e1a1abfbbe439a9294fd4d6a9879de9", 0x1000}, {&(0x7f0000001340)="51107214512ca2bc2767caa513000a8dc1e273ddf0a2fa76603a3d9750c3ead59717", 0x22}, {&(0x7f0000001380)="c18aaa38e76d3b96a3a916c9372e348ced6e433102f3f13b2b49de6f080b7663e7900dd2bffe1310de3e992ec7f08eca35452a950b574f82831d3e807db38e60e6", 0x41}], 0x5, 0x0, 0x3f, 0x12) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) getsockopt$WPAN_WANTLQI(r4, 0x0, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$EXT4_IOC_GET_ES_CACHE(r4, 0xc020662a, &(0x7f00000016c0)=ANY=[@ANYBLOB="010000800000000005000000000000000500000096000000060000000000000000000000000000000100000000000000000400000000000000000000000000000000000000000000000800000000000000000000000000000200000000000000710c00000000000005000000000000ef000000000000000000000000000000000a1d0000000000000000000000000000a10800000000000000000000010000000000000000000000000004020000000000000000000000000000ff0f000000000000320900000000000000000000000000000000000000000000000000000000000084050000000000000000000000000000000000a0000000000500000000000000ff7f000000000000000000000000000000000000000000008d120000000000000000000000000000050000000000000000080000000000000900000000000000000000000000000000000000000000000004000000000000000000000000000091a4105631646937cb744d6da7918446a8334f34caca74bc309d89aabc2dfc3d6e814bce07f9e58bcbc6b0f31aa35b199430c1c78a64856fd114e8c2fdedbb936c4b483a11fb7e83a4aafa48de23d1ce22067c4ae5b23bff0a6b6a2aedcd72a1626668cc1a168afbd205c358c1b957050e318e76667925badcb787bfc36abc1500128ba3cbfb23fe7235f464e1d46ab2e6bb03dcc7b5daa7a176d8817785e5cd33f14800"/531]) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:07:00 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r3, 0x40485404, &(0x7f00000000c0)={{0x2, 0x0, 0x293adaca, 0x2, 0x42da}, 0x101, 0xfffffffffffffff9}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e23, @private=0xa010100}, 0x10) close(r2) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r6}}) 12:07:00 executing program 1: ftruncate(0xffffffffffffffff, 0x9) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01330c0700100000000000"], 0x178) 12:07:00 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01330c0708000000000000"], 0xb) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r2, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000)="b7e8a047", 0x4}]) r3 = socket$inet_tcp(0x2, 0x1, 0x0) io_setup(0x6, &(0x7f0000001340)=0x0) io_pgetevents(r4, 0x33e, 0x4, &(0x7f0000001380)=[{}, {}, {}, {}], 0x0, &(0x7f0000001440)={&(0x7f0000001400)={[0x401]}, 0x8}) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000001240), 0x501002, 0x0) io_submit(r2, 0x4, &(0x7f0000001300)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x2, 0xffff, r3, &(0x7f0000000100)="c55613ae893d0402106d0353c232431afe2958a0943a38c9341d41b729425e62cfe4c073fbb0eac976a475a61bb7bc98e0c15e7d9252d66269c7a6eea012694ae1373b99b6af5c6d21fc13851b4cdca3028be4506dfe2e3e6052bb0f896f70d5efc31077605a0c6355590f8eced799bf352dc6b1b0a5761fe5300f87c3573e50e43f7a990865f99ff2b73402172159c7cfac5df659a29afc7b6ffe6cdb98e44775d2da5722d761f6717cd441187c63ef85d628b198458acc505b0196d019524bdf073f098e5e3458222b257abef2308b3baef9725334b39d667b5354f85a95a6180f1104a28acbde16dc67f1050e099137c6b1eaf6aef3bac4124b8d4a5a57f97cc1382e044c182033ccce1e4ed92dc6092b109583e4507efe5baa0f27b5d08640b77d4e1cb1196ef693d208c85c9dbb05ed2f58b8470e39559640a5efa4f8e713ad0c22dbf7433860e18c0a699d518ae98526289e7ea7a3ff863839d1627931b81a1d0f66d5de27cdb85baa17609e6008093d591be006a9d9db40faedb9aeca83ab4d46b0494b241671f963052d71bc7471ec1513e1057561f98af81a41f290f7ddfaa68efe0f47a4415d3935427ae07a26afa2a149674be4ca4e277e45b1df07cda1a023517f492406918de8f49d46f48c26e550a79f2aef2bab4e1fe2b06bb469972abf44bc8fd787ae0da2f2b778647ee45a9f79eb79a46d353ce18251d54e87885f7df61e707e49cf9f0d5ec9717346ae7e14120cdd3324c57a80fa235272de69ca489d08a0f81c416737e25db0fa1a73d71b935ed1d5dc2952364ba1478e92cfe2e1d91722ca259364f4b4d6ac519d53b171e3e4762708f6fc3c141816e1fc33af65a380b71002d9fb6b157d785b10bbb2499e9f12450f6f84ec75c26e45c87c390a05a97d4e4f815cb2aa528f8ce129df9887abb5ebbc5f9a766f7752f3af0aa2c56f4f2671757ea544f6e4f51bdb2d67a5bd3c6f995f50e7a8a6186aa48b9e10fdaeacbca4f4591dfe1804e60dce7f52469a716579338e55e5264481856f262f4a4a4691e2242dc36f79a98017125ff1cc594138ffd5f38aa5873a2d4b3ed50632006f5df678ae4db84572d6ab773821a508c26fcc80dfa0b960a9a979b3503cdd496a2e08599e836cb1855e016c51bdfffb3b6e1b4c7139c1cc8876c00c1e1561e77275ae3ccd2e613fdcd90e3f7cc591d593dc3415b2ddbe4bae526e8acc58fe89031743f52744d669db2142f192b794b6217f13bb1100b03c9cbe2fd85fd864620d95a6171738e18930c85b75203480183fff138ef57000aa92653c980405d7dcc00c9777c7c837c7f961d71ad7a9216c124eacaaae5008bd289c1039eb933d83e50927f40a684747062073e1e4b9f003588698e4ee47d7ade287925b14309b91be87d67397938257e3b9f27185391150c0a88b6c1c48046209a05d12b8eeefdca0e5795c0e29cc1f68b453fae0774f994b542745a02d926a2579a44c185c722451e6755d0ec89456a69e359f99a1e37c735a5ab4a7be651d1c39c798961001bc8b12f6ca59142c7945ecf4a467bd8f4d6116e3e378afb1b2152b60969ffabcaf46122503b5c03c88bc21991c09e16a0a67373b0870a83ff9bc4d00acbcda559c571a9c542249e20eec96d8a2af7a6bc234e271d06a4d8382d0bf5a2b57020e983a0924a6f2e925d757e303904975e8bb52e7158d7403dc4fdeda5d0bca3d4ca224235085a51a65853583adccec3432dc952a199778f6dd0ab54ce8f01beebf9980a6d61940a0f2293d6e69bc3aadb74746aa44360d0d03faaad768fd144aa96076321d0911613fe858257c8b795dab2c4c3945ca43b7cfe58a0c40f20ade26fc56ef4881629e4697513248249f5ef7e38acb1a03b3f4eed9d82c0e5ccee3eb2a0e567f887817370f9d344c2789636a42f48ae8ea54ff9b66a6902bcaab99beffaa578f923031f42389c0a399b744037e1e129205a36e20e63135d5e959e62ad4396f91da8cdc59c457bdb95269bcd5900b73660d8de4166b84ada3f7b81161de38e21e3fffcb8d605bdffed7f0e9d8a1746e1ed784b135d329c56ecfe847feecd396dd3dd24a6cb77120ccefc25ef36e2237df628656560144655b0da450973f723c4230cf5a800ed311c109259b07fe989434cc8a414b848e79076dc1128a7753de220cfe44d5fc5b82f13fa636b6bcae22dccc59191e6785685f671fb6e09036742e4f328bfed605feee25acfae17e83eed437c9394c291ee38e5c543aefb66b613eb197354bd292ca9d9395e033abd299c39cd07c7941affb460515793f0a286ee6f713211f031bfa8b0b41fb330a54d29c2fc0c39b199d2e0dbbf62a6955659470a1cd38c4c78467d56e8b3d639e2f94243998f2f976fe1f5650626a7861a2013dc021b95e5c5878520ab5475ec2f51bc597eeb07ea28cbc759ed2ac991eb39a72d397c039f1f5c3e277b0525266230e9e4de51143290571cc88ca18fa4b88be8c01ac686443981d070b870f13cb21e40cac7e53dd50cd2d3c190c33344107bd3a26b5b018a268920a50e2aacddd5e696b960fdb94b4d7b98ebb7df3d8dadfffa882e7bf9f54ea32344b9b519376ba4f0ba7461096b423eeee09136c9462245a0815d7bb63899888a0c80a0b813660b0974cbf9a30f6a9fac8b2de3f40aaddefa2d4fd0f65d1672c86c062c1a58c446e392aaee306a9105bec95e968f88afa9c54fece065aec4ce552ac1aed0ef32080972395bc119cf393c3a351766771f4ae1c9c50d00197ab4b46dfb3cdad6deb8aec92c0bc2005ed8343fea47347091a84aef6c9e3d4076330552de3d52bb830469f1641b7a66b27caad3c5eda278cd6b5e82b293fd69be6bec33644a0a806beefcb19e6c2d4e9f13b14bf1ce9ee4bad40230b780cb43930cc052d03e4d4a8b02694bed8ea844268d661f298e196a0733ca63ee17c9205d5a4a9511a7162fa12be622ed83dc0e3b94640d89b329105b3fc80db01c61e69c5e4f813a51b6b2cf658269356233ff1039ff561db9482d51482bc959195978b789b3a6ee895fbefccbabcfcee1b77ea39c693a5774351db0073bd6cb6adba0ca7fe809890cbe67c79ced31d381b2f79d0da42a6e709a379555f322e59e18ea367912758848522390ab74aec19c911b092f2505c59f3d8d6dcd281ffb3dfc03cff788f85fad87e9bdcb6b46eb965fc723571eb4b574c2a914ca1e86c4e067e2bd2fc383879c1785620faee811d23b6d5bb3c0f26a1bd014a08fbb0ecd3441e2c624346c9077bace36773d812bcf6af40f5a56ad8da9c02884223f92c7e12dc7a064a4e1245eb47baaf12898c5024a59776a12d736915bceab99ec00e973d815900c152c7e8aefeb3e9bfa9ff2fdf17ec9702fe0447d95c73ea317fdc446fc5a8840df0d80ca871e13f8019cc70254a6e450657b762c16fdaef753ca3bb8e70621d6e112ff70aba0c2b0c1a037c4c61ddfa96089405242e0ad682e3abd99ba5c70171a34cb26940042aecabf1c989d7379d2f430598c42f0029ad8c47fc7e9b78dc19b2b31dfe7f1c4415fc30e3ba88d097ec0d78edf262783830b5837414514957881e053965404b11e4c47d285fa372be95a08aafe0326d043c973e511ebb6120021cc2f34e2becd5f48e70a9f4490bafa542ea3d4e85c7681569a1f590fe13704bd34eae065433cfe1393be3247d0345b387aced6d771d6f983db3cc27c08c563ad77213111b7ada84b8a6d16b26729415806fb1d6faacf30dcb220be41847b89d3001e91b820d997ef058c6c8b12d7ee50088baa349e51de5bffa49032a1f13ee587128c4bb829951a315e17c7229a95d47ac6288106d09abe81cc99ab627c1f2aaadaf70512563fc153ace198da967f7d27ee1353e5587e7813c87601450d2d89e2c9a93b3fcbae5a97b637368d53e70be2af66fda80900281b3dd9dc630cf18859d44d36fdc470b4eee9fa48e22239a2e060fdddf95aa43121d5fb6020b03e5ee2410d1193d244f29b00863cf4d53705e75b6cb2508bf57f44150693049843e2a3cc3bbea617d1c832306f20334855c972a9ad897a1d4b74e884262504fff7dec006d65c398185e195ad782fc7cc96561782f155c23768b718beaf09789b6dbdf88ea5eb9611fcb208718bb240eed23750a9deca4c43193aa6e6aa342b878ccf84674025df9f7a6720f1fef9ba1c04062c186e5af7420595f3a5263d573ebfb252f5b603bfa2db3aa17fbe0874d29c0f7f1860ce33b57e3d859a994c111b657d0df2753167dd6a0b4f262d1cf59572a9001ed0a6da271f7896509d3d586434f9fb635b17b058caa06feff3e7ac1c7d7ad8ac273de455e2bb72889446c8f93c6e7e16f50e10a815635dba737eea03b47eb86e840d242eab096252fa3dcab6606237c7436e8691dbb88d7fcd93ac83591b7182f2534229132a0f838583b5abca462d190db24a985993576e7e6d50ee59f089be09fd3c8d5b09d6b7892e41c7ee62855c75b02311804fc1a8034fc472ef8c51dd76f252176896d161817ce955ac0712311f21f73a66bce8e93e7a6876bff78e5b3ec20cd91345a3e36e07bf2db98b276d2a2608af9d8ff31a679d56a886b6ad706550c2f08f8d5b6fb14283fea59c1e10d081a7cba473b9f225bc240f7b7e08a8270383463959bfdf58cf1e248af9bb8c5a98c06f4150c6be17cfd7ee38afc013e451f85b174c7cf99b5653cb372845cfa139942427365864117edd3876645c816ada568f10393bd3cbb87c178da7386199c3c8c28942cf99997791a1c25311aeb4eb6796c9f6e6574c3090ae0ba2ffcec9e017b2ee0203f9dc67b5ff5ebaa72ae7071cfec97b7942deaf1d8f4d3c4196dfaddf717fe60a5ce47e0378ddd5bdf20ed63c1890c464c84b17d8085593588d9c1d1a23efaac73081b4b54f2f2ea0cfca893f42bf4f311f1e337a6055700e64b7784382cab8f31c0335c45573c11e28b2ec6d6156a64ea213e028c4568f45535c0b62cfa2880ee71202215635f645fcdb2cd4b0f65b6a54364133a0ceffd548ce06a30dbd5a4baed912db222aa70229e751dad6054505fceb6efe87909ba5761793f4d385c8cc2b020038ffcab630b69dd4ff1251bcd0f1b0328a42b57466c1c2d2b7c09a6f5f58f0b15dfeb08db6191873fae84b2f936cd6e1ebd6abbdb66cc67544323729d6ea4ee84d1e28e45f170cae45fa6e608aa8409560e26dccc19c38f7af32522735ecc1b8a2c20e05aac593f3dc7a8ae248f49aaf3473eb059cf150957817d11e34225bf79b3113c7165ae0de462d5dff3e4cb447607f855c37be82051188d616bdbf7c6f21d460ef2e0861e3f59e8c91707c3a450da2b8091d93d8d60dedb1184e41f1d8531840b85cbc55be22db5673e980540b67dd5d5837552ed2674b6def44a8deaec7f3a85d5b040acadfb643514db9a6983084bd52043c4feff17856085f6d8a4217854e4e0c0ac6ea947460e1288d7d960ede9be8c711484590a3860baef6bdd43205c0be1c8dd55618f11a4a3eb8280ee5e8e86c1a10a1e8e33c3901edab2cbec024867bc1aabebec05b7ea4237240a2b374367ea3f05090c26d30c6d4ac272dddd756ba5e3c769f86cf7b9e0b01954dc03069467734995cc665cd4a7bd27c2c5106d6fcb441ecb83c321ec7758052fc95a6e41395d04b0891242f61f90ab46a36bf3a2c871eb5aef3eb044f698c5e99fe7f00a2760db63165758496ee54fa4dcddb8875fb2c6a14eeaea215e09959c9e0a8bba945f8c96fe212861db47b35094a96fc0", 0x1000, 0x1d, 0x0, 0x2}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, 0x7f, r0, &(0x7f0000001100)="d41481e94aa634db3066e0483a1581639aa470c6fc83a8faeec44d4e1d5923e1cf696fee05fe547f185010595f6ea847853c65b65f917caf321108ffa95f1628cbee8713f0ed91a2b4660b02bf1e94eb38256143adf357279a27e3a772541d54fa3141a01c884deb170834bbd7c210f3e50112edaf6fbb2f33c70ce2f5f8fb88435019550b752c467f30cb", 0x8b, 0x1, 0x0, 0x2}, &(0x7f0000001200)={0x0, 0x0, 0x0, 0x3, 0x20, r5, &(0x7f00000011c0)="840cc3c9a6ec1060", 0x8, 0x6, 0x0, 0x2}, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x3, 0x6, r6, &(0x7f0000001280)="60bd4f3294119b51dadf67d92e619fcbeab9f5bd8f022bae50b939801cdb0d46f7cbaa54c99d3b39ddca773af9c1c39426", 0x31, 0x6}]) 12:07:00 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, 0x0) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:07:00 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="02340c0700000000000000ea88957598a062466bab40a1be17f41d58067a61bbc46d0ebd6aa97a293a45da0a0a741bd9d99b9f57492fb5db7da41b3838c4c6d9bfbcf7c792eb325a58a993c51311d7296c69936183587add018a66b309074699fdb55ad24b92c6ec336e02fa8c3cfd52c522ea5a90c4b4d1fa6a6e6dcc4741fef051ab01f0ff4d94c4c2de3b7e7fe30bbcc7bebfe14078ad36fcb61a9c186d614fb3cac4e1e0ea3dcc688f70c5c64308"], 0xb) 12:07:00 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:07:00 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000000c0)={@in6={{0xa, 0x4e23, 0x7, @ipv4={'\x00', '\xff\xff', @loopback}}}, 0x0, 0x0, 0xb, 0x0, "fada9ab9b9ad7393edb5456d4ed8ae3681d572201f8db95d95c2712bb04ca4a6ed30a992e77f5813764f96cc74b724dc959acdf69c2632f6cb33b62221e9c0acaeeb4560d343275522433a4166d7c0e3"}, 0xd8) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) fcntl$lock(r5, 0x5, &(0x7f0000000040)={0x1, 0x3, 0x3f5, 0x80, 0xffffffffffffffff}) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$bt_hci(r0, &(0x7f0000000080)=ANY=[@ANYRES32=0x0, @ANYRESDEC, @ANYRESDEC=r3], 0x178) 12:07:00 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x600000000000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:07:00 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x401000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:07:00 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000040)={0x5, 0x200, 0x3, 0x0, 0x1}) r1 = dup(r0) umount2(&(0x7f00000000c0)='./file0\x00', 0x1) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) [ 2529.498107] Bluetooth: hci0: command 0x0406 tx timeout [ 2531.546254] Bluetooth: hci0: command 0x0406 tx timeout [ 2533.594101] Bluetooth: hci0: command 0x0406 tx timeout 12:07:12 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0xffffffff) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r4 = inotify_init1(0x80000) dup2(r4, r0) 12:07:12 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:07:12 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x1000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:07:12 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) fsetxattr$security_selinux(r3, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:devicekit_var_lib_t:s0\x00', 0x29, 0x3) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:07:12 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = epoll_create1(0x0) epoll_pwait2(r7, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000240)={0x200b}) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r0, &(0x7f0000000040)={0x2018}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) write$bt_hci(r4, &(0x7f0000000040)=ANY=[], 0xb) 12:07:12 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) getsockopt$sock_buf(r2, 0x1, 0x37, &(0x7f0000000040)=""/58, &(0x7f0000000080)=0x3a) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r1, 0xf502, 0x0) 12:07:12 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$sock_bt_hci(r1, 0x400448dd, &(0x7f0000000100)="948f44987069f2722dfef4267320482a2281a6a5972f2dad13be6f84e74209bc1a0784224136da5884801e13ba41b7788705d253834bded1334612615bd429db3d767f95d60942a337cd5a9e7a261d03bcf03486eef50ed67a5bc27cbd18d27d9751705d5658c25589e01c4efdecd222139f155e1a820dc693b10869f93cf2ec5f831bd099d869ad0667540b72295af50267dd0b90a14316223006a63df54afb2b97") bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0133060000000000000004"], 0x178) 12:07:12 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x810000000000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2539.682216] audit: type=1400 audit(1759579632.236:19): avc: denied { relabelto } for pid=28211 comm="syz-executor.5" name="TCP" dev="sockfs" ino=45568 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:devicekit_var_lib_t:s0 tclass=tcp_socket permissive=1 12:07:12 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x1000000000000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:07:12 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02330c07000000004a1c25"], 0xb) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x23, &(0x7f0000000040)=0x2, 0x4) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000100)={'nr0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="47000000490000000800000002000000409a06cc08dd7ba7a03f1ad8380f9c8f84de00000001000100000a00"]}) 12:07:12 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:07:12 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x4}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$BTRFS_IOC_BALANCE_CTL(r1, 0x40049421, 0x0) 12:07:12 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x2000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:07:12 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x4000000000000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:07:12 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="f472616e733d66051deaf037bbf488", @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',\x00']) 12:07:12 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x0, 0x0) [ 2541.722061] Bluetooth: hci0: command 0x0406 tx timeout [ 2543.770073] Bluetooth: hci0: command 0x0406 tx timeout 12:07:23 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:07:23 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$BTRFS_IOC_SEND(r1, 0x40489426, &(0x7f0000000100)={{r2}, 0x3, &(0x7f0000000040)=[0x0, 0xa2, 0x5], 0xffffffffffffffff, 0x6, [0x8, 0x2, 0x4, 0x9]}) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:07:23 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x3000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:07:23 executing program 1: bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1, @host_buffer_size={{0xc33, 0x7}, {0xfffd}}}, 0xb) 12:07:23 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) r5 = syz_io_uring_setup(0x7188, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x0) dup3(r2, r5, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000005c0)=0x1) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r8 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r9 = epoll_create1(0x0) epoll_pwait2(r9, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000580)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, {0x0, r10}}, 0x3) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r8, &(0x7f0000000240)={0x200b}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000000c0)={{{@in=@empty, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast2}}, &(0x7f0000000340)=0xe8) statx(0xffffffffffffffff, &(0x7f0000000380)='./file0\x00', 0x1000, 0x200, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x1004040, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@dfltuid={'dfltuid', 0x3d, r11}}, {@cache_none}, {@dfltuid={'dfltuid', 0x3d, r12}}, {@cache_fscache}]}}) 12:07:23 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x0, 0x0) 12:07:23 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x2}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:07:23 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f00000000c0)='./file0\x00', 0x3, 0x0, 0x0, 0x28bc, 0x0) utime(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x1, 0x4a}) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@posixacl}, {@noextend}]}}) 12:07:23 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="010c040affffffffffff04000000"], 0xe) 12:07:23 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000080)='./file0\x00', 0x1, 0x7, &(0x7f0000001540)=[{&(0x7f00000002c0)="89dde89f1e7e1d011737893e4a15ac93f38a744a3283a1919b94a920e7fdb68ed1bced9c853a55326776d45146e6e96971dfb504045bd508083d8605d2c86b548895e348e8d85ec1cd7dd72ab2d33da4cd20116b545596d40665e8fa8288a48eda3fc29ffd1e3e596cbfa8179a18c673520a47bf7f345de367260c68c70f9847798dd2067c2bb24c34f93e1a39af6e7b5273f045a3223030ae3d9b74405ad3fc2cec4430391f1420787e791f794e10f29d989a27fddc8ae1be3014dbeb2cbd69ea95aa633d878700ed29eadd833c3c87eebb4eafdac479ae035e4aa5757f67637af73cbe69b31d77c6196e", 0xeb, 0x940}, {&(0x7f0000000540)="64ba9468a3d3fd62711d92f72c8a756042b553da3ce8402282a4015573f06788dd761e457705adea5bda5a5998fb00b82269324aa5a995cdddb9cb9f9393a0f6900c8c0f898163c70db0e155ec9b4fc3c6c9c8b7c871fda12c8135923ba6ac0d58957ad0cb75570dc6dae4d3e2e0a3b89a8115648c7acb307ae355a4e1b3b369906d764d61552e73a0f3de4f0242f09902f4c1fb98f581ca21cd635e7ff62fc416a3805e449ed8ef2cc5ec2e4f35600a280bef2ab7547e550f48a425654f3ca1527e897644dce9193bb046f150bb1613187383972b5fc3caa1094d71dd6885fef5bb8c50ae9c7c2f3c81b60eb6759ed36861291f61ac7389da0896eef124c369a64bff181733216496cd73597ed4da7a6499ac05f4d118205c7388e880347b88b255a69b1e5ef0676b72f22315c9c53f08784fdfe55fa93367b6b302ccd18e1defb2b5d74c573584bb4fa8f358d7a0a94fb7dfbdeb6e086b5c72c505b9873bd2cf4cfe0e1d86f8e7da180a127bdbc42a2b5aacb15a0ac06dba59cd6e482c12265a2b1da90dac61c9e708b412917d39edbec3d5ed21b29c155c0965be0506464c6f0afcfe829ec749357555f941c8de0823d870fd366e50ab2dd0930d3fbb89b5a1fd125413b2d606fa9d23e4e8044d5be0abeb481f5b7601e0af0250390f3b4b71fcdaa9a39326d362e982db43e3e4b0b041f0858ec9d62b9eb8d42afffb19c004990f67bbd5edcd5cd7348333225de27ec7c47e9136ac6f75896a0cf3a5d2b6054558dc1ad0bc44dec55d1d93e4720210b242d085fbe12da4f360ad72c5a489b8b77cae298ad4289bca31ab3f8a3b423b6678cf453a778fbaf00fa1b1c8d50564e4208390e9d07a89ee69f2902fe77d8722273bf65ea97a8bdb6d7d03e264a1a0499f24b707f51b4714b3656948e534908d75c253a37a3f83b2a748a53273cafa4ad35e6e857aa9c53d5e515954ca0c1537c1c46f803ff4ca6a0891a0edd6379d9ea83c738e7b178612a475ede2732437b6629ecedfe350ea4f4104979b6edec956f84d9d4dce17f5beff04922aa93e3f32f7729e245d48a0c64701d273a8fb54319f352467b902f18ae62360600641ccf4c4c7bb392bfc1600fd9ad26fc4af61073d085a7a50e820bb7abbc709b9ea2a89dc833bdd9a5e4d2c373a8618e368be9c03f16d022a1dae5b02172310980cebe2d6de5a9d13af3032b823cf03f4e18d3b7e9002679f0d5c2e498d758c433a9f10ea1454a90a2ced12d7ea270bb799d22ebe4599e7c615ed7eff8347c8216c1af0288583603b5cd1fa177f36f866d4e74664c2198928358e2ba6001f46dbc381da08becc77f1d61b8b4318d9952799591446df4b6867190cd47d846c641701914a4f034733fb35705380eca2ff09ce5054606f4b30a8ca599e62d382d0892ca19e431a0039632b205b7c040bd97618483b307a10666d93bef6bf89cab17bccd3c52ed6a37513e7d2859725dfea16a83fdf49d77a923f259a39e5e59f20cba55a4c4f5c64d17c3197220cb4ca03552ae60432801762b1fd47d0077b1e6bc994a9ae2191bb432ec8d6838501123cd19da6fb4a91b3476a708765b5eb462de672a851b910c6afd71597c73a3c334742487ff8ec04e511eee8f24a306acf990dc84c15ff44417a146a094d2b7148ec52da23979e52105888d62602a6570a713aa13b6015aafd9018e2259ecc58c8f54c3fa7a15d99a79df17ac5857dd447c012afbc814f3d3df5e2f2f57a528066d106b84b316e070a3c4e434a24b8ea358734995bc616b313c56f2b7d00e70706f69a847774fdb29f7ae229687facd658d5e68c500a00a0fa505b38fdc6875f77a0e8196a7c02a1641f8c99f977fa8408530f4d5ea17d18b65de32a75db3d7c800dfe94fb539aedaa33e872ef96279ede7341945cde77d1a475aa52c48fd1d9eec7661dc549e346f974462053bca7e661197e9e916ac305cade44817184ff885b0adc4779e65a138b1797f7d112820246ec316cd15c7b28e1806f3b142985b683b202cc6450076c466b98c3c50b644f81e1f83ebdf975f9ef2407b808df26755afe53c8dcbaf017119d9e75106e2b41e40b2feb5091b6b242b1cade8c9c6fa4dfff5ae5dd7ac7e824030ad070f4fe9949883d21a974b6f2674698203d62a3efe29b5b1ce0bf88303c3bfafe562300074ee1b91c5e7f32ca299051feb5ac97866b7f6f3fa096e94c096269670c7b4af4c48ea17964ba7f49d55f55fdec7a649c8411215fa2bf11c8485f283cc9d7afbf4d0a3aa0333f6d9a260e5e09cd6c9b3378558b8ad08d5988381208694884199c8a699339e3f31f87bb0c5b19a5ebe286d077c1be7dda413d980a04deba566a9fa827af3794c843bee508482f1addc64d059c16187104dc938b937db70c1ba4a3214c46ab7a86e2c2af75346e474b0c778c537f9f39078b28415a948f1ebdcb6ca34170fc1996cab7c6e8b2353d4aab5e882754afe33c959bc33099bc29bc073f3eedc7a7fbdcbf0863396d131d9c6546859b6261b847c6c74aef1cbf23e4b9ad601d3d977cf56985c0551e209c237cc9fd9a2160bebc18da671b0b16833280df467e2e2cc1efd32641ec555ee25ffbb1c5cb47ecabd2c18a8524a29f21a5649a24b9ab7c25b873248eb78ba53db0dfb5b5e88eb11431f20d140938c6887a43f3095ee1db94d12e54d8934a062fd0e4903c7383feb6e59584a647a555909f6fead9dfc52060faf3f89a7b347abaf7d3ebaca7bcab8b2eb5eef1cd7a38c5427ca4c0473072f7e8d6810835e54247def5936b876a0bf45eccdb36f595872aee316e900bf11009fd0d550785db06131e4626768088e9e273aa56ce5ddf8347c04cf24aba94260c5f65771c336caee6ae738af140b92cf702480573fbfd321f82ece6287ed9205b2e41b6eb52a8259e495914abb3e519516d0d7b225fcb2f8ec76460d52d8671f2746f5a8b31f998b3f3d760dea1630ca788d8f8294cbcc552e0f9443903edf06062c529d11e44e002c494473680d58b3caee9af6088b6e2c93eb72d976f04ec3047fb1c9e6508ed732000af73789e82727e1d37b642fb57817ac5a81fdeede7b9362e6be4fc4492cff43cf4fcfb3f67df72c33b58c2b8fd5169b720f5e647efebf9c9dcfc4fd647a56075f4f94cd2010050710e93119e2ec6607a80fdfec14dff14e588e7920e3a720c7502e652c96eeb4b3aa5600c64955c7ebdee4d26b81db226328f5e178dfa610e0d528e60d3052be8f3f00a9aea78ca8b5294d738ec34b3dac4f87ba869447e2cfa783aa71d1327e656821080e1c6e369b5fc551cb0ffb01c24d363d59509793a26ed8829dc6aae8710328b25ee2254bb32164ea6485ee966903b319760d962b8277ee09c64a63827290f18edde67c5bb72f46473175281a534aa057ea952054507b5c8b8cfc3a949226237a97c8b20f4ff472da2a55f7145a55f230ba1deb67d2c8b7466ca98ba7ac1b48f879c6637348f61aea8776520529751f3e368f6ae311f6d0883985b20de06dde634165ec2e9547f52db2867d32ea54aa2dd17cefeaaf1b6f380fd783395998cd08de79fdae2f74fe2ab722a69df43d42195861e8d3069699509d2434c6814235cd84f523cddb2ce9abfd3cbee016afb26f0dc3156bf1ebd1c4143e19380b5fbee10309433af9a8a842bb82710343c5e08ec86f5e429902c7dde0592735a72f2314359ddc9c62c70a81c50e9c914fe2d65f7d4d4d1c845235707d34061326c04362eca7f5c4f9f50fdbabcbfd47add1462c0137cb11ed01ea8498d69bf8e215709d1ad37196aa6dde24e2ac13818a4ae943141307ef854dee891ae4ce74a3dcfabdfd1f4beafc1658e62572bfa7fa392d3d3689e2acb7bc5e18334b3130902f7daa9c63134665eb6dc0d70c9a31bfaa543ee22897fc298c8f7f15d9ae5f0665b8c9e359949c4531094e067b6ae62007d89141fb79417d7f44a2113519c2d1a9c97d993d88845505e50dcf9be3c154511733320f5b3b2d2ac1b6cc0d41c6010fd0dc51ea292d03f1cbcde8f43f679089d8dfd4aa3a1a8b281dd4d99a4724bda9c6a6c82e373a117de5335fbb8b9a5e9d00abe3dbaebd619bad17c227bd2bd0409c7506f9e60235d1c5b433c861a252ae7aca07348ab56c8d9f81bcde4a62bfdee954387f6e6661b253a58483d86e361842c9eda27723f582e06beb8d949494b2fd4825396ebb10ea28531f097b278856f660bb934ace62ea202f3089053248ebc7fb13b2d5a9dc0df38f9d6b55947b3087583fbcb773c1b266facd11a12c57e324fbf7a427d7f0ac66a9d50cfe08a4f89672e7ceb16754fc8775f7821316f178f04257b56eb2378859cc28634a4337e0d80ffcf4109a7b359e2e8381a9c43f22b468992e2de0831258744d39302c1aab2db25941d4d8387339cba56c2d88f05d82a759c258599f7942d4f780383b61ffb32f08b0f13dc0bade825784720cdc846a9591179989ea5b379a547107c3cb82af9a382c65e7fe17a5e9f25cf07d02019f7dc34a6f845e14c04b042de19e28905da1b396b1f7693990340ebbb97f9d693c7857ca3ee9eb0014a56a782ed4876b127a857245f30d465aa587251c91e7cbb9e318a16834b362c5cbeb2dc0a3039f17d932eec4c2abb6929c66395437a9ebdd923bb15361e19fd75996e0932b673136391eff83ad25df25718e938191e59fb6938223b9bd8dbdd2ace8b73a0d501ea636cc4a52266e85909d1759a3da62b59b7463104a8685d8f6752b1dc3697e8361a681311a576d02916e5deb884681d375010bedde1a0941b1304700524d90c8fed4a2c313c5d8d42b640a114309e52b6d5c5c91355633b5c8ae1e3b45c65df3b79ca4ec52b6a4ac0203a7964708c39c6f0184614969e9b9d58ede21b48106dae17427fd64faac7be9a9e55b529f37ff4725dfeac0d3755e6cefff8a56181cae0520440677a0759817d6cd27a3ff1513d019746b848bc4d30a9e7df8d76f405295c1179356c4b242e472aa35907071fce3404891453684ff5c27203e979a5ffcb5cb34a2d558e4c20bc2e72b7527ee64796b727daa94975e32448b09bb19e8dc006236cce21ca7addd0325ede982f91819c9f991e42e2462053df86cfe1f1afa1ddb312a941c38fcd3c386cc4a2b4c937f594aa9190af3c3ac667b5bf43d4f28465cdfcd55330680b7b8c25a1743b6910b568a01854b4e22a043d744648aeacd2b6a407d2ba08bd1d45c3fb7ff74f9125c50bad2cce5c8fd204f3ce7c251b3f15eb843594981dd13857aeb0bbaa4ee89823b467056f473ff40e12a1d96b49efb1e4fd6c118919e43d0b4646197229c7733a637ed80520bbd327c57d4eb6f81c4be1835da5372936abd0ceb6e75d970efd0690b8727b4e9828df8a09bc3c910cfae96d70a88be7015336ad2e9be25039c751d85738cc068f977764b060ffc82f0df0eedb870b7eaf1f3b96997aba2e5a2bf1913af01957f6d79c830e690ed1200f14ca8ce648fe4b70e6b674ca4a80ae88c498c948c75bc10466aa419f7b16c82dc8e58ce563eea29453afa0cedd9dcf5cbd870897ae2e0e92da0600c6777626cc7d790ec37e3c0eebfb7ad7b2ed74086318e7a9af3a18972570f69f3116e085ab8dd81c52a39e85a6b8e3ac53e442529025aa6116342c39e53cc8b4d594b6ddd6e250e5a362fd89f535af27d177be00c477ae11c275c4756f1feffba27e5265403d8829a9424fe1dc0ea029eedbf0be0c632898f343d3c78e99b3e9fff7ca45253f8567071d420d32c6344032", 0x1000, 0x1}, {&(0x7f00000000c0)="7edfe0cdcf522f538f1cac308bcc913fd24026880d0449def052", 0x1a, 0x2}, {&(0x7f0000000100)="4359af58061b23106ec057b63d6bc6a73b3e853e013fdd16702e9f55139edfe04e98f3", 0x23, 0x100000001}, {&(0x7f0000000140)="3c0ec61ed7147b7d32d9", 0xa, 0xd0d}, {&(0x7f00000003c0)="2ed9d1c7dc034b516d6b5dd68029562a61290cdfc539e498f609f8c26b179751a5c55d61ca814ab8a39c15e5162a90ea72cae5d35ddd", 0x36, 0x7ff}, {&(0x7f0000000400)="ad02dfd94b0d6da3f027d7c7b85d2180b5469d38b571626a2811fec7923f8368395844278e32aaf670802390b6697e80ccca33e2ba321b6ff3f20f772b4cebb5f706d222e5cfdc1c4f091b05aa9098bc3111150b1f3d4a6e934ee06269d9a78bd64f5c371b45670dab7c", 0x6a, 0x4}], 0x8080, &(0x7f0000000480)={[{@min_batch_time={'min_batch_time', 0x3d, 0x1}}, {@user_xattr}], [{@obj_type}, {@context={'context', 0x3d, 'sysadm_u'}}, {@audit}, {@subj_type={'subj_type', 0x3d, ':\''}}, {@measure}, {@hash}]}) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@msize={'msize', 0x3d, 0x17be}}], [{@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@appraise_type}]}}) [ 2551.232963] loop5: detected capacity change from 0 to 264192 [ 2551.240521] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 12:07:23 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0xffffffffffffffde}}}, 0xb) 12:07:23 executing program 3: setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000100)={'mangle\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$sock_bt_hci(r1, 0x400448e1, &(0x7f0000000040)="32af285d85027b056f6089c877f0a69d01b9f4268d471385409e2d9e3ad8541d69330fe65325359a84c387ace78f5aa4117e3ee1dffd26b76827c017933b4a2d1e790c8ad9b862b9c6820499b5c925f2abf64ad0483633e04d712ef0a00c6151bc858ffc8ed618e5ecd0be86d42ba9d5997834ffb0361d8f3e415655daf363450c77b4497a37047537c0c01a2e0241c0d5933c6270894d8246d9f14c0584638345bcdb3ec6e1f725ae029140144a2bca6898d59ebe97a7c81eff7c") 12:07:23 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x0, 0x0) [ 2551.288766] loop5: detected capacity change from 0 to 264192 [ 2551.299790] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 12:07:23 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x4000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:07:23 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x3}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:07:23 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="01330c0700000000f5ffffd86dbfd539808e478ea8da79a8bb37997018fb745fc0300a81bef3385bbcbb1045dc771963b3fa07e8a1d8687003bf748132596cdc714828b2632b8713476351306887a5b19a2de572a0d814a4"], 0x178) 12:07:23 executing program 0: unshare(0x8000000) semget$private(0x0, 0x4000, 0x0) semtimedop(0x0, &(0x7f0000000000)=[{0x0, 0x0, 0x1400}], 0x1, 0x0) semctl$IPC_RMID(0x0, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x2000) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:07:23 executing program 5: mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4000, 0x2, &(0x7f0000ffc000/0x4000)=nil) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f0000800000/0x800000)=nil, 0x800000) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00', @ANYRESHEX=r2, @ANYBLOB=',\x00']) shmget(0x2, 0x4000, 0x20, &(0x7f0000ffb000/0x4000)=nil) 12:07:24 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x0, &(0x7f0000000180)) 12:07:24 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="de1da4b1d1fc7505ba2f0150628aa6ee2b223a7479ac299900d3d79c5890a8ba8d8632ff6685e260533e5e1d2e76d989d07b208799aef12189cfc86ece3c374c22d20de0760d8bad81953ca0e95fae7fea47912feec5fa4b8610e5913eab634290466ab1b42accf645fff3aad06dd61ac984ae80d0283a55e45bf9c2a58fc509c37340c6bdf25c70dc8417bde852b1fa775c761901aa34d43eb93f738f788474fa7b17b8ce61d39bb05cf21fbc506d273a3594ef34d188c3a1f320a828492b1ebc5e704893a8408ab2e8c2de3e5b05c443558269ee13c48eafb003fb19841b740e2ebfa835854753eacc8c3deced7c61ccbabaf8eee424ae0e4d55692ddafd18e176c0bb4eb06684b55ba1c78bdc70c1d6381a5f15f115fe9e016bdf7323a559d93edad7c2019db7bd245bcf648afc0376da6d11dbed0600"], 0xb) [ 2551.547181] 9pnet_fd: Insufficient options for proto=fd [ 2551.562134] 9pnet_fd: Insufficient options for proto=fd [ 2553.242150] Bluetooth: hci3: command 0x0406 tx timeout [ 2553.243370] Bluetooth: hci0: command 0x0406 tx timeout [ 2555.290071] Bluetooth: hci0: command 0x0406 tx timeout [ 2555.291171] Bluetooth: hci3: command 0x0406 tx timeout [ 2557.338084] Bluetooth: hci0: command 0x0406 tx timeout [ 2559.386080] Bluetooth: hci0: command 0x0406 tx timeout [ 2561.434002] Bluetooth: hci0: command 0x0406 tx timeout 12:07:34 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x402, 0x0) openat2(r1, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)={0x40000, 0x20}, 0x18) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:07:34 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000080), &(0x7f00000000c0)=0x4) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r2 = dup(r0) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) syz_io_uring_setup(0xf5c, &(0x7f0000000100)={0x0, 0xd1a6, 0x10, 0x1, 0x9}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000000200), &(0x7f0000000240)) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB="026fa83e673022", @ANYRESHEX=r3, @ANYBLOB=',\x00']) 12:07:34 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000000)={0x0, 0x1, 0x0, 0x0, 0x100}, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f00000000c0)) dup3(r2, r3, 0x0) dup(r0) r4 = syz_open_dev$ptys(0xc, 0x3, 0x1) write(r4, &(0x7f0000000100)="b2b06cc37219e86bcc5a7604f53178687d9c3692e150f85d8e79913ed2d1e057b2244a5c9da1e266efd325ec386d0750b8d37ad01cda45ca6343d3a019c736d7f71b57f474e13a053f8bb2fa78aef30aa6f3e4f0ba385c0f3e369562d8034665d3cbab774c", 0x65) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:07:34 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) ioctl$sock_netdev_private(r0, 0x89f3, &(0x7f0000000280)="3c03e7a7abcce60091352654b06691be8620e56fe2b6438aaafc840bea62acee7d00f610c470051d49a889fa9029843daa3bd9dd2c64e08064613f7e3028fc03c26955f53b3afd45db6dc43e40551a390e157294863eacdc71d1ab54c896652641050d9bf0a839ad3be79066ddd8c9248420f2c511486c70e077d58a192ecc1df1498f8ab66e55d447106c82cc7efad6d6b2d0857cbda3b1fd67ac67ae6f9a756a64acd4c8b5778590289ee6d76cae27c956eab9cc102fdf62e6c0f514681d7aaf1e54ccc3adfb87b05b734a27138c413632f26548832ae9949c5281e47456641e1b2a34d4b47901bc4b41be173f7fdb2850f4c0cc43db89cc33000fd6887ed3ceac1c01add7d62ebbfaf7ae679efe7a37fb5bdaba0a35dd6006c9d7ee244b391d630a773492fd3fd11eb663a6e790abae34709e5b5b5b193d83b65c6072c8") r1 = accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x80800) accept4(r1, &(0x7f0000000200)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @local}}, &(0x7f0000000080)=0x80, 0x40800) 12:07:34 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x5000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:07:34 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x0, &(0x7f0000000180)) 12:07:34 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = syz_open_dev$vcsn(&(0x7f0000000040), 0xffff, 0x105000) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0x1, 0x3}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01330c0700000000001000"], 0x178) 12:07:34 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x4}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2562.357954] 9pnet_fd: Insufficient options for proto=fd [ 2562.383773] 9pnet_fd: Insufficient options for proto=fd [ 2563.482128] Bluetooth: hci0: command 0x0406 tx timeout [ 2565.530026] Bluetooth: hci0: command 0x0406 tx timeout [ 2567.578069] Bluetooth: hci0: command 0x0406 tx timeout [ 2569.626075] Bluetooth: hci0: command 0x0406 tx timeout 12:07:44 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x100, 0x0) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f0000000140)) r4 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0xe188}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x9000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r4, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r3, 0xc018937b, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0, {0x0, 0xffffffffffffffff}}, './file0\x00'}) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r5, 0x3) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r6 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) getsockopt$bt_BT_POWER(r2, 0x112, 0x9, &(0x7f0000000040), &(0x7f00000000c0)=0x1) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r0, 0xc018937a, &(0x7f0000000440)=ANY=[@ANYRESDEC=r6, @ANYBLOB="75038e5d112f7b475ab5213b4426d704b9118a2577773512e77507107c30c0941d681bb0488b6a45fcfbac4726b22c19b48c6e8284ffe64f613de3e0e41527584e8566565db224c883a5139892103a364b7c81423107e74e8412e3a6f98f8f5f6bf66d9515035bb4ab6922f5bc244330b871af4fb6767ec2c2c3eb41d36a4d247d3fddd958b3bcbb6463e4b5e834c4862643f20f2265e3bf", @ANYBLOB="04000000000000002e2f66696c6530002b62248a0514186eca8ee2942a9e8a5ad0e5fe91405beb81818b94da6609bb3fc6a19544ef"]) 12:07:44 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x210000, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) getsockopt$WPAN_WANTLQI(r3, 0x0, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) 12:07:44 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x0, &(0x7f0000000180)) 12:07:44 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x6000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:07:44 executing program 3: syz_genetlink_get_family_id$SEG6(&(0x7f0000000040), 0xffffffffffffffff) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="02330000000000000000001f1d89539b119a29d04b8a4f464024d5055c153d296a232477acab1717135bbd40ab270261d3804ab49d70511a25c79f25f16e885a5c9afaeeb6a0b1366c84fc2999e5e373a3060b8721a7b4e05c8808d6c109b23a4e7856f6b6832095aa6c703c249485d546ddeb5fd09cb082f2052ab7a7dfa8682819ecc5f51b583bc15a304905bd276ccf57eba49ed9e064d6f173bc73"], 0xb) 12:07:44 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x5}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:07:44 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) ioctl$sock_bt_hci(r0, 0x400448cc, &(0x7f0000000040)="315108180582a05766aed67e0644e10f22ac4b9021d55afe05a2f79b43ce09a7b03cc93bf092f4ef85cf899c46087f6be0412f7776ccfc5f91eac393835c1d2d3195dac6525f9f3f6681e2a671dae6988a1b") write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:07:44 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) bind$bt_hci(r1, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:07:45 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[0x0]) 12:07:45 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0236e00c61fd7dd1800000ebd8929d221e175c600d19c095f527913316ce2b35f0e4ec1f6ec3795de4db5d5d0f1db5c24f46fc062da2be33b43757e6a57f08671cd5820219b5a5beb38069c6252f33ad607c0cc4972dd3223f898682d60bf931407888e7167114717fb54eae48eac4d3094edbb242513a7bc7246925b28becbe96911f5a522d8ce4f5d84d9ba9d12c64d20692312b20cd4eae69aaba71f5ff79b8f0a05bec21e75d2df29e3325861fe75e781366944f98975b7d5e42fcfd4f51c5c08e168495f15b74e41378cd53ee9fe470caa1730bb82b0abd4b8d351d"], 0xb) 12:07:45 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x6}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:07:45 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x7000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:07:45 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:07:45 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[0x0]) 12:07:45 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0233d6889201bb49968000"], 0xb) r1 = syz_io_uring_complete(0x0) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0x0, 0x3}, 0x6) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x2003, 0x1}, 0x6) 12:07:45 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x1000}, 0x4) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) [ 2574.426023] Bluetooth: hci0: command 0x0406 tx timeout [ 2576.474013] Bluetooth: hci0: command 0x0406 tx timeout 12:07:55 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x9000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:07:55 executing program 7: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000000c0)) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x4100, 0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:07:55 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x3}}, './file0\x00'}) bind$bt_hci(r1, &(0x7f0000000000), 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f0000000140)={0x1, @pin_code_reply={{0x40d, 0x17}, {@none, 0x22, "47a73a1b728e4baad0ae733b03954226"}}}, 0x1b) write$bt_hci(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="024d0cf5a20bb4074fea17929ce33679d16308f40000000000009b0340faf274d3ef3eaa182f4fe6b5f3ff30a148dbbe51aed9baf9f9a2e4b21f9edfd87f52649e123b78bbe9e405c32fac096ed0a15423f555507364ba7f3fe35cd351d2d26a7fa4a57247c33449e38b7f72867692702dde334178c0ff0e9665b29cb05e4bf790558e7351f1150146494947aa5e8a1f628cc9e3dd520cb4a7ee8ca157dac71769c1943ae60ce2"], 0xb) 12:07:55 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[0x0]) 12:07:55 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="01330c07000000000000fe05b46638c2b4a76bd2da93d5b1b26a200844ce7a52288a175953232b50f6c68f70d476588d7d31eb73ce9ef0275ab15d8285013307ac077a33dbae3ab0e42b71671081f81757060c5bc68776011b532b0ccf1502ee932bd77aa11b5ba3a751f18cf754a6814d22bbaef224e25e9b59fb459e2e5aa9a388c11f8c59455caff5f546c1a400"/154], 0x178) 12:07:55 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="2c80b0b51b5858", @ANYRESHEX=r2, @ANYBLOB=',\x00']) 12:07:55 executing program 0: ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000040)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x5d}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCDELRT(r1, 0x890c, &(0x7f0000000000)={0x0, @xdp={0x2c, 0x0, 0x0, 0x34}, @in={0x2, 0x4e24, @empty}, @llc={0x1a, 0xffff, 0x1, 0xff, 0x0, 0xff}, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x5, 0x10000000007f, 0x2}) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f00000000c0)={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x3}}, 0x0, r4}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000180)={'syztnl1\x00', r4, 0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @loopback, 0x0, 0x20}}) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000740)) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000980)={&(0x7f0000000f40)=ANY=[@ANYBLOB="dc0100001800000125bd7000fedbdf25000000000000000000000000000000000a0101020000000000000000000000004e2404014e2300000000000000000000005232c5631a1d434f42f8ca5776bd6687aacaf5d7eb633396643b56b9bf4c6651c3acf092efcc9e6878d11a5d78", @ANYRES64, @ANYRES32, @ANYBLOB="0a010100000000000000000000000000000004d33300000064010100000000000000000000000000c5ffffffffffffff05000000000000000104000000000000210000000000000000000000000000004000000000000000030000000000000000fcffffffffffff0104000000000000d10200000000000009000000000000000800000000000000000800bb0200000002000027bd70000740bf49916e7bb313eb5f1b3500000a0006060200000000000000b500000000000000e4000600fe800000000000000000000000000037000000000000000000000000000000004e20009b4e23", @ANYRES32=r4, @ANYRESOCT, @ANYBLOB="ac1414aa000000000000000000000000000004d46c00000000000000000000000000000000000000dd0e0000000000004d0000000000000000010000000000000200000000000000060000000000000005000000000000001f00000000000000000005000000000000005f9300000000000008000000000000002000000007000000500f000028bd700007350000020002d64700"/168], 0x1dc}, 0x1, 0x0, 0x0, 0x4000011}, 0x40084) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000140)={0x4, 0x7fff, 0x5, 0x0, 0x18, "afd55f6730692714b1ccb56f75d2ff4942d7af"}) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=@ll={0x11, 0xf5, r4, 0x1, 0x4, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xf}}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000200)="f367f041c470da6da401aca4a15f7894e27eba90d9e338f4d5f3c06f888f264896603bdb69b8", 0x26}], 0x1, &(0x7f0000001180)=ANY=[@ANYBLOB="78000000000000001801000000020000a08c91caac0f43fc3cb00da6deaa503d79c2788ee4d392585369571d6b3b5fe333a0101160d84446c61524fe40193f23bd7e51071f6d5ea4046c878dde9afb63a167d45f7ad6a6e6e78ef400108f16fa06ea13f8a810f24df6dab8adf0da7f78379300000000000000b000000000000000080100100100000013deec1ac2b8fbb8006a7f053477a6bb35ded80f390fc302bb2c2fc621d130b0a9faac44ad575c375bebc64be388335dde0396309a0f26e04bf2c811cf1b186a172737036879eb03e1af7b9f0f546b0410833748770cd99f2a070a53897783c6969afed592c6a33544c9aa20b2b857d0cec7eec10a9c9ba8b3523e6a62e4afca28e8a6483606d1adc06cbc507380769d127557ee3fd661eb1de8470ed0d870000000ac88e3ed900000000000000010010000080000000e15cb0fa60f112f155fed0e14594608dba2c60edc3f67a64c32dad570e1cad670c937ba9d86ad5fdcc8d5d29972e7bbee34dc5efeb89089924e9f3894a588d10de678f4cb1493b73f2595f213ced0433e4f7e6491d46b73be682f279e1ebda8aec575151e6cd43977a3fc1d843fde3d272e162fa30e3307e1afdc00000000007502ab9cf99b8711100100005a0c0000dc0acc25165a6643ec30c42bc00e4b94c40da6103d8409d01471b0d21e703f331dbe40d13402c97552900264ee5f43ae09743d2d8359819e4259e54d4d5fa4c9c239eb947418a389d38f1707078344084de6ab59f44b4c1d3a5ef99cdc3f7c232f29996710047ac144e234ce926ff9c57281e30ba564a30902d942db2f337f52a9702b3d16f33505d3310fdddfdcd44ea54f610bae7d4948e15aef8081cb8dc9fa76cc812b17279f7fd65d866b36e85e1a385716864215bcabc555e2704b158073bf3993f9424521ee878ab65f9f3212cd7fee5dfc181d937b86f5f2473f08557e5c842510010000000000000101000000020000c593cc144c08e62941cb133edd9b0501b546088b8b7199e31f1d4479443cd500f307183db7c0eff02809b2448ac3fb9306000000000000002ed87c2ffbae74f34361fb3cb5924d134fd5e37ff6e9765293f411501ad1f8a90101c525c29e54173c6e633edf30ce98c9338d522a50b3ebf809ee69f432ec41f9b47f7a1ba2f9474aaeb91150a94012913776a97426414b504fb5cf5d865d47cb39a597260600a9c3d58014209ef9c5021ae66faee03898f114f8962a637f4b1036a2658b1b2a7edf000000000000000045c70d1d58ecad85718f9046565ca300da940d64b248bcbf8601157786d886c84eacbb06a53d17363bce8c5b2b4b45dacbb8e53aed6f45fd3965aae271dbc75651a0d54920e034d2ba1928e5d10000000066a5d91d703d97317a8cbc869dd93bd874942735ba3867067a38ff7405e6d6f9997b472d6f2641f1abd56388dca26a64a2d3ae0a6013f4ba150afe2c345613677f03f6c4bddf7226e7e3a3f908675787a4f3000000000000000000000000000000bb4071768aaae2e8cb2d8b701dbfe590faee3b1c243706e23cb5074d1ea55e1a17f0b23381467d1aeb2fd3a9000000000000000000000000305d1441fd648348c98a83520c649d3a6f15a4670651efc41530ec8811905b5ed7fa6b16bdb69e5ac79dfedd98283a70bcc0b526d7ac941dd3d79aadff04ac7c79f12d7970cdffe13e83c6b52076a90d0a4c7433a410e9dbdef0a209b19f9636633894a6a4240b0d2890b9cd6a73380ee8dff29cebb5418a437e6131846fa3701f3f957c43d7df74ec21c524e466f251bab98f5236ee2fa76db0f02e739eae9d920d345c8449a1ad2b7d304785ebb0a65f3f2a53b84d6258fa040c1bb18730152236f114123850f58d5be45e7e70f07a8ecc10bee5f31a58ede476871a3b6f84da52fea047923f282a8933bf6382d2ecb5df1e826cf15840fa0f02ffcfecb468e67f36ef191bf4a870a661ffed2f275f312591134b5bf6ff25417ee4aa7d49d2f18526c800121af0ba4f3ef59b4e0d625ec036a600b65aae7b7c5de867b8079c25fb89993bdb796e71708b55265edc249be533d2ace5e9d9d1c302972be668eb69592577269883ccfb6760de274c3042b9620b61813ed0c5c226dccf1d308e85895d29d18cfdf924d487625397476e5bb90b36cc4dc3da052812baf3f77c7ad1a030fc88cc"], 0x3d0}, 0x0, 0x8000000, 0x1, {0x0, r5}}, 0x6) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x9c, 0x5, 0x0, {0x0, r5}}, 0x3000) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_FALLOCATE={0x11, 0x4, 0x0, @fd_index, 0x3f, 0x0, 0x0, 0x0, 0x1, {0x0, r5}}, 0x3f) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x5, 0x0, @fd=r0, 0x63c, 0x0, 0x7, 0x4, 0x1, {0x0, r6}}, 0x4) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0xb) 12:07:55 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x8}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:07:55 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)={0x1, @le_del_from_accept_list={{0x2012, 0x7}, {0x3b}}}, 0xb) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:07:55 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) [ 2582.751457] 9pnet_fd: Insufficient options for proto=fd [ 2582.762612] 9pnet_fd: Insufficient options for proto=fd 12:07:55 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000440), 0x141802, 0x0) open_by_handle_at(r1, &(0x7f0000000080)=@reiserfs_2={0x8}, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x40, &(0x7f0000000040)=0xc9, 0x4) 12:07:55 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = dup(r0) r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) lchown(&(0x7f0000000100)='./file0\x00', r1, r2) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00'/15, @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r4, @ANYBLOB=',\x00']) 12:07:55 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x10}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:07:55 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xd000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:07:55 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448ca, &(0x7f0000000040)="f5813c1fc1c478e5b07b4fc5d2cde563c2a1eb12d38088725eedc97ea3847d71ea621dc7c4742ef949e6c5d2fff54eda93925860") bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x2}, 0x6) write$bt_hci(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="01330cffffffff970008fae4fcab522ce3ee5347d8d63947c67d5bb085cbe9376e3562ac46046fe70bebfe101834a345077c190a94ca8b00b9b4206dbd56f94c917ffd3b61ccf77060fa1e600d580331c35656e837ec55c623d84286d1124f53ddfe4d4d74ab11cd30ef418fa6ddc6eca97aa93b2b04694bec650645bf658d3df53840977b5d60eda2383a816ad2d243f7e539738563d096051f82d048c3e3fcf101fed3b581d2d7d246204fd48dda13ca04bfe2bc6abb080fec4c0dd2a6d50ad5528a345df68d29e9b66152ed93606a711ea482d4988840a3ab8a08c168b019beee9fb6f72fce7e0a194d909f144157c1bcd424dffc07f72c21836736e2e8b15e5985216d1eb2d8170340105a756d83485b149a"], 0xb) 12:07:55 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000240)=""/136, 0x88}, {&(0x7f0000000040)=""/36, 0x24}], 0x1, &(0x7f0000000100)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x120}, 0x40000000) r2 = socket$nl_route(0x10, 0x3, 0x0) preadv(r2, &(0x7f0000000800)=[{&(0x7f00000003c0)=""/88, 0x58}, {&(0x7f0000000440)=""/67, 0x43}, {&(0x7f00000004c0)=""/244, 0xf4}, {&(0x7f00000005c0)=""/113, 0x71}, {&(0x7f0000000640)=""/222, 0xde}, {&(0x7f0000000740)=""/142, 0x8e}], 0x6, 0x81, 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000380)=0x7, 0x4) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:07:55 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x300}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:07:55 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) write$bt_hci(r0, &(0x7f0000000040)={0x1, @read_remote_features={{0x41b, 0x2}, {0xc9}}}, 0x6) [ 2584.730036] Bluetooth: hci0: command 0x0406 tx timeout [ 2586.778058] Bluetooth: hci0: command 0x0406 tx timeout [ 2588.826045] Bluetooth: hci0: command 0x0406 tx timeout [ 2590.874087] Bluetooth: hci0: command 0x0406 tx timeout [ 2592.922194] Bluetooth: hci0: command 0x0406 tx timeout 12:08:06 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfd}o=', @ANYRESHEX=r2, @ANYBLOB=',\x00']) r3 = accept4$packet(r1, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14, 0x800) pwritev2(r3, &(0x7f0000000480)=[{&(0x7f00000000c0)="1e67ac316266460641e970fe507b7fcc53d015148bf183e535f8dc5a78f076e48887573cb3a43aa6bb24da9a8d2402eaabc90639081881dede3d8e248276e4e3d274", 0x42}, {&(0x7f0000000200)="ece9c7a30a7e3f969b71382feadce8b9a660d7043ffcbd9c046847e5ac469164b1b59a89905bbc87432710d7d82853b36f6d23bd1a6a7903418498bf4bc8c883a1d4be7dd827ec91619eeb6434c486d61479c93566905d926443", 0x5a}, {&(0x7f0000000280)="f39ad9a4f5b4d1bbf6ccfeb49fc2f6cb702192e6b2c46c0535543c4f132d187731b0b6d5e3d96f56eebbc695ef3875808e920047d1c998415f8921eb127b7629dfa3022f490def4f8e947ef5af8c3e31b583423b0a0441cc5937722e0a9d365cd97e021b607ff511f6a6cd704848ab4f79dc9b7adef5d0da601307621dc5ae0abc3e119c51683d10b84147e4111571f0e39a0f6f24e1449d6db896bbb36a1eaa10f13564e5b80b215dad65a9ca5dc174a00e55ed6eef53e4b3ddee7f527ffb1179a8598b90aebacaa9aec0fb95dd8c9d04beea2ec339", 0xd6}, {&(0x7f0000000140)="cca679e62848fd9b2776a5899ce5cea4c78cc41a6df586ccc2167904da59a6753f", 0x21}, {&(0x7f0000000400)="38f4b8590f7dd1d353cafcde91d5be21a73ce9ad0aa3fb8e2fd634c0d83f6b0b9798d23710bebe0f7604c96d8ea4706584b9f56521a638ada9545d67c269aee51ba8a74fc7a43375e7f27689bd0ad1a02dd3cfe8e67993598a74b6e016bb", 0x5e}, {&(0x7f0000000540)="d3ad88f91784d17b74f9cd7ec44c094e73f2fbb78199b64acdca6d04fea91582ab022ad7bb93938ed240f3a0a64743c8daca2a9d86a6e9c9083e9a9e6a9af250410bb7af2ac3b9eec2d88b3d4c8e080538259a05c9dd23705c79d3131c03ebe9c56da502759bf3b0d9c3e303596e4ca6501026059add70c6a69725229e36df1d64e4d9b86224d57e5e6d3faff1a96492f14f37a43ff88467d973f2263d70a8ece2e76727ae0040a7e5d7e60cda3c5e8e22d0a013b6dda8d792c7b97b953e060754827a11bb589618c031f1481c667ce36fc126eb802ce1cd906e4271cf280824cf81bde9c37a", 0xe6}], 0x6, 0x10000, 0xffffffff, 0x2) dup(r2) socket$nl_xfrm(0x10, 0x3, 0x6) 12:08:06 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:08:06 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) dup(r0) r2 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) dup3(r3, r2, 0x80000) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:08:06 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000080)={0x0, 0x4, 'I3q', 0x5, 0xe1}) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size}, 0xb) 12:08:06 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x10000200}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:08:06 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)={0x1, @write_auth_payload_to={{0xc7c, 0x4}, {0xc9, 0x7}}}, 0x8) write$bt_hci(r0, &(0x7f0000000180)=ANY=[@ANYRES32=r0], 0xb) 12:08:06 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x500}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:08:06 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) socketpair(0x22, 0x800, 0x4, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$WPAN_WANTLQI(r5, 0x0, 0x3, &(0x7f0000000140), 0x4) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x4, 0x2}, 0x6) [ 2593.991410] 9pnet_fd: Insufficient options for proto=fd [ 2594.010713] 9pnet_fd: Insufficient options for proto=fd 12:08:06 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r2 = dup(r0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000080)={{0x0, 0x3, 0x80000000, 0x37035120ce42c56f, 0x7}, 0x8, 0x12}) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) copy_file_range(r2, &(0x7f0000000040)=0x81, r1, 0x0, 0x1, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="747461657633fab10d4f376e733d6664090b8dee6e6f3d", @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB=',\x00']) 12:08:06 executing program 3: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) epoll_pwait2(r3, &(0x7f0000000140)=[{}, {}, {}], 0x3, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)={0x200b}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f0000000040)={0x1, 0x1, {0xffffffffffffffff, 0x3, 0x4, 0x2, 0x20080000}, 0x29}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$F2FS_IOC_MOVE_RANGE(r4, 0xc020f509, &(0x7f00000000c0)={r1, 0x100, 0xc5c, 0xa0}) ioctl$HCIINQUIRY(r4, 0x800448f0, &(0x7f0000000180)={0xffffffffffffffff, 0x8000, "ba76fc", 0x5, 0x5f}) bind$bt_hci(r5, &(0x7f0000000000)={0x1f, 0xffff}, 0x6) write$bt_hci(r4, &(0x7f0000000100)=ANY=[@ANYBLOB="023b0c070000000000ebe64d0c6e5a5900"], 0xb) 12:08:06 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="010c07000000000000004398ec020aa21cf3e9"], 0xb) 12:08:06 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x600}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:08:06 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000000)={0x10000001}) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:08:06 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x11000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:08:06 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) open$dir(&(0x7f0000000040)='./file0\x00', 0x80, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:08:06 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x810}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:08:06 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) ioctl$sock_bt_hci(r0, 0x0, &(0x7f0000000100)="fa7c6459ee4e3aef2a96a868cb90de6351e0251fe6c48c1f761c8a4dbd11d0f883a52705e110bdbb1f5fb5e7b0852675f5b301b88cff3ce0ce558e66858f30d423a4103b697057272c564a081c701ded1c03051e959f5258f6423a1f4dcd5c71063ba18bf44f9e8cb0b43b32e0a9044d8bcd1a8921e803caa4b26d20b7cfa601d82144067923cdb31ab60577aa16f88feaed08c6e4c94d952ea54f2ca9b0ca862f3ee9af2deb5eb983d4665ce3ac1d44cc137fe32137f6dde1f07f667ebd51ed5c34edc962de898962d60a150f303c16c68914d7a0c885c4a7fa260e8223703f05c93aed0b69195b8c78ad76e94593be8211f7db7e4f5a4368e2bd981a85657eaabbef33edc8e2f6f036183f6a866ffb5de2b350afb5721332b168bbb81e6dddb19f54d131b3f47b6005c26713aabb4ba2bed02b6f2cfc23c2651e1b74ed7a5eb58d2f5f197aa2741b4fc06139c987150d9629740c007677a9fc9f0eeb18621fecefb987f052090d61052f862c1f74327bdc8d2cc052452cb59a6b9c84ce3d65b7fcebbf0cf5808c0b475ef8287938571a9610e4bd71529c3124d05208492b3ae7acaaddeac3c6558cbf0a2c60808310a67e12778941b6637966f03e934bd429be6a22936664694a5d3829ab88022588cf45e64c23e7fff6a715ae21194f41978c340d5c33b5624be24a3deb0296e41234ccf853de303043caf67a1eea889b9d3a6b08410ef0ec4ae7a26b6f97857859fd9427785f165ed4045af21b9892f9b1365d49340ff600bcb3764a54bdc2c18ad09b3bd6dfa1405b11a34bc2f45514c2adb4b103cdfd747223048657ef739bfaec1c8287e1154c787f02b6140dded0819171f018c347f0a10e52656a9eca7cb4ff120f9f4b7c728029ec53ec98fd18f7d7a3e26e3d7e0e658b6b811c22aa433319b9b478be48d64ee19aaee388584d5bfb2bd2795514987ff37c2cecc22637473eecca407c3c1cbc97c7de57f9bdf28a4c480a07c627cd6717b598d0e798995ff6d8f3437b692f0dfccb58e07b2f04fda9144b606ff19a19adac8c593712df2c8495faf126804a90f13177e69ccc1c14501e7b253f3ceab41831535ecb08cc67b0b94f2a7805cecd3a6709ea2ce972d48deb5e8957e89fc0aa0e70014cd5a9c03b4a35e9fd95bba8b6d984cd782e02c7530b89473ff9fcccd3bf193408871397d4a5902f522740dc55e09da1dc54f246b6db4f6f4fc30c3dae9742219a7dd92d6445c29fcd365a2252770d1d890ca82e5354e3405240f8d385ec5367975348bab5a7cf519b3aa1d0cbaa86f60a9d09f9c04818cdf361bdf19ea2fbe8ad106d5bf225a0de7acb8b427b928a180425452337f773bb9386497ec2c64d0b766eef6d66da74ca5a0c53830183511c9e25fe515be2970039fcf63b555ac38059b3871f94baf808d1c28dcc3d7dff95a2634dc6d82f72e5b4ecd5d64ffc5dd7661fdcc39263950466f69f631b086fe6aa9f318ad1d24db58ee14f2b06631392ed5171411a7438817056df47d5593089518d6c36f548a7689e5fe19df2f4c586645d4037934b5e67776f3cc7c34edd04bca3244d02dce69e203f72287fc04f342654adf0dade54ae86ad971198a1b3dab3942e108aad7ad296cef20d999dcccbdf4a9679c98e2ac2e1929b0976d1ae47bcab16f66f67ab9c4f10acc5d451017669a598f51542cff9e33fd93cf355b609c67d91ffcce23d63256a6c9995e0fd29e381d945354696bf380507736a15b3e5088e66c6114948b1496971deee829f74c7e258170a105b56480f4ad7d5033e4bd8a60f824a66334d1c6a4181486a69c2bbdaab8bb3a26fef21d0a96c9d2d54579459a9280b9d6b5c2b345db718b4d8577f43fe2863c516c91fbdef4bf65e448ec2f14f1b5565d5a7730b6f8cf462b2679b31b9f1cbf03acde9e8f0d3ce6adb6153817191560e709da4622454f816aca90d890bd50751065fa4ee0dac8f88ab7c1e98293bdb3967ab97266d422008a2ffb05c546a5bc09777675176a9e71e6a44f9e212e98452d669bbde5f6fc99005b7cfd043ea9bff97fec48fec02a572f3deca5ceb4fd064b21ebdf07d88d4357651869faaf6448f820b997f8dbf10a2fd86358caf2c9a1986e8ff30d88d5fbd7d4b3951491b6ee09be4eceb393c887578a912d0db185f22dd4eb70600e979d1ebeb5b460101a8ea44ad18a8adbc13d3836ee701fee282275e02766b4e6b33eb39cbc583c610038067c5687fb75e3b6ad1777d7d94590bfbc54fc515f844a6bade9d424910e3d54e6ea66a01d7ad09f3f755cbe8f891213ed5eeb9bebf40cf2b414180304404f4ec12d79344c6405c68fd56483f14dda854079540f31a1310a21b98ce8fda43b014bbd801766e439b5092f48c1d934ab2022935d749ee699dada5cea23a19a534e2ba4ed9f8a522bda795c25bf41d45c7829eb73d36b86cc3f5a61a33784cc62d251239cc5501152988102ae5b5af35a4bf6118d98c8d265cdc6eddd1cb0578bbc4db687b9b3a4f5e0e0539f64f47b982197ceaf498b00e8e8aebe24faac5f05b2f1cc18e9042f33f30dbb168ed45cee4e64e6a188441429d11fc67efc047342818e696087ddeb981e7d1415a2b4ad85a4b32b12eda5ea6e0dbdf9859d5959e6967510e5f0fedce47e505b74451cc5b4a099b8b11ab821f1873b6b3307673ab34902ef7bf632b5d6e2383d69a2a594fa15f483e0cf0fbdff435c07c99466777a2be1d2752303f10715431dd891daa30a985bc2ee3710262a54eb82e25460e5e3aeccf121dc71cbdd3780ef84f14cc6fb3a5805eb0fe4d9e386a50a24b66c92597cee142a54be347f46e71c5b35cb428ff95d0a95f3a97221ecc87c0863a1f0bf53b36c86a50357544c62167c0e3b589cb912e9746da0a03df63c5d4093a39e3b819174079e19b55808268b63e3bf996540e4ed9b10b181729b581615113e48a5d67f1e8e9a54452e59b9732f39fede14daf00e5c7e00a3e76fe320a93a347b8b8f5301e9c6816e61b5985f16835eef4c147b609145ff9679f33d061fd465374458fb6b433bf6896f39ce29db42e58f6d39293a4620ece5f49a7ee485a613b5cd00925b1bdc44f3749c5ad3dfa2e9f7373680ee23d4b74e5ca50f2732699017f7e172c262fbb1f0c569da483171dd72f9d0fdb89d1dd07ebe815ba8f289418c05bc67d14a2763eaa0735c098e1604371799f632236bf5ef3ea100740548da0653cbb6dd21fce7d3372b1c014dd1984d20d1f710e1258b9d322e995c3a2da88ea6b85df0890ecfdc8ab742621c9277f016556d15577314e5f4a279c9c2f8a0127bb67481a2eb321429f39df671601488849bf80ca7577cba02e537869fef817a8a629177b80022f684c7c382959da5ccad234df25b74c77a571073cd49c2e254924dd08449a575338977ae5394f4315385a94f9ce39750206a7ef04d25efc63810eb9289b2241c750461ae84874a43a95a802ba548b1b6a3012295e06128fcc09dac4776df22a19bccbd00737c5f3f44c8819a23ed2b2db38800c50d4fa8bc90bc0cb079becfc3a750f6beb55ba81e3ba20a40489059e5532dfc7b25ade49d7e63097c6b65275d0d0481ced905efebe49eaf8e95143223022822adfe65aec78bebedc318ed52e158d4c30e2e5d86e4a3c90ece49006dd8a3533fb177287924d17cf479977a05a7942cdbcec4ff8e4b201bc8b11a854c6d53f0e27fa66a1360c3ec48087ea1aaaec106750bb394db381e33ad4c15d568b060fcc1251426393be15e4ea75590752a1f827dabd7b0f95c47a5872b7ba50b36e7cee19dc374c34ce739f4b7de3747dc8e7a13f21f7714bddb0300f9ff07c2c7f3e4f78257becbc5df28ad82057bda2028589971ac73c01848e5191ce8bcdeb92b8f09b32057d19683adb3fced6fd3b48ced462aa050352819c9e54706aa9ba5c831cfdb446b7f5ddb4c44656c24d54d69ff88c04ac897ebd4a4f3e790301c75b9b203b90142a607e3c61161f190c632e87c026aef603321c16ce9a65026cdd19fea306c00a79f12fa6020d0087064588916bf393f9d2cb03c6b6336acf37fe4e6452d4fc41dd9949efbc295e3176d1fa47f0cf3bd78025081a5d358e9a43d47d0efafc135e13d69eed691add51495354b183f3331a6ae395246cb53fed8b55b1ec1fc476ed0511bc80e2a08ce66d71f50eb6ce80f33895bd17321f16f25a3f1df73b19a920f088f483da488b20f2ac95ccba88a17f5649862f276afed7a33447738dc66cb7f5614ba86c59d568e321242a33d5d582489351c2cfd50e074cff41f0bdd934090166d49056c6f092ac710ba29e054629eaf18b85b67f9be1ddb884e8c85693173c5588980fc6ac6c2e1b83266b277255071eac06560455f1cbe79bae9410fba882cc3edde2d53551ffa653296a8e5c7a8c5dab504a079706265b7867591e4e7243aab2345e7deabd4407ce978040655a3f9be233e7a67ba153a7f47c72d0b596c4f9e4c7f68ec464c85962c93fdce2ebcd5d122eda4dabe32fd48987ac9b65baacb7fa656b052cdf4704987fa90c136fd1b813790cf348e1ad42b00435b034222945d38197ba0a319d47508447f752f6d3726c2f589ba6e1abf8bb61de0cca0413145e6a1a9dc3062a452c6f4d4a417b4cbadca31a2313251b529e1243100d22b61706f00e4db8828414e7e230dfd0a554de16059ff5b76cbf2bb05b1ac38132e548e4165ed7d65884e03e0e7fe31dcf18c0e4d929de527958c0d474c29e2df06e6f59884624da522d14b570113f15fefb0369dc315240df0c5b2a70261fd4146f69117096a0c9e55afcfb70f45dcad7f000f40172d780ec84a0a3efd210548fbabdd7434a07c08705822eb4a320c7b8c9e00fb3615c913041e25805d0ffe75bddfc03153cdad5b129b766f47b40943786b07eb198d6d463de9668eb54a54df1081aa8cfa36a25bfb2a78aa1d37188b548315f30b726544d051b554a815b5666cd715fd54a35edef3500a93f55112635e7a839ca1f598a4e5bdc324c33c437468d093bbf44a70a8196116054e0c40345b7732e3810253f13c2a20b23fcd9ffc02e4962f04d2b16a91854f76be3bc42d87b6b780b805cae798ccc53cbd4eb9a133163685032fe46359a7cea074997207583bf32295d542b26526e04734945481664cf93bfa322e5ec5118fec8766c48bf05fbefc8ef3182a79ddee5c4c78875062d789804c81e44af0708c60e1645665bae67c42e479ff88b6fa031c3c59ec9498507bef28997ae91d7950bc2932d7973b9884d4e1cd3e0fc0da11fbf13cab2d7e138e4dc2e8393196bad2de92bba008d8ceb4e8f761e0c7866a723fc7188084caf2df856bf7b8a1ca767e59526644723c3dfa03a23f5191cc4be8756dabaccd3ede20da5d04c39d253f45cdb58473309ffa08347b38d88b7c34715960515e62d8b8bf4c6f31b56dd5a1227521b4fd0d3339a79bb8cf30cc2a1d3b6d677aec155eddad592a84363d9bfb93ba1161567e7cd0e07837446246288398f2d1856bad68c8ab0417616d7b03b3a5135531aea9df57ad533b55a8ea4180173198bf89f2e08e9114d9fc58a0687dced65a7e4588ec71251c1e21a989c6fdb7c88ad4335d4ca08ef0a5322f225a024114202da9cc44cefe4f044c977bbed010631e26841e9ddcaf8e3eee6b93bf80811141ddda1a2d8d63957b4af6f18b90e9c00f9804abb4b642e989736a611fb945cc71d3841d12dbfe05ab251acccfeff6cb5940ebf2420c6f5dc14f9a642d42ab302966ff152846c93a6") [ 2594.970063] Bluetooth: hci0: command 0x0406 tx timeout [ 2597.018078] Bluetooth: hci0: command 0x0406 tx timeout [ 2599.066067] Bluetooth: hci0: command 0x0406 tx timeout [ 2601.114100] Bluetooth: hci0: command 0x0406 tx timeout [ 2603.162081] Bluetooth: hci0: command 0x0406 tx timeout [ 2605.210012] Bluetooth: hci0: command 0x0406 tx timeout 12:08:19 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:08:19 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x1fffefff}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:08:19 executing program 7: lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)=ANY=[@ANYBLOB="00000000000000000000000000007467a5be511a4b432ddbdb0815349b561163da033574fe9099b001713aa2e84b466b271b28a1cab6688379"], &(0x7f00000000c0)=""/184, 0xb8) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) recvmsg$unix(0xffffffffffffffff, &(0x7f00000028c0)={&(0x7f0000000340), 0x6e, &(0x7f0000002740)=[{&(0x7f0000000040)=""/62, 0x3e}, {&(0x7f00000003c0)=""/241, 0xf1}, {&(0x7f00000004c0)=""/4096, 0x1000}, {&(0x7f00000014c0)=""/74, 0x4a}, {&(0x7f0000000240)=""/12, 0xc}, {&(0x7f0000001540)=""/12, 0xc}, {&(0x7f0000001580)=""/157, 0x9d}, {&(0x7f0000001640)=""/4096, 0x1000}, {&(0x7f0000002640)=""/240, 0xf0}], 0x9, &(0x7f0000002800)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xc0}, 0x0) r4 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) fallocate(r0, 0x4, 0x3, 0x81) r5 = dup3(r2, r4, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f0000002900)) 12:08:19 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)={0x2, @accept_logical_link={{0x439, 0xffffffffffffffe5}, {0xc9, {0xc7, 0x7, 0x6, 0xa8a, 0x9, 0x9}, {0x8, 0x7, 0x401, 0x81c, 0x0, 0x8}}}}, 0x48) 12:08:19 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000180)={@empty, @ipv4={'\x00', '\xff\xff', @dev}, @private0={0xfc, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00006, r3}) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCDELRT(r4, 0x890c, &(0x7f00000000c0)={@loopback, @dev, @mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3}) ioctl$sock_SIOCADDRT(r0, 0x890b, &(0x7f0000000100)={0x0, @xdp={0x2c, 0x8, r3, 0x3f}, @ax25={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}, @nfc={0x27, 0x1, 0x1, 0x5}, 0x1, 0x0, 0x0, 0x0, 0x3ff, &(0x7f0000000040)='wg1\x00', 0x7fffffff, 0x60d2b6a0, 0x7fff}) 12:08:19 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x1008}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:08:19 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB='\t\x00\x00\x00no=', @ANYRESHEX=r2, @ANYBLOB=',\x00']) 12:08:19 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="01330c0700000023a77026b1d8613b5e00000000"], 0xb) 12:08:19 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x20000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:08:19 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0133060000001f00000000"], 0xb) write$bt_hci(r0, &(0x7f0000000100)={0x1, @user_confirm_reply={{0x42c, 0x6}}}, 0xa) write$bt_hci(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="01ed0802c800"], 0x6) [ 2606.582043] 9pnet_fd: Insufficient options for proto=fd [ 2606.596697] 9pnet_fd: Insufficient options for proto=fd 12:08:19 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e6, &(0x7f0000000040)="7465fd5060d22b7842aa10") 12:08:19 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x4000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:08:19 executing program 1: syz_mount_image$tmpfs(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x2, 0x7, &(0x7f00000004c0)=[{&(0x7f0000000080)="10f8cb77da155540fe1894368f22f927a619d820f3f3a0502ce245a6e845f7c13d9120ed060f1dbe2a08b3bf848922cf42dbdb7059af", 0x36, 0x2}, {&(0x7f00000000c0), 0x0, 0x4}, {&(0x7f0000000100)="673f15e43c5cff358d029b865d213758d0dd2f0348d69e0f751c5425e4834c64761a086a4601371c1674d5d4c883164d5d9e177598309fdfd9b0f3d34bbd8cacca95898b0cf8e5f8b2cfe960ee88d47e66256f4ce47408d967cadd498dd6205407dfe79fe0d58c745ebebe0d358ed8e9d11a96f07b8b9b9ce96c97aba9e07c5996c5c5deb7ff9f86550bde8d5a6a1c9210a7acd7c30f993f600c72a3610ae911866dfc42de0f0d6d30ce526f84f9841f9bb5fde7122b3c457be29816e6f55033414eb8349d2d55d50819c7c777563853151766", 0xd3, 0x8}, {&(0x7f0000000200)="0f2f1c9f70183265884a6b5c7b9be37d3c94fd4fd9f14cdc4d52581e0c26c6aa681cc06d90da98a5158189dbb8b2039033c3a451576f600eefdc80411231014f0d8f5e37c746fc3b10ffb240a9cebd1b621a3821b66917c485c4a3a3229eccddca3c8627edb1af9669547ef6c7f1d57d68ad41f20393b6286a1c8f07c01bbfb2e691bd3afb056af3d1a48257bdb9b7494dec62c20ab28a27487c0fe759a54ec44083a0879920817a79052773daac21e42524b6801ed419b4a1a4c3ae145158", 0xbf, 0x8}, {&(0x7f00000002c0)="527e3486be8dff199556fcab0144978b6f6eb40682c7644b69a21919827c330b1f2e12737e37f6d896867af45ca6807c5527b1b1da6bd60134f4d7d8d3af3edf330fae8032424bbe39484d287f6f08a1b1b9669ca84a5b8a2387f54a58501a51d0919260406058075e9e090514576347fb6afee87d34fdcda26ec644bb6fc93185b54feef51578a254fa77b3a83758ba3a9d8c3ce1f7e69113b4dda0ac580ebc793583b0cc5762a728efad0c18619747611c9b3c69db0d0e35b5897d9f91c66bd2cc0ca7788f3d4d1d5a3843b3f493cbe399", 0xd2, 0x72}, {&(0x7f00000003c0)="3270ae2781cc92918e7e47036f1a23990907b6d4f6be98ef1235c653b45d15b870e2422de869a240ae9ca9a6c62141f992b4070a46f7c1ca18fbc66766e4739f8a8121999e6a570e95db0e3bc20a27af4fa85b660525b61f8efe19d3df442e3224d5d8ff17411b0668b179f22c0c", 0x6e, 0x2}, {&(0x7f0000000440)="87dfe67190cb81abcbabecaf3268808f0eadfb44acb5b78b5876f77a44dd6fb606cd78a48b7da5d4eaf6b5f0fa658aa496b49e9b16d30a05e669363d9bf3c2de48ec49411fe028bb616429945318", 0x4e}], 0x280001, &(0x7f0000000580)=ANY=[@ANYBLOB="6875676ed70000005a2c4bf13776dca89e8100000000000000a1e5d04de45f1f35f56884850000c8526e51922ca832010000000000000073ea36c9051339da"]) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) dup2(r0, r1) 12:08:19 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000014c0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000004f80)={'wlan1\x00', 0x0}) r3 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000005000)={&(0x7f00000001c0)={0x28, r1, 0x1, 0x70bd28, 0x0, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0xfb, 0x2e}}}}}, 0x28}}, 0x4040084) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, r1, 0x1, 0x70bd25, 0x255fdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2400c094}, 0x4004000) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) bind$bt_hci(r4, &(0x7f0000000000), 0x6) write$bt_hci(r4, &(0x7f0000000200)=ANY=[@ANYBLOB="59748aff547d0eb2d796c1aa910d4b6aadc18d265fe748e5a2d8bbd7c8d701ac03b73ecfbe157084d197f8c3e927175acff905976914bc5cc85ed669fc347784adefa3544cb116e73afb8d537c3594ca9631332e313ae4a99f70"], 0x5) 12:08:19 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r3, 0x8040942d, &(0x7f0000000040)) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:08:19 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x3a030000}, 0x0, 0x0, 0x0, 0x0}, 0x58) [ 2607.258015] Bluetooth: hci0: command 0x0406 tx timeout [ 2609.306027] Bluetooth: hci0: command 0x0406 tx timeout [ 2611.354008] Bluetooth: hci0: command 0x0406 tx timeout [ 2613.402018] Bluetooth: hci0: command 0x0406 tx timeout [ 2615.450000] Bluetooth: hci0: command 0x0406 tx timeout 12:08:29 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)={0x1, @le_set_cig_params={{0x2062, 0x2a}, {0x3, "50f38f", "4a61ca", 0x0, 0x8, 0xff, 0x391, 0x7, 0x3, [{0x5, 0x6, 0xe6, 0x3f, 0x3, 0x2, 0x81}, {0x2, 0x3, 0xfffe, 0x0, 0xe2, 0x40, 0x7}, {0x3d, 0x1f, 0x2, 0x79, 0x0, 0xfe, 0x6}]}}}, 0x2e) 12:08:29 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="331e461c271c6e563059a7d8078ab136871491cb7dcf"], 0xb) 12:08:29 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x11000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:08:29 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x3f000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:08:29 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 12:08:29 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r4, &(0x7f0000000000)={0x60002000}) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:08:29 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) bind$bt_hci(r1, &(0x7f00000002c0)={0x1f, 0x1, 0x2}, 0x6) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x108}, 0x6) process_vm_readv(0x0, &(0x7f0000000040)=[{&(0x7f0000002000)=""/104, 0x68}], 0x1, &(0x7f0000000000)=[{&(0x7f0000000180)=""/260, 0x104}, {&(0x7f0000000100)=""/70, 0x46}, {&(0x7f0000002140)=""/4087, 0x1003}, {&(0x7f0000001180)=""/44, 0x2c}], 0x10000100, 0x0) write$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1, @read_remote_ext_features={{0x41c, 0x3}, {0xc9, 0x20}}}, 0x7) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ede4c40000"], 0xb) 12:08:29 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffffff, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:08:29 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x40000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:08:29 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffffff, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:08:29 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000040)=0x5, 0x2) 12:08:29 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f00000000c0)=0x800, 0x4) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f0000000040)={0x1, @read_stored_link_key={{0xc0d, 0x7}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7}}}, 0xb) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r5 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) epoll_pwait2(r5, &(0x7f00000002c0)=[{}], 0x1, &(0x7f0000000300)={0x0, 0x989680}, &(0x7f0000000340)={[0x4]}, 0x8) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) write$bt_hci(r3, &(0x7f0000000200)={0x1, @le_set_data_len={{0x2022, 0x6}, {0xc9, 0x7fff, 0x2}}}, 0xa) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000001680)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_DEV_INFO(r2, 0xd000941e, &(0x7f0000000680)={r6, "38281344401f21aa56ad851881829562"}) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, &(0x7f0000000380)={0x40000004}) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="4d93ea94086b71fe01320c00e4d740c28c012fea680000000008016d40c9f76b2a314bf86a2abd5a99f4cac3a72317258dfde40e478580ebc7e3eb53aef8187edc900e3c79b2b0a7a46e3ef2440e23036466e9b19f0e8d199cb9ed892c6bf55aebeb7e231344a560678e806a6cbde0e2f088a76f067c388f045d4b51bd8f76210c2282e68712c73618f24f6a329749ae882986d8a98fb63f45527147419cb58c688418398f2d057bab74d4ce5ea21895604d101ee586"], 0xb) 12:08:29 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000100)={0x1, @read_tx_power={{0xc2d, 0x3}, {0xc9, 0x3}}}, 0x7) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r0, 0xf504, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0x4, 0x4}, 0x6) pipe(&(0x7f00000000c0)) 12:08:29 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffffff, &(0x7f0000000000)="b7e8a047", 0x4}]) 12:08:29 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x34000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:08:29 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = openat$sr(0xffffffffffffff9c, &(0x7f00000002c0), 0x400200, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000300)={{0x0, 0x2, 0x5, 0x3, 0x3}, 0x0, 0x8}) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r2 = dup(r0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r3, 0x8010661b, &(0x7f0000000040)) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000080)={{{@in=@remote, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f0000000200)=0xe8) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[], [{@smackfsroot}, {@euid_eq={'euid', 0x3d, r4}}]}}) 12:08:29 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0x7bffffff}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:08:29 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r4, &(0x7f0000000040)={0x7b55a88d1bfad6a8}) r5 = dup(r0) r6 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0x4eb4, 0x10}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r0, &(0x7f0000000000)={0x20000010}) dup3(r5, r6, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:08:29 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x4}}}, 0xb) [ 2618.842048] Bluetooth: hci0: command 0x0406 tx timeout [ 2620.889995] Bluetooth: hci0: command 0x0406 tx timeout [ 2622.938188] Bluetooth: hci0: command 0x0406 tx timeout [ 2624.987012] Bluetooth: hci0: command 0x0406 tx timeout [ 2627.033977] Bluetooth: hci0: command 0x0406 tx timeout 12:08:46 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x80000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:08:46 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r1, 0x8040942d, &(0x7f0000000080)) r2 = accept4(r1, 0x0, &(0x7f00000000c0), 0x80800) sendto$inet(r2, &(0x7f0000000100)="8f2b699f0c5357e0a1da0e67de7a396e2a35a8a8af8a4a218701219b2968709b7d5d0ac80fcca69f7ce2f00c05781f02f939abf4ba6dd751c1e92958fffdac23848b127d684c8e96b03fc694cb029723c652c475fc1f51c44e8398615b290e6b5e681e8f3275e95e44a8a35eedaecd04be9146d466fd589b09d57d9ceecddc8ea5e3a6b39c604d001b9d07ede83df250ddbe79c2085bf53f1e63901b30badbde1725847361fb49adf0565afd799966e9cb653daad818cf4a4c2e49a3f63f1966648e319d83394549844521e86b631a0c01d0470c19418a81964dad3dba97b92f29c3a47351af7a9fb27701e751252272cb2b176bf6235f63ff", 0xf9, 0x5c000, &(0x7f0000000200)={0x2, 0x4e20, @local}, 0x10) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYRES16], 0xb) 12:08:46 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, 0x0}]) 12:08:46 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xfffe}, 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/zoneinfo\x00', 0x0, 0x0) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0x4, 0x2}, 0x6) 12:08:46 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r2 = dup(r0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) 12:08:46 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$sock_bt_hci(r1, 0x800448d4, &(0x7f0000000100)="4e7ebf9b0f37e3e384f7f7cf9eeb4f00d0867575bbfee3135a2310cb53a68e9d4273cb08b356457dcd36c394ad78e7c44b327a2f6eb276e93268d2fcbd70ff3dc633aa1fd1f8ef8bbf063e4eb3cbf6d498071fe5dbe50064cb8278e7c0ec8f597027cbca649d9549d6f332cf216fe6ff0befb0617f8b22da83ea3653ebef6861190efe9d5278adee59a8b41169a34a09c94526f1afc0db28b5d3cde38d772f0ca8e0c905be7f628bee8c8cf5190ed66409ba7cacb50b34eb2964204a76a02211383b362a773ff88db3df7e0001a9513549ad4dba2a") 12:08:46 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xc0030000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:08:46 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000000)={0x2}) r4 = epoll_create1(0x0) r5 = dup(r0) r6 = syz_io_uring_setup(0x7184, &(0x7f0000000280)={0x0, 0x0, 0x8}, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r5, r6, 0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:08:46 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x100100}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:08:46 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, 0x0}]) 12:08:46 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000100), r1) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x3, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}, {0x0, 0x0, 0x0, 0xffff}}}, 0xb) [ 2633.763581] 9pnet_fd: Insufficient options for proto=fd [ 2633.779483] 9pnet_fd: Insufficient options for proto=fd 12:08:46 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) recvmmsg(r0, &(0x7f0000001e40)=[{{&(0x7f0000000040)=@ieee802154={0x24, @long}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000100)=""/17, 0x11}, {&(0x7f0000000140)=""/75, 0x4b}], 0x2, &(0x7f0000000200)=""/111, 0x6f}, 0x8001}, {{&(0x7f0000000280)=@nfc, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000300)=""/37, 0x25}, {&(0x7f0000000340)=""/118, 0x76}], 0x2, &(0x7f0000000400)=""/157, 0x9d}, 0x80000001}, {{&(0x7f00000004c0)=@hci, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000540)=""/117, 0x75}, {&(0x7f00000005c0)=""/206, 0xce}], 0x2, &(0x7f0000000700)=""/4096, 0x1000}, 0x2}, {{&(0x7f0000001700)=@hci, 0x80, &(0x7f00000018c0)=[{&(0x7f0000001780)=""/71, 0x47}, {&(0x7f0000001800)=""/29, 0x1d}, {&(0x7f0000001840)=""/88, 0x58}], 0x3, &(0x7f0000001900)=""/234, 0xea}, 0x1}, {{&(0x7f0000001a00)=@caif=@rfm, 0x80, &(0x7f0000001d00)=[{&(0x7f0000001a80)=""/135, 0x87}, {&(0x7f0000001b40)=""/38, 0x26}, {&(0x7f0000001b80)=""/45, 0x2d}, {&(0x7f0000001bc0)=""/176, 0xb0}, {&(0x7f0000001c80)=""/19, 0x13}, {&(0x7f0000001cc0)=""/20, 0x14}, {0xffffffffffffffff}], 0x7, &(0x7f0000001d80)=""/170, 0xaa}}], 0x5, 0x0, &(0x7f0000001f80)) [ 2635.738013] Bluetooth: hci0: command 0x0406 tx timeout [ 2637.785976] Bluetooth: hci0: command 0x0406 tx timeout [ 2639.834013] Bluetooth: hci0: command 0x0406 tx timeout [ 2641.882002] Bluetooth: hci0: command 0x0406 tx timeout 12:08:55 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) ioctl$sock_bt_hci(r0, 0x400448e6, &(0x7f0000000040)="eb4ebe70bad3eb6f5f963f001440") write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) 12:08:55 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, 0x0}]) 12:08:55 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x400300}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:08:55 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x3, 0x5}, 0x6) write$bt_hci(r0, &(0x7f0000000000)=ANY=[@ANYRES64], 0xb) 12:08:55 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = syz_open_procfs$userns(0x0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r5, &(0x7f00000000c0)={0x2001}) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$BTRFS_IOC_RESIZE(r4, 0x50009403, &(0x7f0000000100)=ANY=[@ANYRES32=r6, @ANYBLOB="005edfe54a352c4ac4a124f5caae4775f300000071161ee05722ffbbec3d34ccd0cf710a68eb250f9224131ece5e7b75be20bb60061e68ff1200981459416190da9b3d06d4695a2fa39eda56bc71834095c9ceb0090288479fe579b452b9a77de7a8061e9e1c", @ANYRESDEC=0x0, @ANYBLOB=':+00000000000000000000g']) 12:08:55 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) fcntl$dupfd(r0, 0x0, r0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB="0000fb10132a37af3147025aabb28c5874b949aa6c1c45f8ac44c8671325acc97888e47b9344fdebbef011d547bc74eafe768c82d5a6aeb20c24b2dd2de4bc2ac98959f8dde6cdb0b3f5f6ac655702a7e14094c41e992bc340324aa1bd8f55694ad937b4b826cc607e7bd3b52053171a72b742875407789d08323c2a47"]) 12:08:55 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xe0000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:08:55 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0x4, 0x4}, 0x6) fchmod(r2, 0x24) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f0000000240)={0x200b}) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x2}, 0x6) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r8 = socket$inet_tcp(0x2, 0x1, 0x0) write$bt_hci(r0, &(0x7f0000000100)=ANY=[@ANYRES32=r8, @ANYRES64=r8, @ANYRESOCT=r2, @ANYRESHEX, @ANYRESDEC], 0xa) 12:08:55 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="01330c15f77ebf9dd4b4079a0700000001000000"], 0x178) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000100)={0x5, &(0x7f0000000080)=[{0x4, 0x4, 0x40, 0x9}, {0x1, 0x1, 0x40, 0x6}, {0x9, 0x5, 0x6b, 0x6}, {0xb4e, 0x2, 0x1, 0x8000}, {0x3ff, 0x40, 0xff, 0x8}]}, 0x10) 12:08:55 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000000)={0x1, 0x3ff, "a253cb", 0x3, 0x99}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x10}, 0x6) write$bt_hci(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0133ed060000000000000020f8d2a83a820320b85bf1392eec23df7ed9ea206b4ed088bbcae86c4e5a24ab848c5b1a8d98d40f10ecca09795b56308c1386baec8d676626b0d3d420adba22ff70add4675b9419f8da8000d9f5e1a8bd16a74f638dd223a572806ed4099202640baa63e0bd1344e50c62a23d03ea4f7241a5f68680442147421bb60a8d67d573b602c95080e1d171c38793b1efc6d6a4527b86520514eb9ab61a1cd4ce883b3e17f7bb000000000000000000000000000020bd63204538b312c443437872d848"], 0x178) 12:08:55 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) ioctl$sock_bt_hci(r0, 0x400448e2, &(0x7f0000000040)="86841c71026856e4b06d6b11829cfd7b58322487fadbb814d1e9fad008d85f77c3802c1cd82e3bd3cab71f72105560926b872e91a34eaf77bccab748e3b684e062d14120d082") write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01330c0700000000c4f900"], 0xb) 12:08:55 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x1000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:08:55 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0}]) 12:08:55 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xf0ffffff}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:08:55 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000380), 0x10080, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f0000000340)={0x1, @set_cpb={{0x441, 0xb}, {0x28, 0x6, 0x9a, 0x261, 0x1, 0x101, 0x8}}}, 0xf) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x2, 0x800, "ca7de6", 0x7f, 0x8}) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000040)) sendmsg(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000100)="401aade4c888d8db165dfc471e5d4226bd04481906edfb26040d7cadabe1716f46c2bddaf5a2067943b70a80488491830a02bea7e60d13c39239ecd383aa60c8ac84a75104fad27777167bf6cedbfc85df6bcdb7d025be33df784fb65e08b146cd1c73f7e62057f4e0fbadae3abfaac1b4481a185055da8964973f81ab277f1ff5e9884a445df0c2e9dbc668c7917b8828296247352e7787bd7011664f8400b79319cdf94055b5744ef8216215a306aef2", 0xb1}, {&(0x7f00000001c0)="94616c87b662c91522465117256d6bd768484a069a3052d2cfa45e3f4eb6d8d8ced1bfa5dcf12826a2e26e885234aa855b87083078a5e8da579954128af28bf2fcad250269be16c9767ac690512c0a42bfab828157a0ee51f043883320fcde4a9dbcb224208a59aca9497b44cf68f52fa415d8ebea4f8b5f43411179f8641354da7109828ba5c153c069bfad2027db37ceb22b9cb845eb686597903a82fff00edd2269eb4b1be662cb1f1091905bd0f615b7880b1835dc72e92c37e68f3da59ed683d7b64e844eaf77f548a0b7fed0247ec6575be36af7", 0xd7}, {&(0x7f0000000080)="cef93a81275dee8ae3c82fb5440d1417afc8d10a68ede674ec2f6edce0c1dc1ee7a77acd0136b2cee086d8", 0x2b}], 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="a0000000000000000b010000ff030000a23d8d768d8bf550b4008c3c77018268876594c646d5d5b1837760bc8fe90bb09ceb0d03b124a85dfc003bd0d7c48c9e0b2c2f59443176073fb8a21f851be73b2a425724743fddbdaab6e1731684c1b93a86b15ad81b029579586b87b2b5f3771d1be073c0f7954ae0012948ab1c9b775ce04289e2281c289a4b0f92554c3438d83fab2bd1d68294770000000000000088010000000000000c010000ffffff7fa849d15530e4b897b5fe8049476305c00d46cd95d874d7e411dd8c1894e287535a9c7ea84c189b40ddfc1a6d58059734087853a376a5b6319289ea94d03e7ace6df37a7de2d32c58c1015adeaaac12e9119d8f349fc13812a4a8cca8be923fca8e64b4c4eec4e7570ac2c18185d5d38312adaf182c2c7923a707d820e2bf396b2ec01145cf354cc9ccb265aee850aa3f7b02eb431806cb646c06e46b619a395a7c31f322885ce273088a300844d3a50ad837e0a501702e7b6e5956097800ad4a0713110230f0f7307d4eef5db5f47b45dc2b69e50560160b04b752054c3ec912c17e539f56d4e8dfc8ac0ec0236423f7bb7649f3a7fe8b7de8ba5a5e495c5358404c9dffcb993d0cc89497d704740a7a5fbd45c32627b67ae04e12c638065fdb797e628454118ba2f5d2352c728c7ce88c2bd3bc9d55c239bb2d3767c1f83aea16b405e48532175fd3b435873459a91f6c5b7e9b83872d126b3de44406f37142f7f6b84c5b31fca65e2687000000000000d80000000000000088000000f7ffffff6c444ecd5b58c15efedbe5bf95eb0771c820ae515d87b1db3b76cafa7b268c38db972c8f45fd4adf692520903780f1a29e9df3587a6ac557032a168d4abc618a5ce98d5980fe375b504c51313958725acf69464283562e80e77e8a8785cfb44d131d44bb9a23363ba61b263e0b407b4f9df7ee0922a69766d4c081bbb16ab851f5373152b7ba07dc69ce337a817449da1e0aa2f40d4e3b5216358b0818ecbcfdc8dca4f425c865d394e2bba1f20d4a5f88c02facc500f3b6997a7eae74695c2e41307f3900000000"], 0x300}, 0x4004014) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000000580)={0x1, 'veth0\x00', {}, 0x3}) 12:08:55 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x2000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2643.693126] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 2643.694394] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 2644.826054] Bluetooth: hci0: command 0x0406 tx timeout [ 2644.890009] Bluetooth: hci1: command 0x0406 tx timeout [ 2646.873988] Bluetooth: hci0: command 0x0406 tx timeout [ 2646.938008] Bluetooth: hci1: command 0x0406 tx timeout [ 2648.922095] Bluetooth: hci0: command 0x0406 tx timeout [ 2650.970014] Bluetooth: hci0: command 0x0406 tx timeout 12:09:04 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xf4000000}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:09:04 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01210c0500690000800000"], 0xb) write$bt_hci(r0, &(0x7f0000000040)={0x1, @create_logical_link={{0x438, 0x21}, {0xc8, {0x1f, 0xd0, 0x9, 0x200, 0xfff, 0x5}, {0x6, 0x5, 0x2, 0xffffffff, 0x9, 0xfffffff9}}}}, 0x25) 12:09:04 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0}]) 12:09:04 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x3000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:09:04 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)=0x0) dup3(r2, r3, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) pwrite64(r5, &(0x7f0000000140)=' ', 0x1, 0x99ad) r6 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x1000)=nil, 0x1000, 0x7, 0x13, r5, 0x0) syz_io_uring_complete(r6) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r4, &(0x7f0000000000)=@IORING_OP_SEND={0x1a, 0x5, 0x0, r7, 0x0, &(0x7f00000000c0)="abc19cc5abbc0e59e31ac514a74f905ceab9714ad17011a42ac37d0eb0ea67f5ed6649db9d026c320101794f422c7d7918790e838e6e7f8f", 0x38, 0x20008055, 0x1, {0x0, r8}}, 0x7) readv(r1, &(0x7f0000000040)=[{&(0x7f0000000340)=""/211, 0xd3}, {&(0x7f0000000440)=""/229, 0xe5}], 0x2) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:09:04 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @write_remote_amp_assoc={{0x140b, 0xc2}, {0xc8, 0x3, 0x6ea1, "fc939d5bcb306b0db3f6ec39bf0aa25e052e00f925f7b76c6b3357e8c733cd9f817db59b56fd35d26458f73bd7f2785f6272678ca6af94ae7c585e8635dcefa28b37ffc1336b15f7e95ada1f42cad4d46e1979738b752a08064e91627a9db682af14f01d66bed1b08d5df09d7391749fe02cf3b42c16e982d15d12578f3ccd6c3377f530d3ab6f6e52d28a8cac88e21ba957710f957482a978872291b0b6ae5a7acc53088181799a9a0e39091042a40a166e431dcf144b3618156606df"}}}, 0xc6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="0139e821c95f81ffff0600000006000000feffffff09093f000200000003000000ff0f0000"], 0x25) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 12:09:04 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02336a6764a50000000000"], 0xb) 12:09:04 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = accept$unix(r1, &(0x7f0000000040)=@abs, &(0x7f00000000c0)=0x6e) ioctl$BTRFS_IOC_BALANCE_V2(r2, 0xc4009420, &(0x7f0000000540)={0xa, 0x1, {0x8, @usage=0x7, 0x0, 0x1, 0x3ff, 0x98, 0x7fffffff, 0x27872990, 0x492, @usage=0xfffffffffffffffe, 0x8, 0x9, [0x3ff, 0x1, 0x401, 0x4, 0x2, 0x5]}, {0x1, @struct={0x20, 0x200}, 0x0, 0x3, 0xd, 0x6, 0x1f, 0x6, 0x38, @usage=0x101, 0x9, 0x4, [0x8000, 0x4, 0x80000000, 0x200, 0x1f, 0x3f]}, {0xffffffffffffffff, @usage=0x4, 0x0, 0x20, 0x0, 0x3ff, 0x10000, 0x7, 0x1c, @struct={0x2, 0x7}, 0x7, 0x18b0, [0x2, 0xea47, 0x0, 0x3f, 0x0, 0x1]}, {0xf54, 0x0, 0x9}}) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}}) 12:09:04 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0}]) 12:09:04 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xf5ffffff}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:09:04 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x4}, 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:09:04 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="02330c3b0e00507a5effa50700f40000000000"], 0xb) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 12:09:04 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8", 0x2}]) 12:09:05 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x4000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:09:05 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = epoll_create1(0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000240)={0x200b}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, 0xffffffffffffffff, &(0x7f0000000100)={0x20000010}) write$bt_hci(r1, &(0x7f0000000040)={0x1, @delete_reserved_lt_addr={{0xc75, 0x1}, {0x6}}}, 0x5) 12:09:05 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xfbffffff}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:09:05 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8", 0x2}]) [ 2655.081687] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2655.087182] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2655.089393] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2655.108966] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2655.111500] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2657.178983] Bluetooth: hci0: command tx timeout [ 2659.226061] Bluetooth: hci0: command tx timeout [ 2661.275374] Bluetooth: hci0: command tx timeout [ 2663.322325] Bluetooth: hci0: command tx timeout [ 2672.253629] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2672.254772] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2672.330352] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2672.331593] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 12:09:33 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x5000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:09:33 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7e8", 0x2}]) 12:09:33 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x80000, 0x100) r2 = dup(r0) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x2, 0x9, &(0x7f0000000840)=[{&(0x7f0000000280)="a933461c04ff6baa0bec573e2e799dcb1359dd841a5f964eb0d402d1bb63da4f2c513b6074cb16799876c4f08f7127b5083ca291c1acb0cfc141a53c3af73919e4d4eea4defa530d7937d0ed85f92e0db7d069d29ad239c29aa269ef587ae08408147643af21318b84aa7f826c5db2af235b931b440351a63fc41e7de54e184804c2c37b52bbd434424e529593340a2c5fe521003efb6a8620967d74066a468534cc", 0xa2, 0x7}, {&(0x7f0000000140)="baa44ef3568917c803968e9ca8a7183734e3c1ea3c5eab0134b19c6b7b7cd3220fb1514fd93894f1073e369824324ae7c1b2dbfea3cb155289", 0x39, 0x400}, {&(0x7f0000000400)="565a671bc0d7ed400c61b9d622822e83e4e086b037a56b4e1554b182ee9462cb46257e911aedda18a1fd2d5239687b1dc504c8093f387d41b06f8720cec4d92da30b873442e5fede420b656ca32be448fae850d009c42fb58f47368ceece13bd4143c7ad8f7974b89a2d5f368ae409255094ec6c36b6592049a767c1f13e79ce2115084064db4468f0c18c1eb8253642f0e74ca1089427278ebd1b9c66fba16fbd0a8f1d43425c7a9f2a79368ed21e329f4439cf86a65d71f4db5a1a94d52fd9ce7825c536a50ab23de2bdc62e976875cdf9f0a77d0abd0d8e66083f48ae6b3f62c2f60c22926ef1f6042455825916853998445950a606385d10a3d85c", 0xfd, 0x8}, {&(0x7f0000000340)="80e29b5db2d2500dddad7a581cfc1385cee6efc99afc1966181f5f67b8ef57e7b5bb2b611c92065a92037b6838f56feff904b39d8b031a0684f90e1bbbf3fe0af4349a9ed272eba00e60c735b106fc0de9175ce9acbc5f08fb52ae05eaf2432138a93a58395fe406", 0x68, 0x4ed5}, {&(0x7f0000000540)="91bc99990a42763b4754ca31b87f8f94de3aa93eb672c5404b8984ef586db616a5ddbbd705b62fea26d1620e01aa4537b8e93b6deb5ea8a1dea9b443a802173101599a7e87afc5a30bb79873478657102f0bc7141cb5363e1e324958a9ce4b1b4e615f14494ad817eae22bac9fcad99dd85192b8ae7f0dcde824b0da3f11e556e943b1d85897d0acac186da370b936c70677597a29f8f27a7d1a45c09b9d4dc54fd168a049469752c94b72862a4ed17c7e6643a3329e4d032151f44e03e9ea", 0xbf, 0x1f}, {&(0x7f0000000600)="ccb7112d03e00043e936af3664ed46abe91a5ebf145d7d71f1110258a790ac5d1d8f1821bce4d657694b6592828a2ad592e571a37ac7a4f74fadebe1d39a2f4d1f952be7ba5831db608ee9ecd372bd94014c1cd370f0fdd1444dc2c90c7a4cf2e35710b8313d6b9559b042287b319a78e40f223318c6d9fac6ff20c75bba7265e2217162d32176cfcb2eb9d0086bb8ebf3a0a404aafde07859d77388055a2e0460333a8abd8412b40c0fed7dcd6e801a08d22ecc", 0xb4, 0x9}, {&(0x7f00000006c0)="2e1faa207c8bf2b3cd1e816d60f613bde7662bb5034bf1523d291717a7bbe1d1730fff28cc49f63f0af740a7ff03318e2fcfe1ae0d20c23c1a04340bde0ae56e82ebe1098c65e44801709657dc62ccf1ed91339328ee64fc6b7eaae639a0fad9889362f65a866330c740f7f8", 0x6c, 0x7f}, {&(0x7f0000000200)="7a1aa29ef0", 0x5, 0x3}, {&(0x7f0000000740)="aba1ea918e823d595935f20514e2b34574d715988615041ae0be0bcf6664a8ef70cc80d94ff54b27c7a58a9ba4b73862d86d4281a3ea531ea2489a554116104a23cddf9f62d752436bc100323425e42694de93e21237c1dbb996e1088b64c8c4137fa7003fbdd25c843991beb2031529faca9a7a8ee52392f7749bb891c7e7f334fc59a7ec6be02f76fa6baae96702588dc74bff2640355bd035b36eba909244972ccec1bbe4649ac3812747b283f5ed28463e46fe924fe9d9435cf5616346d779a7f999f04b6fdce5ddd2e4", 0xcc, 0x63}], 0x1010000, &(0x7f0000000940)={[{@journal_dev={'journal_dev', 0x3d, 0x1}}, {@usrquota}], [{@subj_type={'subj_type', 0x3d, 'rfdno'}}, {@mask={'mask', 0x3d, 'MAY_EXEC'}}]}) r3 = fork() r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) kcmp$KCMP_EPOLL_TFD(0x0, r3, 0x7, r0, &(0x7f0000000040)={r5, r1, 0x6}) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r6}}) 12:09:33 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000000)="7539a3c22a0c0965d9e19ccff7520aed", 0x10}, {&(0x7f00000000c0)="9d4a76762448c161c5886146c9649e5ee759ebd1135a979634d326461c3b71616585e35551c86965aae0d57988330024c708f19cbb08475a8db91b38ba8b17605868194c3fa67b315675e16978c3584783f5e9b584aed59684eb176f57455680f70c63c07bf08ea1cb9e14dc40a24afa1d859936e71e2009dc9877ab3d3f51cc3ddaa3c8d0f46f87e4c3749a42fd20158fa978bce2d04c7ec9421131add30157948a243b6f29c30cb556bc7c166efa16a177df9a07e67696a6943ffe44", 0xbd}, {&(0x7f0000000340)="9367ba083f00acd169d2bf96b8d1f6fde3f4393b76ab26bdbda8ca989b0be47d331aa3297a23a36f731e5c410cade9a53903b398115aa3c8e2ec90322dfdfa3f9877d47303344f0d0ca4f82ae93babda14de29c643308f78cbf4167f39bd23f987b193149c5d119344522976399610f835d303affbca588d404090", 0x7b}], 0x3) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) write$binfmt_elf32(r3, &(0x7f00000003c0)={{0x7f, 0x45, 0x4c, 0x46, 0x7f, 0x7c, 0x3f, 0x3, 0xd079, 0x2, 0x3, 0x80, 0x38d, 0x38, 0x39b, 0x101, 0x3, 0x20, 0x2, 0x3, 0x3ff, 0x8f}, [{0x3, 0x7f, 0x20, 0xea92, 0x9786, 0x8, 0x6, 0xfffffffb}], "e9f856f8f15f61f343fe191f05af39", ['\x00', '\x00', '\x00', '\x00', '\x00']}, 0x567) r4 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) r5 = dup3(r2, r4, 0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) r6 = epoll_create(0x1) close_range(r6, r5, 0x2) 12:09:33 executing program 3: clock_gettime(0x0, &(0x7f0000000180)) clock_gettime(0x0, &(0x7f00000001c0)) rt_sigtimedwait(&(0x7f0000000040)={[0x42]}, &(0x7f0000000200), &(0x7f0000000080)={0x77359400}, 0x8) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) futex(&(0x7f0000000100)=0x1, 0x2, 0x0, &(0x7f0000000280)={r1, r2+10000000}, &(0x7f00000002c0)=0x2, 0x1) 12:09:33 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) write$bt_hci(r1, &(0x7f0000000040)={0x1, @change_conn_ptype={{}, {0xc8, 0x2}}}, 0xffffffffffffff04) ioctl$sock_bt_hci(r0, 0x400448e2, &(0x7f0000000100)="26ae09cee5183c89dbe2412bf5100dbacd5553b67fb5f3cd77e311fc7909c1853636b118ebe73ec3b7f286593be4ecd6b276602051becb06bc3cbdfb76ff473d94f6765eb4be042f80b5591b01524adbf4da9953d7356c934625a828d8491555cd6873687a51aae9d8fe8713bbc46064a6614cf346c571a3ddb9ba1b270492bde6e02510e4c84db2c7d55c8e56b8f16ccc07a142e1a59586c0c93413088171d74b0edc1d518ddcf7d590366d398771fe4cd8dc8d5539") 12:09:33 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xffefff1f}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:09:33 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="01330c07000000000000ed331247baff1324627aaee37a18cc8ad333f5ebd5996167114b9d8ecaebd6a48978d263c6ae1d902ecc1d5de344254945cb"], 0xb) 12:09:33 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0}]) 12:09:33 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x6000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2681.080238] loop5: detected capacity change from 0 to 78 [ 2681.087999] ext4: Unknown parameter 'subj_type' 12:09:33 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xffffff7b}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:09:33 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) ioctl$RTC_WIE_OFF(r2, 0x7010) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) ioctl$F2FS_IOC_RESIZE_FS(r1, 0x4008f510, &(0x7f0000000000)=0x19) r4 = epoll_create1(0x0) r5 = dup(r0) r6 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r5, r6, 0x0) epoll_pwait2(r4, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:09:33 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x8100000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:09:33 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x33, &(0x7f0000000700), 0x8) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000280)={'sit0\x00', 0x0, 0x29, 0x6, 0x8, 0x3f, 0x10, @private2, @dev={0xfe, 0x80, '\x00', 0x11}, 0x8, 0x80, 0x2, 0x8}}) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_pwait2(r2, &(0x7f0000000100)=[{}, {}], 0x2, &(0x7f0000000140)={0x77359400}, &(0x7f0000000180)={[0x20]}, 0x8) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) write$bt_hci(r2, &(0x7f0000000040)={0x1, @sniff_subrate={{0x811, 0x8}, {0xc8, 0x8, 0x6, 0x2}}}, 0xc) write$bt_hci(r0, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:09:33 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01340c0700000000bc0600"], 0x178) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10) lseek(r1, 0x3800000000000000, 0x2) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2}, 0x6) 12:09:33 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0}]) [ 2681.284565] loop5: detected capacity change from 0 to 78 [ 2681.293399] ext4: Unknown parameter 'subj_type' [ 2683.098033] Bluetooth: hci0: command tx timeout [ 2685.146061] Bluetooth: hci0: command tx timeout [ 2687.194075] Bluetooth: hci0: command tx timeout [ 2689.242028] Bluetooth: hci0: command tx timeout 12:09:43 executing program 1: ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000180)={@empty, @ipv4={'\x00', '\xff\xff', @dev}, @private0={0xfc, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00006, r0}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f00000000c0)={@loopback, @dev, @mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000180)={@empty, @ipv4={'\x00', '\xff\xff', @dev}, @private0={0xfc, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00006, r4}) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCDELRT(r5, 0x890c, &(0x7f00000000c0)={@loopback, @dev, @mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4}) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r6, 0x890b, &(0x7f0000000180)={@empty, @ipv4={'\x00', '\xff\xff', @dev}, @private0={0xfc, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00006, r7}) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCDELRT(r8, 0x890c, &(0x7f00000000c0)={@loopback, @dev, @mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(0xffffffffffffffff, &(0x7f0000004f80)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004f40)={&(0x7f0000004d40)={0x1d4, 0x0, 0x8, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}]}, @HEADER={0x84, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}]}]}, 0x1d4}, 0x1, 0x0, 0x0, 0x4000001}, 0x40010) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r9, &(0x7f0000000000), 0x6) write$bt_hci(r9, &(0x7f0000000080)=ANY=[@ANYBLOB="0100000000e600"/16], 0x178) 12:09:43 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xfffffff0}, 0x0, 0x0, 0x0, 0x0}, 0x58) 12:09:43 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x10000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:09:43 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) perf_event_open(&(0x7f0000000340)={0x2, 0x80, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x200b}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x4, 0x400000, 0x0, 'queue1\x00'}) get_robust_list(0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000300)) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r5 = epoll_create1(0x0) epoll_pwait2(r5, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x200b}) perf_event_open(&(0x7f0000000280)={0x2, 0x80, 0x0, 0x1, 0x87, 0x4b, 0x0, 0x400, 0xc80, 0xb, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x2, 0x0, @perf_bp={&(0x7f0000000100), 0x8}, 0x1c2, 0x10001, 0x6, 0xb, 0xa1, 0x3, 0x6, 0x0, 0xfd, 0x0, 0x5b3a}, 0x0, 0xd, r4, 0x0) write$sndseq(r1, &(0x7f0000001100)=[{0x22, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0x1c) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r6 = dup(r0) setxattr$security_selinux(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080), &(0x7f00000000c0)='system_u:object_r:policy_config_t:s0\x00', 0x25, 0x2) r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB="00000300000000", @ANYRESHEX=r7, @ANYBLOB=',\x00']) 12:09:43 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0}]) 12:09:43 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000040)={0xffffffffffffffff, 0x1, "d3b570", 0x1}) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01330c076f45ec1f00037b"], 0xb) write$bt_hci(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="01f38f19d482e5b656a0dbf98f87ce337b5bba28d80c2f1f0fc2492e49c03fd8a64d13619f6409793f687600a9a87680b1abf0cf88859f4f02a91f42675e4fe1ce5b4a4123cc8f9996460e000073bccfebf200ae078a29725c7d9818eb6860e6a97fd65b757f3c5cca17bd72ebd16f07677b9be710d81459597cec27dce887774e73da99769d067cb01c9dc19b884507c4fc3aa7"], 0x6) 12:09:43 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02330c07050000ac93c442"], 0xb) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000040)={0x4, 0xbcb, "ce35df", 0x8, 0x5}) 12:09:43 executing program 7: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) r2 = dup(r0) r3 = syz_io_uring_setup(0x7184, &(0x7f0000000280), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000200), &(0x7f0000000300)) dup3(r2, r3, 0x0) openat2(r0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x90400, 0x50, 0x2}, 0x18) pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r4, 0x0, 0x63, &(0x7f00000000c0)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) 12:09:43 executing program 1: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = epoll_create1(0x0) epoll_pwait2(r1, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)={0x200b}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = epoll_create(0x1ff) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_open_dev$ptys(0xc, 0x3, 0x1) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r4, &(0x7f0000000200)={0x10002008}) bind$bt_hci(r2, &(0x7f0000000000), 0x6) write$bt_hci(r2, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}}}, 0x178) fcntl$F_GET_RW_HINT(r2, 0x40b, &(0x7f0000000140)) r5 = accept4$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @empty}, &(0x7f0000000080)=0x10, 0x800) ioctl$sock_inet_SIOCGIFBRDADDR(r5, 0x8919, &(0x7f0000000100)={'gretap0\x00', {0x2, 0x0, @initdev}}) 12:09:43 executing program 3: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000000)={0x7fff, 0x5, 0x0, 0x8, 0x0, "1255f7597ab49bf8"}) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000000c0)=0xa) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000), 0x6) write$bt_hci(r1, &(0x7f00000000c0)={0x2, @host_buffer_size={{0xc33, 0x7}}}, 0xb) 12:09:43 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000000)="b7", 0x1}]) 12:09:43 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x40000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) 12:09:43 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01330c0700e845428375e84e4f5ceb9a4788050006d6139113df6295496a64075df97fa60772d1ad411a840600000000000000d633a7b14c1742ab14c02c2daea04a0403082b445eec50a263d0311c94cbe484"], 0xb) 12:09:43 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000200000000000000"], 0xb) [ 2691.290015] Bluetooth: hci0: command tx timeout [ 2691.318710] 9pnet_fd: Insufficient options for proto=fd 12:09:43 executing program 4: set_mempolicy(0x3, &(0x7f00000007c0)=0x5, 0x11) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone3(&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, {0xfffffff5}, 0x0, 0x0, 0x0, 0x0}, 0x58) [ 2691.366501] 9pnet_fd: Insufficient options for proto=fd 12:09:43 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000000080)=[{}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x200b}) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x4, 0x3}, 0x6) bind$bt_hci(r0, &(0x7f0000000000), 0x6) write$bt_hci(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="b4fa16985a443c857cfade5ac8142565a4a3"], 0x178) 12:09:43 executing program 2: perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x0, r0}]) 12:09:44 executing program 5: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="7472616eff3d66662c7266646e6f37", @ANYRESHEX=r1, @ANYBLOB="af0000003d", @ANYRESHEX=r2, @ANYBLOB=',\x00']) 12:09:44 executing program 6: perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000)="b7e8a047", 0x4, 0x0, 0x8000000000000}]) io_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x0) [ 2693.338102] Bluetooth: hci0: command tx timeout [ 2695.386167] Bluetooth: hci0: command tx timeout [ 2697.434247] Bluetooth: hci0: command tx timeout [ 2699.482123] Bluetooth: hci0: command tx timeout [ 2701.530020] Bluetooth: hci0: command tx timeout [ 2702.834824] kmemleak: 11 new suspected memory leaks (see /sys/kernel/debug/kmemleak) BUG: memory leak unreferenced object 0xffff88804a1d9d00 (size 184): comm "syz-executor.1", pid 285, jiffies 4297357950 hex dump (first 32 bytes): 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc aac3d9bb): kmem_cache_alloc_noprof+0x406/0x680 prepare_creds+0x2c/0x7e0 copy_creds+0x7a/0xa20 copy_process+0xf59/0x7410 kernel_clone+0xea/0x7f0 __do_sys_clone+0xce/0x120 do_syscall_64+0xbf/0x390 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff88800cd94b00 (size 128): comm "syz-executor.1", pid 285, jiffies 4297357950 hex dump (first 32 bytes): 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 ................ backtrace (crc 3442d345): __kmalloc_noprof+0x497/0x760 security_prepare_creds+0x101/0x160 prepare_creds+0x579/0x7e0 copy_creds+0x7a/0xa20 copy_process+0xf59/0x7410 kernel_clone+0xea/0x7f0 __do_sys_clone+0xce/0x120 do_syscall_64+0xbf/0x390 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff88801fa4b080 (size 288): comm "syz-executor.1", pid 285, jiffies 4297357980 hex dump (first 32 bytes): 02 00 00 00 01 00 00 00 00 00 00 00 ad 4e ad de .............N.. ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................ backtrace (crc 519a3b62): kmem_cache_alloc_noprof+0x406/0x680 alloc_pid+0xd5/0x1100 copy_process+0x3bd1/0x7410 kernel_clone+0xea/0x7f0 __do_sys_clone+0xce/0x120 do_syscall_64+0xbf/0x390 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff888016bd6000 (size 2048): comm "syz-executor.1", pid 31323, jiffies 4297358000 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 1f 00 03 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace (crc dfa6cd09): __kmalloc_noprof+0x497/0x760 sk_prot_alloc+0x157/0x280 sk_alloc+0x34/0xbd0 bt_sock_alloc+0x3a/0x3b0 hci_sock_create+0xb2/0x170 bt_sock_create+0x15d/0x2c0 __sock_create+0x369/0x810 __sys_socket+0x145/0x260 __x64_sys_socket+0x73/0xb0 do_syscall_64+0xbf/0x390 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff88800dfd0ac0 (size 32): comm "syz-executor.1", pid 31323, jiffies 4297358000 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01 00 00 00 03 00 00 00 4b 00 00 00 00 00 00 00 ........K....... backtrace (crc ad019dda): __kmalloc_noprof+0x497/0x760 security_sk_alloc+0x101/0x160 sk_prot_alloc+0x20b/0x280 sk_alloc+0x34/0xbd0 bt_sock_alloc+0x3a/0x3b0 hci_sock_create+0xb2/0x170 bt_sock_create+0x15d/0x2c0 __sock_create+0x369/0x810 __sys_socket+0x145/0x260 __x64_sys_socket+0x73/0xb0 do_syscall_64+0xbf/0x390 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: memory leak unreferenced object 0xffff88804b6f4c80 (size 232): comm "syz-executor.1", pid 31323, jiffies 4297358001 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 60 bd 16 80 88 ff ff .........`...... backtrace (crc 83de32c7): kmem_cache_alloc_node_noprof+0x3e1/0x6a0 __alloc_skb+0x2ab/0x370 alloc_skb_with_frags+0x8f/0x7c0 sock_alloc_send_pskb+0x7cb/0x950 hci_sock_sendmsg+0x190/0x2270 sock_write_iter+0x57e/0x610 vfs_write+0xbe9/0x1150 ksys_write+0x1ef/0x240 do_syscall_64+0xbf/0x390 entry_SYSCALL_64_after_hwframe+0x77/0x7f BUG: leak checking failed VM DIAGNOSIS: 12:10:02 Registers: info registers vcpu 0 RAX=0000000000a0610b RBX=0000000000000000 RCX=ffffffff84bf50b7 RDX=0000000000000000 RSI=0000000000000000 RDI=ffffffff814c9680 RBP=dffffc0000000000 RSP=ffffffff85c07e00 R8 =0000000000000001 R9 =ffffed100d9c630a R10=ffff88806ce31853 R11=0000000000000001 R12=ffffffff86644c50 R13=1ffffffff0b80fc7 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff84bf3dae RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e53be000 00000000 00000000 LDT=0000 fffffe5000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ffe7d04ee68 CR3=000000000d786000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000 XMM02=00000000000000004187711400000000 XMM03=0000ff00000000000000000000000000 XMM04=732f6c61636f6c2f7273752f3d485441 XMM05=622f6c61636f6c2f7273752f3a6e6962 XMM06=73752f3a6e6962732f7273752f3a6e69 XMM07=6e69622f3a6e6962732f3a6e69622f72 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=000000000146f8ef RBX=0000000000000001 RCX=ffffffff84bf50b7 RDX=0000000000000000 RSI=0000000000000000 RDI=ffffffff814c9680 RBP=dffffc0000000000 RSP=ffff8880096efe58 R8 =0000000000000001 R9 =ffffed100d9e630a R10=ffff88806cf31853 R11=0000000000000001 R12=ffffffff86644c50 R13=1ffff110012ddfd2 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff84bf3dae RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff8880e54be000 00000000 00000000 LDT=0000 fffffe2c00000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f0044f70000 CR3=000000000d313000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=656a626f206465636e6572656665726e XMM02=2934383120657a697328203030643964 XMM03=3220646970202c22312e726f74756365 XMM04=3030202020200a2e2e2e2e2e2e2e2e2e XMM05=30203030203030203030203030203030 XMM06=3030203030203230202020200a3a2973 XMM07=6d75642078656820200a303539373533 XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000