syzkaller login: [ 43.483932] sshd (244) used greatest stack depth: 24744 bytes left Warning: Permanently added '[localhost]:13388' (ECDSA) to the list of known hosts. 2022/09/13 17:24:34 fuzzer started 2022/09/13 17:24:35 dialing manager at localhost:36597 [ 45.644218] cgroup: Unknown subsys name 'net' [ 45.725351] cgroup: Unknown subsys name 'rlimit' 2022/09/13 17:24:49 syscalls: 2215 2022/09/13 17:24:49 code coverage: enabled 2022/09/13 17:24:49 comparison tracing: enabled 2022/09/13 17:24:49 extra coverage: enabled 2022/09/13 17:24:49 setuid sandbox: enabled 2022/09/13 17:24:49 namespace sandbox: enabled 2022/09/13 17:24:49 Android sandbox: enabled 2022/09/13 17:24:49 fault injection: enabled 2022/09/13 17:24:49 leak checking: enabled 2022/09/13 17:24:49 net packet injection: enabled 2022/09/13 17:24:49 net device setup: enabled 2022/09/13 17:24:49 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2022/09/13 17:24:49 devlink PCI setup: PCI device 0000:00:10.0 is not available 2022/09/13 17:24:49 USB emulation: enabled 2022/09/13 17:24:49 hci packet injection: enabled 2022/09/13 17:24:49 wifi device emulation: failed to parse kernel version (6.0.0-rc5-next-20220913) 2022/09/13 17:24:49 802.15.4 emulation: enabled 2022/09/13 17:24:49 fetching corpus: 0, signal 0/2000 (executing program) 2022/09/13 17:24:49 fetching corpus: 39, signal 21022/24748 (executing program) 2022/09/13 17:24:49 fetching corpus: 89, signal 40356/45516 (executing program) 2022/09/13 17:24:50 fetching corpus: 139, signal 61392/67650 (executing program) 2022/09/13 17:24:50 fetching corpus: 189, signal 68927/76457 (executing program) 2022/09/13 17:24:50 fetching corpus: 239, signal 74378/83188 (executing program) 2022/09/13 17:24:50 fetching corpus: 289, signal 79308/89296 (executing program) 2022/09/13 17:24:50 fetching corpus: 339, signal 85564/96588 (executing program) 2022/09/13 17:24:50 fetching corpus: 389, signal 88732/100904 (executing program) 2022/09/13 17:24:50 fetching corpus: 439, signal 94932/107960 (executing program) 2022/09/13 17:24:51 fetching corpus: 489, signal 98645/112657 (executing program) 2022/09/13 17:24:51 fetching corpus: 539, signal 101648/116691 (executing program) 2022/09/13 17:24:51 fetching corpus: 589, signal 107066/122839 (executing program) 2022/09/13 17:24:51 fetching corpus: 639, signal 110599/127219 (executing program) 2022/09/13 17:24:51 fetching corpus: 689, signal 113436/130967 (executing program) 2022/09/13 17:24:51 fetching corpus: 739, signal 115797/134248 (executing program) 2022/09/13 17:24:52 fetching corpus: 789, signal 118844/138013 (executing program) 2022/09/13 17:24:52 fetching corpus: 839, signal 121983/141845 (executing program) 2022/09/13 17:24:52 fetching corpus: 889, signal 124260/144900 (executing program) 2022/09/13 17:24:52 fetching corpus: 939, signal 127282/148548 (executing program) 2022/09/13 17:24:52 fetching corpus: 989, signal 130254/152093 (executing program) 2022/09/13 17:24:52 fetching corpus: 1039, signal 133346/155719 (executing program) 2022/09/13 17:24:52 fetching corpus: 1089, signal 135084/158158 (executing program) 2022/09/13 17:24:53 fetching corpus: 1139, signal 137629/161279 (executing program) 2022/09/13 17:24:53 fetching corpus: 1189, signal 139612/163900 (executing program) 2022/09/13 17:24:53 fetching corpus: 1239, signal 142762/167381 (executing program) 2022/09/13 17:24:53 fetching corpus: 1289, signal 144625/169816 (executing program) 2022/09/13 17:24:53 fetching corpus: 1339, signal 146401/172166 (executing program) 2022/09/13 17:24:53 fetching corpus: 1389, signal 148384/174714 (executing program) 2022/09/13 17:24:53 fetching corpus: 1439, signal 150456/177256 (executing program) 2022/09/13 17:24:54 fetching corpus: 1489, signal 151886/179278 (executing program) 2022/09/13 17:24:54 fetching corpus: 1539, signal 153062/181051 (executing program) 2022/09/13 17:24:54 fetching corpus: 1589, signal 154846/183320 (executing program) 2022/09/13 17:24:54 fetching corpus: 1639, signal 156791/185639 (executing program) 2022/09/13 17:24:54 fetching corpus: 1688, signal 158006/187377 (executing program) 2022/09/13 17:24:54 fetching corpus: 1737, signal 159564/189364 (executing program) 2022/09/13 17:24:54 fetching corpus: 1787, signal 160884/191133 (executing program) 2022/09/13 17:24:54 fetching corpus: 1837, signal 162070/192830 (executing program) 2022/09/13 17:24:54 fetching corpus: 1887, signal 163165/194394 (executing program) 2022/09/13 17:24:55 fetching corpus: 1937, signal 164365/196012 (executing program) 2022/09/13 17:24:55 fetching corpus: 1987, signal 166620/198344 (executing program) 2022/09/13 17:24:55 fetching corpus: 2037, signal 167497/199727 (executing program) 2022/09/13 17:24:55 fetching corpus: 2087, signal 168405/201117 (executing program) 2022/09/13 17:24:55 fetching corpus: 2137, signal 170092/202990 (executing program) 2022/09/13 17:24:55 fetching corpus: 2186, signal 171690/204815 (executing program) 2022/09/13 17:24:55 fetching corpus: 2236, signal 172925/206398 (executing program) 2022/09/13 17:24:56 fetching corpus: 2286, signal 174226/207988 (executing program) 2022/09/13 17:24:56 fetching corpus: 2336, signal 175522/209527 (executing program) 2022/09/13 17:24:56 fetching corpus: 2386, signal 177027/211164 (executing program) 2022/09/13 17:24:56 fetching corpus: 2436, signal 178942/213133 (executing program) 2022/09/13 17:24:56 fetching corpus: 2486, signal 180239/214641 (executing program) 2022/09/13 17:24:56 fetching corpus: 2536, signal 181416/216035 (executing program) 2022/09/13 17:24:57 fetching corpus: 2586, signal 182809/217536 (executing program) 2022/09/13 17:24:57 fetching corpus: 2635, signal 183553/218697 (executing program) 2022/09/13 17:24:57 fetching corpus: 2685, signal 185049/220290 (executing program) 2022/09/13 17:24:57 fetching corpus: 2735, signal 186223/221605 (executing program) 2022/09/13 17:24:57 fetching corpus: 2785, signal 187222/222787 (executing program) 2022/09/13 17:24:57 fetching corpus: 2835, signal 188309/224050 (executing program) 2022/09/13 17:24:57 fetching corpus: 2885, signal 189930/225553 (executing program) 2022/09/13 17:24:58 fetching corpus: 2935, signal 190831/226604 (executing program) 2022/09/13 17:24:58 fetching corpus: 2985, signal 191745/227687 (executing program) 2022/09/13 17:24:58 fetching corpus: 3035, signal 192680/228778 (executing program) 2022/09/13 17:24:58 fetching corpus: 3085, signal 193854/230004 (executing program) 2022/09/13 17:24:58 fetching corpus: 3135, signal 194825/231046 (executing program) 2022/09/13 17:24:58 fetching corpus: 3185, signal 196055/232168 (executing program) 2022/09/13 17:24:58 fetching corpus: 3235, signal 196937/233164 (executing program) 2022/09/13 17:24:59 fetching corpus: 3285, signal 198134/234352 (executing program) 2022/09/13 17:24:59 fetching corpus: 3335, signal 199007/235334 (executing program) 2022/09/13 17:24:59 fetching corpus: 3385, signal 199853/236248 (executing program) 2022/09/13 17:24:59 fetching corpus: 3435, signal 200794/237223 (executing program) 2022/09/13 17:24:59 fetching corpus: 3485, signal 201712/238229 (executing program) 2022/09/13 17:24:59 fetching corpus: 3534, signal 202519/239097 (executing program) 2022/09/13 17:24:59 fetching corpus: 3584, signal 203250/239957 (executing program) 2022/09/13 17:25:00 fetching corpus: 3634, signal 204217/240910 (executing program) 2022/09/13 17:25:00 fetching corpus: 3684, signal 205035/241749 (executing program) 2022/09/13 17:25:00 fetching corpus: 3734, signal 205947/242645 (executing program) 2022/09/13 17:25:00 fetching corpus: 3784, signal 207347/243729 (executing program) 2022/09/13 17:25:00 fetching corpus: 3834, signal 207940/244481 (executing program) 2022/09/13 17:25:00 fetching corpus: 3884, signal 208566/245244 (executing program) 2022/09/13 17:25:00 fetching corpus: 3934, signal 210138/246293 (executing program) 2022/09/13 17:25:01 fetching corpus: 3984, signal 212274/247603 (executing program) 2022/09/13 17:25:01 fetching corpus: 4034, signal 212927/248294 (executing program) 2022/09/13 17:25:01 fetching corpus: 4084, signal 213983/249093 (executing program) 2022/09/13 17:25:01 fetching corpus: 4134, signal 215241/250030 (executing program) 2022/09/13 17:25:01 fetching corpus: 4184, signal 216096/250770 (executing program) 2022/09/13 17:25:01 fetching corpus: 4234, signal 217326/251640 (executing program) 2022/09/13 17:25:01 fetching corpus: 4284, signal 217798/252239 (executing program) 2022/09/13 17:25:02 fetching corpus: 4334, signal 218638/252955 (executing program) 2022/09/13 17:25:02 fetching corpus: 4384, signal 220228/253920 (executing program) 2022/09/13 17:25:02 fetching corpus: 4433, signal 221121/254568 (executing program) 2022/09/13 17:25:02 fetching corpus: 4483, signal 221889/255182 (executing program) 2022/09/13 17:25:02 fetching corpus: 4533, signal 222705/255830 (executing program) 2022/09/13 17:25:02 fetching corpus: 4583, signal 223398/256446 (executing program) 2022/09/13 17:25:03 fetching corpus: 4633, signal 224093/257045 (executing program) 2022/09/13 17:25:03 fetching corpus: 4683, signal 224908/257687 (executing program) 2022/09/13 17:25:03 fetching corpus: 4733, signal 225594/258261 (executing program) 2022/09/13 17:25:03 fetching corpus: 4783, signal 226047/258740 (executing program) 2022/09/13 17:25:03 fetching corpus: 4833, signal 226538/259211 (executing program) 2022/09/13 17:25:03 fetching corpus: 4882, signal 226946/259667 (executing program) 2022/09/13 17:25:03 fetching corpus: 4932, signal 227826/260167 (executing program) 2022/09/13 17:25:04 fetching corpus: 4982, signal 228550/260654 (executing program) 2022/09/13 17:25:04 fetching corpus: 5032, signal 229423/261189 (executing program) 2022/09/13 17:25:04 fetching corpus: 5082, signal 230182/261746 (executing program) 2022/09/13 17:25:04 fetching corpus: 5132, signal 230713/262208 (executing program) 2022/09/13 17:25:04 fetching corpus: 5182, signal 231447/262700 (executing program) 2022/09/13 17:25:04 fetching corpus: 5232, signal 232092/263142 (executing program) 2022/09/13 17:25:05 fetching corpus: 5282, signal 232735/263571 (executing program) 2022/09/13 17:25:05 fetching corpus: 5331, signal 233338/264017 (executing program) 2022/09/13 17:25:05 fetching corpus: 5381, signal 233986/264435 (executing program) 2022/09/13 17:25:05 fetching corpus: 5431, signal 234446/264810 (executing program) 2022/09/13 17:25:05 fetching corpus: 5481, signal 235372/265298 (executing program) 2022/09/13 17:25:05 fetching corpus: 5531, signal 235863/265677 (executing program) 2022/09/13 17:25:05 fetching corpus: 5581, signal 236559/266048 (executing program) 2022/09/13 17:25:05 fetching corpus: 5631, signal 236995/266372 (executing program) 2022/09/13 17:25:06 fetching corpus: 5681, signal 237411/266712 (executing program) 2022/09/13 17:25:06 fetching corpus: 5731, signal 237888/267057 (executing program) 2022/09/13 17:25:06 fetching corpus: 5781, signal 238505/267415 (executing program) 2022/09/13 17:25:06 fetching corpus: 5831, signal 239114/267740 (executing program) 2022/09/13 17:25:06 fetching corpus: 5881, signal 239812/268088 (executing program) 2022/09/13 17:25:06 fetching corpus: 5931, signal 240612/268424 (executing program) 2022/09/13 17:25:06 fetching corpus: 5981, signal 241169/268720 (executing program) 2022/09/13 17:25:07 fetching corpus: 6031, signal 242214/269223 (executing program) 2022/09/13 17:25:07 fetching corpus: 6081, signal 243097/269516 (executing program) 2022/09/13 17:25:07 fetching corpus: 6131, signal 243628/269781 (executing program) 2022/09/13 17:25:07 fetching corpus: 6181, signal 244488/270078 (executing program) 2022/09/13 17:25:07 fetching corpus: 6231, signal 244941/270329 (executing program) 2022/09/13 17:25:07 fetching corpus: 6281, signal 245454/270575 (executing program) 2022/09/13 17:25:08 fetching corpus: 6331, signal 245862/270799 (executing program) 2022/09/13 17:25:08 fetching corpus: 6381, signal 246203/271020 (executing program) 2022/09/13 17:25:08 fetching corpus: 6431, signal 246698/271230 (executing program) 2022/09/13 17:25:08 fetching corpus: 6481, signal 247188/271426 (executing program) 2022/09/13 17:25:08 fetching corpus: 6531, signal 247618/271610 (executing program) 2022/09/13 17:25:08 fetching corpus: 6581, signal 248143/271723 (executing program) 2022/09/13 17:25:08 fetching corpus: 6631, signal 248401/271733 (executing program) 2022/09/13 17:25:08 fetching corpus: 6681, signal 248957/271788 (executing program) 2022/09/13 17:25:09 fetching corpus: 6731, signal 249374/271792 (executing program) 2022/09/13 17:25:09 fetching corpus: 6781, signal 250259/271813 (executing program) 2022/09/13 17:25:09 fetching corpus: 6831, signal 250789/271837 (executing program) 2022/09/13 17:25:09 fetching corpus: 6881, signal 251255/271917 (executing program) 2022/09/13 17:25:09 fetching corpus: 6931, signal 251870/271920 (executing program) 2022/09/13 17:25:09 fetching corpus: 6981, signal 252403/271966 (executing program) 2022/09/13 17:25:09 fetching corpus: 7031, signal 253275/272028 (executing program) 2022/09/13 17:25:10 fetching corpus: 7081, signal 253686/272044 (executing program) 2022/09/13 17:25:10 fetching corpus: 7131, signal 254242/272048 (executing program) 2022/09/13 17:25:10 fetching corpus: 7181, signal 254616/272067 (executing program) 2022/09/13 17:25:10 fetching corpus: 7231, signal 255246/272067 (executing program) 2022/09/13 17:25:10 fetching corpus: 7281, signal 255709/272098 (executing program) 2022/09/13 17:25:10 fetching corpus: 7331, signal 256254/272099 (executing program) 2022/09/13 17:25:10 fetching corpus: 7381, signal 256574/272115 (executing program) 2022/09/13 17:25:10 fetching corpus: 7431, signal 256939/272116 (executing program) 2022/09/13 17:25:11 fetching corpus: 7481, signal 257277/272121 (executing program) 2022/09/13 17:25:11 fetching corpus: 7531, signal 257547/272159 (executing program) 2022/09/13 17:25:11 fetching corpus: 7581, signal 258176/272171 (executing program) 2022/09/13 17:25:11 fetching corpus: 7631, signal 258581/272186 (executing program) 2022/09/13 17:25:11 fetching corpus: 7681, signal 258972/272204 (executing program) 2022/09/13 17:25:11 fetching corpus: 7731, signal 259567/272211 (executing program) 2022/09/13 17:25:11 fetching corpus: 7781, signal 260108/272216 (executing program) 2022/09/13 17:25:12 fetching corpus: 7831, signal 260766/272222 (executing program) 2022/09/13 17:25:12 fetching corpus: 7881, signal 261315/272226 (executing program) 2022/09/13 17:25:12 fetching corpus: 7931, signal 261794/272226 (executing program) 2022/09/13 17:25:12 fetching corpus: 7981, signal 262384/272226 (executing program) 2022/09/13 17:25:12 fetching corpus: 8031, signal 262815/272234 (executing program) 2022/09/13 17:25:12 fetching corpus: 8047, signal 262891/272234 (executing program) 2022/09/13 17:25:12 fetching corpus: 8047, signal 262891/272234 (executing program) 2022/09/13 17:25:15 starting 8 fuzzer processes 17:25:15 executing program 0: shmat(0xffffffffffffffff, &(0x7f0000fed000/0x13000)=nil, 0x0) r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80000001}, 0x0, 0x7ff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f0000000040)=0x2) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x90c83, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='smaps_rollup\x00') perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x3, @perf_config_ext={0x0, 0x2000000000000000}, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) finit_module(r0, &(0x7f0000000140)='/dev/loop-control\x00', 0x3) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) openat2(r1, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={0x200, 0x21, 0x1b}, 0x18) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) mlock(&(0x7f0000ff5000/0x4000)=nil, 0x4000) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3305) mremap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000, 0x3, &(0x7f0000ffa000/0x2000)=nil) 17:25:15 executing program 1: futex(&(0x7f0000000000)=0x1, 0x9, 0x0, &(0x7f0000000040)={0x0, 0x3938700}, &(0x7f0000000080)=0x1, 0x0) clock_getres(0x0, &(0x7f00000000c0)) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, 0x0) ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0xc018480b, &(0x7f0000000140)={0x1, 0x3, 0x3, 0x0, 0x1f, 0x1000}) sched_rr_get_interval(0x0, &(0x7f0000000180)) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) futex(&(0x7f00000001c0)=0x1, 0xc, 0x1, &(0x7f0000000240)={r0, r1+10000000}, &(0x7f0000000280)=0x1, 0x0) clock_gettime(0x1, &(0x7f00000002c0)) clock_getres(0x3, &(0x7f0000000300)) ioctl$HIDIOCSFLAG(0xffffffffffffffff, 0x4004480f, &(0x7f0000000340)=0x2) futex(&(0x7f0000000380), 0xb, 0x1, &(0x7f00000003c0)={0x0, 0x3938700}, &(0x7f0000000400)=0xb4b, 0x2) mq_timedsend(0xffffffffffffffff, &(0x7f0000000440), 0x0, 0x80000001, &(0x7f0000000540)={0x77359400}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000580), &(0x7f00000005c0)=0x14) mq_notify(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x8, 0x4}) clock_gettime(0x0, &(0x7f0000000680)={0x0, 0x0}) futex(&(0x7f0000000640), 0x100, 0x2, &(0x7f00000006c0)={r2, r3+10000000}, &(0x7f0000000700)=0x2, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x20, r4, 0x408, 0x70bd26, 0x0, {}, [@ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x9}, @ETHTOOL_A_CHANNELS_HEADER={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x40048c0}, 0x4080844) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000880)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x10000}}, './file0\x00'}) ioctl$HIDIOCGUSAGE(r5, 0xc018480b, &(0x7f00000008c0)={0x2, 0x3, 0x20, 0x3c, 0x6}) 17:25:15 executing program 2: sysinfo(&(0x7f0000000000)=""/227) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x3, &(0x7f0000000100)=[{0x2af, 0x0, 0x2, 0x40}, {0x20, 0x59, 0x6c, 0x3f}, {0xd04, 0xb7, 0x4, 0x80000000}]}) 17:25:15 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x48, 0x0, &(0x7f0000000600)) [ 86.077463] audit: type=1400 audit(1663089915.655:6): avc: denied { execmem } for pid=286 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 17:25:15 executing program 4: r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) sendfile(r2, r2, 0x0, 0x100000) readv(r2, &(0x7f00000003c0)=[{&(0x7f0000000340)=""/75, 0x4b}], 0x1) ioctl$RTC_EPOCH_SET(r2, 0x4008700e, 0xff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000140)={0x1, 0x1, 0x0, 'queue1\x00', 0x1000}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000000200)={0x7, 0x0, 0x40}) getpid() syncfs(r1) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000100)={0x0, 0x4, 0x7fff}) 17:25:15 executing program 7: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="02000000010000000000000002000000", @ANYRES32, @ANYBLOB="0200", @ANYRES32, @ANYBLOB="02000400", @ANYBLOB], 0x3c, 0x0) 17:25:15 executing program 5: mq_unlink(&(0x7f0000000000)='/(\x00') mq_unlink(&(0x7f00000000c0)='.,,%\x00') mq_unlink(0x0) mq_unlink(0x0) 17:25:15 executing program 6: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='net/icmp\x00') preadv(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/46, 0x2e}], 0x1, 0x1, 0x0) [ 87.348387] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 87.353389] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 87.360600] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 87.368405] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 87.390237] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 87.396920] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 87.405767] Bluetooth: hci0: HCI_REQ-0x0c1a [ 87.461301] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 87.464954] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 87.466478] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 87.478944] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 87.481427] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 87.483678] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 87.491290] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 87.493079] Bluetooth: hci2: HCI_REQ-0x0c1a [ 87.495267] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 87.502823] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 87.512421] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 87.515212] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 87.516797] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 87.517970] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 87.519571] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 87.521307] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 87.522468] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 87.523526] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 87.524783] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 87.526190] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 87.528481] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 87.531797] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 87.533151] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 87.534508] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 87.535884] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 87.537266] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 87.538985] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 87.540107] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 87.542130] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 87.545938] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 87.547822] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 87.548977] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 87.553401] Bluetooth: hci3: HCI_REQ-0x0c1a [ 87.554950] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 87.555389] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 87.556334] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 87.558834] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 87.560028] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 87.565829] Bluetooth: hci4: HCI_REQ-0x0c1a [ 87.568938] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 87.568997] Bluetooth: hci5: HCI_REQ-0x0c1a [ 87.571721] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 87.575346] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 87.584263] Bluetooth: hci1: HCI_REQ-0x0c1a [ 87.597324] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 87.598859] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 87.603005] Bluetooth: hci6: HCI_REQ-0x0c1a [ 87.609871] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 87.614529] Bluetooth: hci7: HCI_REQ-0x0c1a [ 89.422035] Bluetooth: hci0: command 0x0409 tx timeout [ 89.549697] Bluetooth: hci2: command 0x0409 tx timeout [ 89.613708] Bluetooth: hci6: command 0x0409 tx timeout [ 89.614130] Bluetooth: hci4: command 0x0409 tx timeout [ 89.614522] Bluetooth: hci3: command 0x0409 tx timeout [ 89.614661] Bluetooth: hci1: command 0x0409 tx timeout [ 89.616766] Bluetooth: hci5: command 0x0409 tx timeout [ 89.677685] Bluetooth: hci7: command 0x0409 tx timeout [ 91.470723] Bluetooth: hci0: command 0x041b tx timeout [ 91.598769] Bluetooth: hci2: command 0x041b tx timeout [ 91.661747] Bluetooth: hci5: command 0x041b tx timeout [ 91.662689] Bluetooth: hci1: command 0x041b tx timeout [ 91.662694] Bluetooth: hci3: command 0x041b tx timeout [ 91.662725] Bluetooth: hci4: command 0x041b tx timeout [ 91.664258] Bluetooth: hci6: command 0x041b tx timeout [ 91.725688] Bluetooth: hci7: command 0x041b tx timeout [ 93.517676] Bluetooth: hci0: command 0x040f tx timeout [ 93.645653] Bluetooth: hci2: command 0x040f tx timeout [ 93.709662] Bluetooth: hci1: command 0x040f tx timeout [ 93.710116] Bluetooth: hci3: command 0x040f tx timeout [ 93.710686] Bluetooth: hci5: command 0x040f tx timeout [ 93.710691] Bluetooth: hci6: command 0x040f tx timeout [ 93.711587] Bluetooth: hci4: command 0x040f tx timeout [ 93.773661] Bluetooth: hci7: command 0x040f tx timeout [ 95.566681] Bluetooth: hci0: command 0x0419 tx timeout [ 95.694673] Bluetooth: hci2: command 0x0419 tx timeout [ 95.757727] Bluetooth: hci4: command 0x0419 tx timeout [ 95.757731] Bluetooth: hci6: command 0x0419 tx timeout [ 95.757805] Bluetooth: hci5: command 0x0419 tx timeout [ 95.758374] Bluetooth: hci3: command 0x0419 tx timeout [ 95.762125] Bluetooth: hci1: command 0x0419 tx timeout [ 95.821780] Bluetooth: hci7: command 0x0419 tx timeout 17:26:14 executing program 5: mq_unlink(&(0x7f0000000000)='/(\x00') mq_unlink(&(0x7f00000000c0)='.,,%\x00') mq_unlink(0x0) mq_unlink(0x0) 17:26:14 executing program 5: mq_unlink(&(0x7f0000000000)='/(\x00') mq_unlink(&(0x7f00000000c0)='.,,%\x00') mq_unlink(0x0) mq_unlink(0x0) 17:26:14 executing program 5: mq_unlink(&(0x7f0000000000)='/(\x00') mq_unlink(&(0x7f00000000c0)='.,,%\x00') mq_unlink(0x0) mq_unlink(0x0) 17:26:14 executing program 5: quotactl(0x0, &(0x7f0000000200)='./file1\x00', 0x0, 0x0) 17:26:14 executing program 5: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000001300)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) write$selinux_attr(r0, &(0x7f0000000140)='system_u:object_r:auditd_log_t:s0\x00', 0x22) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@newsa={0xf0, 0x10, 0x0, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee00}, {@in6=@mcast1}, @in=@broadcast}}, 0xf0}}, 0x0) [ 145.011430] audit: type=1400 audit(1663089974.589:7): avc: denied { create } for pid=3826 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:auditd_log_t:s0 tclass=netlink_xfrm_socket permissive=1 [ 145.022563] audit: type=1400 audit(1663089974.600:8): avc: denied { write } for pid=3826 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:auditd_log_t:s0 tclass=netlink_xfrm_socket permissive=1 [ 145.024260] audit: type=1400 audit(1663089974.600:9): avc: denied { nlmsg_write } for pid=3826 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:auditd_log_t:s0 tclass=netlink_xfrm_socket permissive=1 17:26:14 executing program 5: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@dev, 0x0, 0x0, 0x2, 0xb, 0x200, 0x896}, 0x20) 17:26:14 executing program 5: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@dev, 0x0, 0x0, 0x2, 0xb, 0x200, 0x896}, 0x20) 17:26:14 executing program 5: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@dev, 0x0, 0x0, 0x2, 0xb, 0x200, 0x896}, 0x20) [ 145.922307] audit: type=1400 audit(1663089975.500:10): avc: denied { open } for pid=3884 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 145.925685] audit: type=1400 audit(1663089975.503:11): avc: denied { kernel } for pid=3884 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 145.938232] hrtimer: interrupt took 47590 ns [ 145.940798] ------------[ cut here ]------------ [ 145.940830] [ 145.940835] ====================================================== [ 145.940842] WARNING: possible circular locking dependency detected [ 145.940849] 6.0.0-rc5-next-20220913 #1 Not tainted [ 145.940861] ------------------------------------------------------ [ 145.940867] syz-executor.4/3886 is trying to acquire lock: [ 145.940879] ffffffff853fa878 ((console_sem).lock){-.-.}-{2:2}, at: down_trylock+0xe/0x70 [ 145.940945] [ 145.940945] but task is already holding lock: [ 145.940950] ffff88800eb48020 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_out+0x53b/0x18d0 [ 145.941003] [ 145.941003] which lock already depends on the new lock. [ 145.941003] [ 145.941009] [ 145.941009] the existing dependency chain (in reverse order) is: [ 145.941015] [ 145.941015] -> #3 (&ctx->lock){....}-{2:2}: [ 145.941042] _raw_spin_lock+0x2a/0x40 [ 145.941074] __perf_event_task_sched_out+0x53b/0x18d0 [ 145.941099] __schedule+0xedd/0x2470 [ 145.941119] schedule+0xda/0x1b0 [ 145.941137] exit_to_user_mode_prepare+0x114/0x1a0 [ 145.941177] syscall_exit_to_user_mode+0x19/0x40 [ 145.941212] do_syscall_64+0x48/0x90 [ 145.941238] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 145.941273] [ 145.941273] -> #2 (&rq->__lock){-.-.}-{2:2}: [ 145.941300] _raw_spin_lock_nested+0x30/0x40 [ 145.941330] raw_spin_rq_lock_nested+0x1e/0x30 [ 145.941355] task_fork_fair+0x63/0x4d0 [ 145.941388] sched_cgroup_fork+0x3d0/0x540 [ 145.941416] copy_process+0x3f9e/0x6df0 [ 145.941436] kernel_clone+0xe7/0x890 [ 145.941455] user_mode_thread+0xad/0xf0 [ 145.941476] rest_init+0x24/0x250 [ 145.941509] arch_call_rest_init+0xf/0x14 [ 145.941546] start_kernel+0x4c1/0x4e6 [ 145.941581] secondary_startup_64_no_verify+0xe0/0xeb [ 145.941608] [ 145.941608] -> #1 (&p->pi_lock){-.-.}-{2:2}: [ 145.941635] _raw_spin_lock_irqsave+0x39/0x60 [ 145.941666] try_to_wake_up+0xab/0x1920 [ 145.941692] up+0x75/0xb0 [ 145.941715] __up_console_sem+0x6e/0x80 [ 145.941746] console_unlock+0x46a/0x590 [ 145.941779] vt_ioctl+0x2822/0x2ca0 [ 145.941802] tty_ioctl+0x7c4/0x1700 [ 145.941824] __x64_sys_ioctl+0x19a/0x210 [ 145.941853] do_syscall_64+0x3b/0x90 [ 145.941879] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 145.941913] [ 145.941913] -> #0 ((console_sem).lock){-.-.}-{2:2}: [ 145.941941] __lock_acquire+0x2a02/0x5e70 [ 145.941974] lock_acquire+0x1a2/0x530 [ 145.942007] _raw_spin_lock_irqsave+0x39/0x60 [ 145.942037] down_trylock+0xe/0x70 [ 145.942062] __down_trylock_console_sem+0x3b/0xd0 [ 145.942095] vprintk_emit+0x16b/0x560 [ 145.942128] vprintk+0x84/0xa0 [ 145.942161] _printk+0xba/0xf1 [ 145.942210] report_bug.cold+0x72/0xab [ 145.942235] handle_bug+0x3c/0x70 [ 145.942260] exc_invalid_op+0x14/0x50 [ 145.942287] asm_exc_invalid_op+0x16/0x20 [ 145.942320] group_sched_out.part.0+0x2c7/0x460 [ 145.942341] ctx_sched_out+0x8f1/0xc10 [ 145.942360] __perf_event_task_sched_out+0x6d0/0x18d0 [ 145.942385] __schedule+0xedd/0x2470 [ 145.942404] schedule+0xda/0x1b0 [ 145.942422] exit_to_user_mode_prepare+0x114/0x1a0 [ 145.942461] syscall_exit_to_user_mode+0x19/0x40 [ 145.942496] do_syscall_64+0x48/0x90 [ 145.942522] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 145.942557] [ 145.942557] other info that might help us debug this: [ 145.942557] [ 145.942562] Chain exists of: [ 145.942562] (console_sem).lock --> &rq->__lock --> &ctx->lock [ 145.942562] [ 145.942592] Possible unsafe locking scenario: [ 145.942592] [ 145.942596] CPU0 CPU1 [ 145.942600] ---- ---- [ 145.942605] lock(&ctx->lock); [ 145.942616] lock(&rq->__lock); [ 145.942628] lock(&ctx->lock); [ 145.942641] lock((console_sem).lock); [ 145.942652] [ 145.942652] *** DEADLOCK *** [ 145.942652] [ 145.942656] 2 locks held by syz-executor.4/3886: [ 145.942670] #0: ffff88806cf37cd8 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x1cf/0x2470 [ 145.942721] #1: ffff88800eb48020 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_out+0x53b/0x18d0 [ 145.942776] [ 145.942776] stack backtrace: [ 145.942781] CPU: 1 PID: 3886 Comm: syz-executor.4 Not tainted 6.0.0-rc5-next-20220913 #1 [ 145.942807] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 145.942822] Call Trace: [ 145.942828] [ 145.942835] dump_stack_lvl+0x8b/0xb3 [ 145.942864] check_noncircular+0x263/0x2e0 [ 145.942898] ? format_decode+0x26c/0xb50 [ 145.942927] ? print_circular_bug+0x450/0x450 [ 145.942962] ? enable_ptr_key_workfn+0x20/0x20 [ 145.942989] ? __lockdep_reset_lock+0x180/0x180 [ 145.943024] ? format_decode+0x26c/0xb50 [ 145.943055] ? alloc_chain_hlocks+0x1ec/0x5a0 [ 145.943091] __lock_acquire+0x2a02/0x5e70 [ 145.943135] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 145.943181] lock_acquire+0x1a2/0x530 [ 145.943216] ? down_trylock+0xe/0x70 [ 145.943245] ? rcu_read_unlock+0x40/0x40 [ 145.943284] ? find_held_lock+0x2c/0x110 [ 145.943318] ? vprintk+0x84/0xa0 [ 145.943355] _raw_spin_lock_irqsave+0x39/0x60 [ 145.943386] ? down_trylock+0xe/0x70 [ 145.943414] down_trylock+0xe/0x70 [ 145.943441] ? vprintk+0x84/0xa0 [ 145.943476] __down_trylock_console_sem+0x3b/0xd0 [ 145.943511] vprintk_emit+0x16b/0x560 [ 145.943550] vprintk+0x84/0xa0 [ 145.943586] _printk+0xba/0xf1 [ 145.943622] ? record_print_text.cold+0x16/0x16 [ 145.943663] ? hrtimer_try_to_cancel+0x163/0x2c0 [ 145.943690] ? lock_downgrade+0x6d0/0x6d0 [ 145.943726] ? report_bug.cold+0x66/0xab [ 145.943755] ? group_sched_out.part.0+0x2c7/0x460 [ 145.943778] report_bug.cold+0x72/0xab [ 145.943808] handle_bug+0x3c/0x70 [ 145.943836] exc_invalid_op+0x14/0x50 [ 145.943865] asm_exc_invalid_op+0x16/0x20 [ 145.943900] RIP: 0010:group_sched_out.part.0+0x2c7/0x460 [ 145.943926] Code: 5e 41 5f e9 3b b7 ef ff e8 36 b7 ef ff 65 8b 1d ab 15 ac 7e 31 ff 89 de e8 d6 b3 ef ff 85 db 0f 84 8a 00 00 00 e8 19 b7 ef ff <0f> 0b e9 a5 fe ff ff e8 0d b7 ef ff 48 8d 7d 10 48 b8 00 00 00 00 [ 145.943948] RSP: 0018:ffff88804212fc48 EFLAGS: 00010006 [ 145.943966] RAX: 0000000040000002 RBX: 0000000000000000 RCX: 0000000000000000 [ 145.943981] RDX: ffff888018948000 RSI: ffffffff81566027 RDI: 0000000000000005 [ 145.943997] RBP: ffff888042a08000 R08: 0000000000000005 R09: 0000000000000001 [ 145.944012] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800eb48000 [ 145.944026] R13: ffff88806cf3d100 R14: ffffffff8547bfc0 R15: 0000000000000002 [ 145.944048] ? group_sched_out.part.0+0x2c7/0x460 [ 145.944075] ? group_sched_out.part.0+0x2c7/0x460 [ 145.944100] ctx_sched_out+0x8f1/0xc10 [ 145.944125] __perf_event_task_sched_out+0x6d0/0x18d0 [ 145.944156] ? lock_is_held_type+0xd7/0x130 [ 145.944194] ? __perf_cgroup_move+0x160/0x160 [ 145.944217] ? set_next_entity+0x304/0x550 [ 145.944254] ? update_curr+0x267/0x740 [ 145.944291] ? lock_is_held_type+0xd7/0x130 [ 145.944329] __schedule+0xedd/0x2470 [ 145.944357] ? io_schedule_timeout+0x150/0x150 [ 145.944387] schedule+0xda/0x1b0 [ 145.944410] exit_to_user_mode_prepare+0x114/0x1a0 [ 145.944452] syscall_exit_to_user_mode+0x19/0x40 [ 145.944490] do_syscall_64+0x48/0x90 [ 145.944519] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 145.944555] RIP: 0033:0x7ff6c075ab19 [ 145.944572] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 145.944594] RSP: 002b:00007ff6bdcd0188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 145.944616] RAX: 0000000000000003 RBX: 00007ff6c086df60 RCX: 00007ff6c075ab19 [ 145.944632] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000280 [ 145.944647] RBP: 00007ff6c07b4f6d R08: 000000000000000b R09: 0000000000000000 [ 145.944661] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 145.944676] R13: 00007ffd236baa3f R14: 00007ff6bdcd0300 R15: 0000000000022000 [ 145.944702] [ 146.061103] WARNING: CPU: 1 PID: 3886 at kernel/events/core.c:2309 group_sched_out.part.0+0x2c7/0x460 [ 146.062550] Modules linked in: [ 146.063054] CPU: 1 PID: 3886 Comm: syz-executor.4 Not tainted 6.0.0-rc5-next-20220913 #1 [ 146.064310] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 146.066022] RIP: 0010:group_sched_out.part.0+0x2c7/0x460 [ 146.066884] Code: 5e 41 5f e9 3b b7 ef ff e8 36 b7 ef ff 65 8b 1d ab 15 ac 7e 31 ff 89 de e8 d6 b3 ef ff 85 db 0f 84 8a 00 00 00 e8 19 b7 ef ff <0f> 0b e9 a5 fe ff ff e8 0d b7 ef ff 48 8d 7d 10 48 b8 00 00 00 00 [ 146.069662] RSP: 0018:ffff88804212fc48 EFLAGS: 00010006 [ 146.070499] RAX: 0000000040000002 RBX: 0000000000000000 RCX: 0000000000000000 [ 146.071585] RDX: ffff888018948000 RSI: ffffffff81566027 RDI: 0000000000000005 [ 146.072670] RBP: ffff888042a08000 R08: 0000000000000005 R09: 0000000000000001 [ 146.073746] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800eb48000 [ 146.074812] R13: ffff88806cf3d100 R14: ffffffff8547bfc0 R15: 0000000000000002 [ 146.075900] FS: 00007ff6bdcd0700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 [ 146.077120] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 146.078002] CR2: 00007ffe27251ff8 CR3: 0000000041906000 CR4: 0000000000350ee0 [ 146.079124] Call Trace: [ 146.079526] [ 146.079889] ctx_sched_out+0x8f1/0xc10 [ 146.080511] __perf_event_task_sched_out+0x6d0/0x18d0 [ 146.081319] ? lock_is_held_type+0xd7/0x130 [ 146.081996] ? __perf_cgroup_move+0x160/0x160 [ 146.082705] ? set_next_entity+0x304/0x550 [ 146.083376] ? update_curr+0x267/0x740 [ 146.083996] ? lock_is_held_type+0xd7/0x130 [ 146.084680] __schedule+0xedd/0x2470 [ 146.085273] ? io_schedule_timeout+0x150/0x150 [ 146.085997] schedule+0xda/0x1b0 [ 146.086528] exit_to_user_mode_prepare+0x114/0x1a0 [ 146.087311] syscall_exit_to_user_mode+0x19/0x40 [ 146.088063] do_syscall_64+0x48/0x90 [ 146.088647] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 146.089453] RIP: 0033:0x7ff6c075ab19 [ 146.090032] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 146.092790] RSP: 002b:00007ff6bdcd0188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 146.093934] RAX: 0000000000000003 RBX: 00007ff6c086df60 RCX: 00007ff6c075ab19 [ 146.095009] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000280 [ 146.096060] RBP: 00007ff6c07b4f6d R08: 000000000000000b R09: 0000000000000000 [ 146.097117] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 146.098167] R13: 00007ffd236baa3f R14: 00007ff6bdcd0300 R15: 0000000000022000 [ 146.099250] [ 146.099608] irq event stamp: 1254 [ 146.100125] hardirqs last enabled at (1253): [] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 146.101590] hardirqs last disabled at (1254): [] __schedule+0x1225/0x2470 [ 146.102846] softirqs last enabled at (1232): [] __irq_exit_rcu+0x11b/0x180 [ 146.104200] softirqs last disabled at (623): [] __irq_exit_rcu+0x11b/0x180 [ 146.105555] ---[ end trace 0000000000000000 ]--- [ 149.174898] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 149.177496] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 149.180045] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 149.185129] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 149.187527] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 149.189738] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 149.194122] Bluetooth: hci3: HCI_REQ-0x0c1a [ 151.053706] Bluetooth: hci0: Opcode 0x c03 failed: -110 [ 151.117642] Bluetooth: hci1: Opcode 0x c03 failed: -110 [ 151.181662] Bluetooth: hci5: Opcode 0x c03 failed: -110 [ 151.182587] Bluetooth: hci4: Opcode 0x c03 failed: -110 [ 151.245674] Bluetooth: hci6: Opcode 0x c03 failed: -110 [ 151.246592] Bluetooth: hci3: command 0x0409 tx timeout [ 153.293753] Bluetooth: hci3: command 0x041b tx timeout [ 155.341677] Bluetooth: hci0: Opcode 0x c03 failed: -110 [ 155.342672] Bluetooth: hci3: command 0x040f tx timeout [ 155.533648] Bluetooth: hci1: Opcode 0x c03 failed: -110 [ 155.725645] Bluetooth: hci6: Opcode 0x c03 failed: -110 [ 155.725790] Bluetooth: hci4: Opcode 0x c03 failed: -110 [ 155.726594] Bluetooth: hci5: Opcode 0x c03 failed: -110 VM DIAGNOSIS: 17:26:15 Registers: info registers vcpu 0 RAX=0000000080000000 RBX=ffff8880202a7bf8 RCX=0000000000000000 RDX=1ffff11004054f83 RSI=ffffffff8180e65e RDI=ffff8880202a7c18 RBP=0000000000000000 RSP=ffff8880202a7b20 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000001 R12=0000000000000040 R13=ffff88801b463608 R14=ffff8880202a7c30 R15=0000000000000040 RIP=ffffffff81461747 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f10e60428c0 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f0c2bc95310 CR3=0000000041b76000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM02=0000000000000000 0000000000000000 00000000000000ff 0000000000ff0000 YMM03=0000000000000000 0000000000000000 000000000f000000 00000034706f6f6c YMM04=0000000000000000 0000000000000000 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f YMM05=0000000000000000 0000000000000000 ffffffffffff0000 0000000000000000 YMM06=0000000000000000 0000000000000000 0000000000006561 6124242f6867632f YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM08=0000000000000000 0000000000000000 732f636f72702f00 6b63616d7300632e YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 RAX=0000000000000038 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff822b25c1 RDI=ffffffff8763fae0 RBP=ffffffff8763faa0 RSP=ffff88804212f698 R8 =0000000000000001 R9 =000000000000000a R10=0000000000000038 R11=0000000000000001 R12=0000000000000038 R13=ffffffff8763faa0 R14=0000000000000010 R15=ffffffff822b25b0 RIP=ffffffff822b2619 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007ff6bdcd0700 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ffe27251ff8 CR3=0000000041906000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 2525252525252525 2525252525252525 YMM01=0000000000000000 0000000000000000 0000000000000000 0000ffffffffffff YMM02=0000000000000000 0000000000000000 0000000000000000 0000ffffffffffff YMM03=0000000000000000 0000000000000000 0000000000000000 0000ff00000000ff YMM04=0000000000000000 0000000000000000 2f2f2f2f2f2f2f2f 2f2f2f2f2f2f2f2f YMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM08=0000000000000000 0000000000000000 676f6c206d6f7473 7563000000000000 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000