Debian GNU/Linux 11 syzkaller ttyS0 Warning: Permanently added '[localhost]:46470' (ECDSA) to the list of known hosts. 2022/10/06 10:58:36 fuzzer started 2022/10/06 10:58:36 dialing manager at localhost:37161 syzkaller login: [ 36.464150] cgroup: Unknown subsys name 'net' [ 36.537069] cgroup: Unknown subsys name 'rlimit' 2022/10/06 10:58:52 syscalls: 2215 2022/10/06 10:58:52 code coverage: enabled 2022/10/06 10:58:52 comparison tracing: enabled 2022/10/06 10:58:52 extra coverage: enabled 2022/10/06 10:58:52 setuid sandbox: enabled 2022/10/06 10:58:52 namespace sandbox: enabled 2022/10/06 10:58:52 Android sandbox: enabled 2022/10/06 10:58:52 fault injection: enabled 2022/10/06 10:58:52 leak checking: enabled 2022/10/06 10:58:52 net packet injection: enabled 2022/10/06 10:58:52 net device setup: enabled 2022/10/06 10:58:52 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2022/10/06 10:58:52 devlink PCI setup: PCI device 0000:00:10.0 is not available 2022/10/06 10:58:52 USB emulation: enabled 2022/10/06 10:58:52 hci packet injection: enabled 2022/10/06 10:58:52 wifi device emulation: failed to parse kernel version (6.0.0-next-20221006) 2022/10/06 10:58:52 802.15.4 emulation: enabled 2022/10/06 10:58:52 fetching corpus: 0, signal 0/2000 (executing program) 2022/10/06 10:58:52 fetching corpus: 30, signal 15985/19235 (executing program) 2022/10/06 10:58:52 fetching corpus: 80, signal 29323/33284 (executing program) 2022/10/06 10:58:53 fetching corpus: 129, signal 37401/41954 (executing program) 2022/10/06 10:58:53 fetching corpus: 179, signal 47761/52315 (executing program) 2022/10/06 10:58:53 fetching corpus: 229, signal 52921/57617 (executing program) 2022/10/06 10:58:53 fetching corpus: 279, signal 58927/63433 (executing program) 2022/10/06 10:58:53 fetching corpus: 328, signal 61991/66547 (executing program) 2022/10/06 10:58:53 fetching corpus: 378, signal 64826/69341 (executing program) 2022/10/06 10:58:53 fetching corpus: 428, signal 68479/72660 (executing program) 2022/10/06 10:58:53 fetching corpus: 478, signal 70585/74604 (executing program) 2022/10/06 10:58:54 fetching corpus: 528, signal 72833/76640 (executing program) 2022/10/06 10:58:54 fetching corpus: 578, signal 74586/78203 (executing program) 2022/10/06 10:58:54 fetching corpus: 627, signal 76567/79829 (executing program) 2022/10/06 10:58:54 fetching corpus: 673, signal 80247/82496 (executing program) 2022/10/06 10:58:54 fetching corpus: 723, signal 81869/83687 (executing program) 2022/10/06 10:58:54 fetching corpus: 770, signal 83235/84680 (executing program) 2022/10/06 10:58:54 fetching corpus: 819, signal 84535/85622 (executing program) 2022/10/06 10:58:54 fetching corpus: 841, signal 85729/86352 (executing program) 2022/10/06 10:58:54 fetching corpus: 841, signal 85862/86510 (executing program) 2022/10/06 10:58:54 fetching corpus: 841, signal 85862/86545 (executing program) 2022/10/06 10:58:54 fetching corpus: 841, signal 85862/86618 (executing program) 2022/10/06 10:58:55 fetching corpus: 841, signal 85862/86655 (executing program) 2022/10/06 10:58:55 fetching corpus: 841, signal 85862/86702 (executing program) 2022/10/06 10:58:55 fetching corpus: 841, signal 85862/86742 (executing program) 2022/10/06 10:58:55 fetching corpus: 841, signal 85862/86769 (executing program) 2022/10/06 10:58:55 fetching corpus: 841, signal 85862/86815 (executing program) 2022/10/06 10:58:55 fetching corpus: 841, signal 85862/86849 (executing program) 2022/10/06 10:58:55 fetching corpus: 841, signal 85862/86883 (executing program) 2022/10/06 10:58:55 fetching corpus: 841, signal 85862/86920 (executing program) 2022/10/06 10:58:55 fetching corpus: 841, signal 85862/86958 (executing program) 2022/10/06 10:58:55 fetching corpus: 841, signal 85862/86997 (executing program) 2022/10/06 10:58:55 fetching corpus: 841, signal 85862/87033 (executing program) 2022/10/06 10:58:55 fetching corpus: 842, signal 85878/87086 (executing program) 2022/10/06 10:58:55 fetching corpus: 842, signal 85878/87125 (executing program) 2022/10/06 10:58:55 fetching corpus: 842, signal 85878/87171 (executing program) 2022/10/06 10:58:55 fetching corpus: 842, signal 85878/87214 (executing program) 2022/10/06 10:58:55 fetching corpus: 842, signal 85878/87252 (executing program) 2022/10/06 10:58:55 fetching corpus: 842, signal 85878/87289 (executing program) 2022/10/06 10:58:55 fetching corpus: 842, signal 85878/87342 (executing program) 2022/10/06 10:58:55 fetching corpus: 842, signal 85878/87389 (executing program) 2022/10/06 10:58:55 fetching corpus: 842, signal 85878/87424 (executing program) 2022/10/06 10:58:55 fetching corpus: 842, signal 85878/87462 (executing program) 2022/10/06 10:58:55 fetching corpus: 842, signal 85878/87489 (executing program) 2022/10/06 10:58:55 fetching corpus: 843, signal 85881/87492 (executing program) 2022/10/06 10:58:55 fetching corpus: 843, signal 85881/87492 (executing program) 2022/10/06 10:58:58 starting 8 fuzzer processes 10:58:58 executing program 0: r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$RNDCLEARPOOL(r0, 0x5206, 0x0) 10:58:58 executing program 1: r0 = epoll_create(0x7fffffff) r1 = socket$inet6(0xa, 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000000)) 10:58:58 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = fsopen(&(0x7f0000000040)='rpc_pipefs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x6, 0x0, 0x0, 0x0) 10:58:58 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r0, 0x0, 0x0) 10:58:58 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x2400) 10:58:58 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r0 = getpid() r1 = pidfd_open(r0, 0x0) pidfd_send_signal(r1, 0x0, 0x0, 0x0) 10:58:58 executing program 6: r0 = syz_io_uring_setup(0x443f, &(0x7f0000000200), &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x5, 0x0, @fd, 0x0, 0x0, 0xfffffd03}, 0x0) io_uring_enter(r0, 0x10001b, 0x0, 0x0, 0x0, 0x0) 10:58:58 executing program 7: syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x3, &(0x7f00000005c0)=[{&(0x7f0000000480)="b4", 0x1}, {&(0x7f00000004c0)='S', 0x1, 0xfffffffffffffffb}, {&(0x7f0000000540)='=', 0x1}], 0x0, 0x0) [ 58.032855] audit: type=1400 audit(1665053938.323:6): avc: denied { execmem } for pid=288 comm="syz-executor.3" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 59.318813] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 59.322062] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 59.324306] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 59.328022] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 59.330908] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 59.332366] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 59.338053] Bluetooth: hci0: HCI_REQ-0x0c1a [ 59.421887] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 59.423703] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 59.426457] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 59.429013] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 59.430335] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 59.432770] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 59.434031] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 59.434986] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 59.437079] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 59.438689] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 59.439656] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 59.440581] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 59.441918] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 59.443044] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 59.445997] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 59.447440] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 59.449397] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 59.450613] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 59.451795] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 59.453205] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 59.454994] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 59.456969] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 59.458481] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 59.459780] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 59.461875] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 59.462468] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 59.463123] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 59.464565] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 59.466103] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 59.467738] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 59.468763] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 59.470915] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 59.472881] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 59.474073] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 59.475522] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 59.480485] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 59.481742] Bluetooth: hci6: HCI_REQ-0x0c1a [ 59.481904] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 59.483789] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 59.484935] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 59.489678] Bluetooth: hci7: HCI_REQ-0x0c1a [ 59.490528] Bluetooth: hci3: HCI_REQ-0x0c1a [ 59.498778] Bluetooth: hci1: HCI_REQ-0x0c1a [ 59.500563] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 59.517535] Bluetooth: hci2: HCI_REQ-0x0c1a [ 59.523083] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 59.526061] Bluetooth: hci5: HCI_REQ-0x0c1a [ 59.526867] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 59.534996] Bluetooth: hci4: HCI_REQ-0x0c1a [ 61.408589] Bluetooth: hci0: command 0x0409 tx timeout [ 61.535328] Bluetooth: hci5: command 0x0409 tx timeout [ 61.535928] Bluetooth: hci7: command 0x0409 tx timeout [ 61.536411] Bluetooth: hci2: command 0x0409 tx timeout [ 61.536837] Bluetooth: hci1: command 0x0409 tx timeout [ 61.537284] Bluetooth: hci6: command 0x0409 tx timeout [ 61.537713] Bluetooth: hci3: command 0x0409 tx timeout [ 61.599295] Bluetooth: hci4: command 0x0409 tx timeout [ 63.455325] Bluetooth: hci0: command 0x041b tx timeout [ 63.583350] Bluetooth: hci3: command 0x041b tx timeout [ 63.583753] Bluetooth: hci6: command 0x041b tx timeout [ 63.584109] Bluetooth: hci1: command 0x041b tx timeout [ 63.584936] Bluetooth: hci2: command 0x041b tx timeout [ 63.585319] Bluetooth: hci7: command 0x041b tx timeout [ 63.585699] Bluetooth: hci5: command 0x041b tx timeout [ 63.647375] Bluetooth: hci4: command 0x041b tx timeout [ 65.503296] Bluetooth: hci0: command 0x040f tx timeout [ 65.631338] Bluetooth: hci5: command 0x040f tx timeout [ 65.631793] Bluetooth: hci7: command 0x040f tx timeout [ 65.632149] Bluetooth: hci2: command 0x040f tx timeout [ 65.633054] Bluetooth: hci1: command 0x040f tx timeout [ 65.633449] Bluetooth: hci6: command 0x040f tx timeout [ 65.633834] Bluetooth: hci3: command 0x040f tx timeout [ 65.696287] Bluetooth: hci4: command 0x040f tx timeout [ 67.551481] Bluetooth: hci0: command 0x0419 tx timeout [ 67.679388] Bluetooth: hci3: command 0x0419 tx timeout [ 67.680107] Bluetooth: hci6: command 0x0419 tx timeout [ 67.680846] Bluetooth: hci1: command 0x0419 tx timeout [ 67.681537] Bluetooth: hci2: command 0x0419 tx timeout [ 67.682222] Bluetooth: hci7: command 0x0419 tx timeout [ 67.683169] Bluetooth: hci5: command 0x0419 tx timeout [ 67.743324] Bluetooth: hci4: command 0x0419 tx timeout [ 115.615537] audit: type=1400 audit(1665053995.906:7): avc: denied { open } for pid=3627 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 115.616903] audit: type=1400 audit(1665053995.907:8): avc: denied { kernel } for pid=3627 comm="syz-executor.2" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 115.642738] ------------[ cut here ]------------ [ 115.642757] [ 115.642759] ====================================================== [ 115.642763] WARNING: possible circular locking dependency detected [ 115.642767] 6.0.0-next-20221006 #1 Not tainted [ 115.642773] ------------------------------------------------------ [ 115.642776] syz-executor.2/3628 is trying to acquire lock: [ 115.642782] ffffffff853fac98 ((console_sem).lock){....}-{2:2}, at: down_trylock+0xe/0x70 [ 115.642821] [ 115.642821] but task is already holding lock: [ 115.642823] ffff88800f0acc20 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_out+0x53b/0x18d0 [ 115.642850] [ 115.642850] which lock already depends on the new lock. [ 115.642850] [ 115.642852] [ 115.642852] the existing dependency chain (in reverse order) is: [ 115.642856] [ 115.642856] -> #3 (&ctx->lock){....}-{2:2}: [ 115.642869] _raw_spin_lock+0x2a/0x40 [ 115.642881] __perf_event_task_sched_out+0x53b/0x18d0 [ 115.642892] __schedule+0xedd/0x2470 [ 115.642907] schedule+0xda/0x1b0 [ 115.642922] exit_to_user_mode_prepare+0x114/0x1a0 [ 115.642933] syscall_exit_to_user_mode+0x19/0x40 [ 115.642947] do_syscall_64+0x48/0x90 [ 115.642957] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 115.642971] [ 115.642971] -> #2 (&rq->__lock){-.-.}-{2:2}: [ 115.642984] _raw_spin_lock_nested+0x30/0x40 [ 115.642996] raw_spin_rq_lock_nested+0x1e/0x30 [ 115.643009] task_fork_fair+0x63/0x4d0 [ 115.643025] sched_cgroup_fork+0x3d0/0x540 [ 115.643039] copy_process+0x4183/0x6e20 [ 115.643049] kernel_clone+0xe7/0x890 [ 115.643059] user_mode_thread+0xad/0xf0 [ 115.643069] rest_init+0x24/0x250 [ 115.643081] arch_call_rest_init+0xf/0x14 [ 115.643093] start_kernel+0x4c6/0x4eb [ 115.643103] secondary_startup_64_no_verify+0xe0/0xeb [ 115.643117] [ 115.643117] -> #1 (&p->pi_lock){-.-.}-{2:2}: [ 115.643131] _raw_spin_lock_irqsave+0x39/0x60 [ 115.643143] try_to_wake_up+0xab/0x1930 [ 115.643156] up+0x75/0xb0 [ 115.643171] __up_console_sem+0x6e/0x80 [ 115.643186] console_unlock+0x46a/0x590 [ 115.643202] do_con_write+0xc05/0x1d50 [ 115.643214] con_write+0x21/0x40 [ 115.643223] n_tty_write+0x4d4/0xfe0 [ 115.643239] file_tty_write.constprop.0+0x455/0x8a0 [ 115.643251] vfs_write+0x9c3/0xd90 [ 115.643268] ksys_write+0x127/0x250 [ 115.643283] do_syscall_64+0x3b/0x90 [ 115.643293] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 115.643307] [ 115.643307] -> #0 ((console_sem).lock){....}-{2:2}: [ 115.643321] __lock_acquire+0x2a02/0x5e70 [ 115.643337] lock_acquire+0x1a2/0x530 [ 115.643353] _raw_spin_lock_irqsave+0x39/0x60 [ 115.643365] down_trylock+0xe/0x70 [ 115.643381] __down_trylock_console_sem+0x3b/0xd0 [ 115.643396] vprintk_emit+0x16b/0x560 [ 115.643412] vprintk+0x84/0xa0 [ 115.643428] _printk+0xba/0xf1 [ 115.643440] report_bug.cold+0x72/0xab [ 115.643449] handle_bug+0x3c/0x70 [ 115.643459] exc_invalid_op+0x14/0x50 [ 115.643469] asm_exc_invalid_op+0x16/0x20 [ 115.643482] group_sched_out.part.0+0x2c7/0x460 [ 115.643500] ctx_sched_out+0x8f1/0xc10 [ 115.643516] __perf_event_task_sched_out+0x6d0/0x18d0 [ 115.643527] __schedule+0xedd/0x2470 [ 115.643542] schedule+0xda/0x1b0 [ 115.643556] exit_to_user_mode_prepare+0x114/0x1a0 [ 115.643567] syscall_exit_to_user_mode+0x19/0x40 [ 115.643581] do_syscall_64+0x48/0x90 [ 115.643591] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 115.643604] [ 115.643604] other info that might help us debug this: [ 115.643604] [ 115.643607] Chain exists of: [ 115.643607] (console_sem).lock --> &rq->__lock --> &ctx->lock [ 115.643607] [ 115.643622] Possible unsafe locking scenario: [ 115.643622] [ 115.643624] CPU0 CPU1 [ 115.643626] ---- ---- [ 115.643628] lock(&ctx->lock); [ 115.643634] lock(&rq->__lock); [ 115.643640] lock(&ctx->lock); [ 115.643646] lock((console_sem).lock); [ 115.643652] [ 115.643652] *** DEADLOCK *** [ 115.643652] [ 115.643653] 2 locks held by syz-executor.2/3628: [ 115.643660] #0: ffff88806cf37e98 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x1cf/0x2470 [ 115.643690] #1: ffff88800f0acc20 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_out+0x53b/0x18d0 [ 115.643716] [ 115.643716] stack backtrace: [ 115.643719] CPU: 1 PID: 3628 Comm: syz-executor.2 Not tainted 6.0.0-next-20221006 #1 [ 115.643731] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 115.643738] Call Trace: [ 115.643741] [ 115.643745] dump_stack_lvl+0x8b/0xb3 [ 115.643756] check_noncircular+0x263/0x2e0 [ 115.643773] ? format_decode+0x26c/0xb50 [ 115.643790] ? print_circular_bug+0x450/0x450 [ 115.643807] ? simple_strtoul+0x30/0x30 [ 115.643824] ? format_decode+0x26c/0xb50 [ 115.643842] ? alloc_chain_hlocks+0x1ec/0x5a0 [ 115.643859] __lock_acquire+0x2a02/0x5e70 [ 115.643881] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 115.643903] lock_acquire+0x1a2/0x530 [ 115.643920] ? down_trylock+0xe/0x70 [ 115.643938] ? lock_release+0x750/0x750 [ 115.643958] ? vprintk+0x84/0xa0 [ 115.643976] _raw_spin_lock_irqsave+0x39/0x60 [ 115.643988] ? down_trylock+0xe/0x70 [ 115.644006] down_trylock+0xe/0x70 [ 115.644023] ? vprintk+0x84/0xa0 [ 115.644039] __down_trylock_console_sem+0x3b/0xd0 [ 115.644056] vprintk_emit+0x16b/0x560 [ 115.644075] vprintk+0x84/0xa0 [ 115.644092] _printk+0xba/0xf1 [ 115.644105] ? record_print_text.cold+0x16/0x16 [ 115.644122] ? report_bug.cold+0x66/0xab [ 115.644133] ? group_sched_out.part.0+0x2c7/0x460 [ 115.644151] report_bug.cold+0x72/0xab [ 115.644163] handle_bug+0x3c/0x70 [ 115.644174] exc_invalid_op+0x14/0x50 [ 115.644185] asm_exc_invalid_op+0x16/0x20 [ 115.644199] RIP: 0010:group_sched_out.part.0+0x2c7/0x460 [ 115.644219] Code: 5e 41 5f e9 5b a5 ef ff e8 56 a5 ef ff 65 8b 1d 1b fe ab 7e 31 ff 89 de e8 f6 a1 ef ff 85 db 0f 84 8a 00 00 00 e8 39 a5 ef ff <0f> 0b e9 a5 fe ff ff e8 2d a5 ef ff 48 8d 7d 10 48 b8 00 00 00 00 [ 115.644230] RSP: 0018:ffff88801ad5fc48 EFLAGS: 00010006 [ 115.644239] RAX: 0000000040000002 RBX: 0000000000000000 RCX: 0000000000000000 [ 115.644247] RDX: ffff88801e649ac0 RSI: ffffffff815677b7 RDI: 0000000000000005 [ 115.644254] RBP: ffff88801d520000 R08: 0000000000000005 R09: 0000000000000001 [ 115.644261] R10: 0000000000000000 R11: ffffffff865b605b R12: ffff88800f0acc00 [ 115.644269] R13: ffff88806cf3d2c0 R14: ffffffff8547d200 R15: 0000000000000002 [ 115.644280] ? group_sched_out.part.0+0x2c7/0x460 [ 115.644299] ? group_sched_out.part.0+0x2c7/0x460 [ 115.644319] ctx_sched_out+0x8f1/0xc10 [ 115.644338] __perf_event_task_sched_out+0x6d0/0x18d0 [ 115.644353] ? lock_is_held_type+0xd7/0x130 [ 115.644368] ? __perf_cgroup_move+0x160/0x160 [ 115.644378] ? set_next_entity+0x304/0x550 [ 115.644396] ? update_curr+0x267/0x740 [ 115.644414] ? lock_is_held_type+0xd7/0x130 [ 115.644429] __schedule+0xedd/0x2470 [ 115.644448] ? io_schedule_timeout+0x150/0x150 [ 115.644465] ? rcu_read_lock_sched_held+0x3e/0x80 [ 115.644485] schedule+0xda/0x1b0 [ 115.644501] exit_to_user_mode_prepare+0x114/0x1a0 [ 115.644514] syscall_exit_to_user_mode+0x19/0x40 [ 115.644528] do_syscall_64+0x48/0x90 [ 115.644539] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 115.644554] RIP: 0033:0x7f890ec16b19 [ 115.644562] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 115.644572] RSP: 002b:00007f890c18c218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 115.644583] RAX: 0000000000000001 RBX: 00007f890ed29f68 RCX: 00007f890ec16b19 [ 115.644590] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f890ed29f6c [ 115.644597] RBP: 00007f890ed29f60 R08: 000000000000000e R09: 0000000000000000 [ 115.644604] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f890ed29f6c [ 115.644611] R13: 00007fffa3dfac3f R14: 00007f890c18c300 R15: 0000000000022000 [ 115.644624] [ 115.702375] WARNING: CPU: 1 PID: 3628 at kernel/events/core.c:2309 group_sched_out.part.0+0x2c7/0x460 [ 115.703022] Modules linked in: [ 115.703254] CPU: 1 PID: 3628 Comm: syz-executor.2 Not tainted 6.0.0-next-20221006 #1 [ 115.703791] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 115.704357] RIP: 0010:group_sched_out.part.0+0x2c7/0x460 [ 115.704742] Code: 5e 41 5f e9 5b a5 ef ff e8 56 a5 ef ff 65 8b 1d 1b fe ab 7e 31 ff 89 de e8 f6 a1 ef ff 85 db 0f 84 8a 00 00 00 e8 39 a5 ef ff <0f> 0b e9 a5 fe ff ff e8 2d a5 ef ff 48 8d 7d 10 48 b8 00 00 00 00 [ 115.705984] RSP: 0018:ffff88801ad5fc48 EFLAGS: 00010006 [ 115.706366] RAX: 0000000040000002 RBX: 0000000000000000 RCX: 0000000000000000 [ 115.706864] RDX: ffff88801e649ac0 RSI: ffffffff815677b7 RDI: 0000000000000005 [ 115.707366] RBP: ffff88801d520000 R08: 0000000000000005 R09: 0000000000000001 [ 115.707856] R10: 0000000000000000 R11: ffffffff865b605b R12: ffff88800f0acc00 [ 115.708351] R13: ffff88806cf3d2c0 R14: ffffffff8547d200 R15: 0000000000000002 [ 115.708844] FS: 00007f890c18c700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 [ 115.709400] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 115.709807] CR2: 00007f6c16fcb4a1 CR3: 0000000019cca000 CR4: 0000000000350ee0 [ 115.710309] Call Trace: [ 115.710494] [ 115.710664] ctx_sched_out+0x8f1/0xc10 [ 115.710957] __perf_event_task_sched_out+0x6d0/0x18d0 [ 115.711328] ? lock_is_held_type+0xd7/0x130 [ 115.711638] ? __perf_cgroup_move+0x160/0x160 [ 115.711958] ? set_next_entity+0x304/0x550 [ 115.712269] ? update_curr+0x267/0x740 [ 115.712554] ? lock_is_held_type+0xd7/0x130 [ 115.712866] __schedule+0xedd/0x2470 [ 115.713144] ? io_schedule_timeout+0x150/0x150 [ 115.713469] ? rcu_read_lock_sched_held+0x3e/0x80 [ 115.713823] schedule+0xda/0x1b0 [ 115.714077] exit_to_user_mode_prepare+0x114/0x1a0 [ 115.714435] syscall_exit_to_user_mode+0x19/0x40 [ 115.714778] do_syscall_64+0x48/0x90 [ 115.715048] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 115.715413] RIP: 0033:0x7f890ec16b19 [ 115.715678] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 115.716914] RSP: 002b:00007f890c18c218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 115.717437] RAX: 0000000000000001 RBX: 00007f890ed29f68 RCX: 00007f890ec16b19 [ 115.717929] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f890ed29f6c [ 115.718434] RBP: 00007f890ed29f60 R08: 000000000000000e R09: 0000000000000000 [ 115.718925] R10: 0000000000000003 R11: 0000000000000246 R12: 00007f890ed29f6c [ 115.719426] R13: 00007fffa3dfac3f R14: 00007f890c18c300 R15: 0000000000022000 [ 115.719931] [ 115.720102] irq event stamp: 720 [ 115.720339] hardirqs last enabled at (719): [] exit_to_user_mode_prepare+0x109/0x1a0 [ 115.720990] hardirqs last disabled at (720): [] __schedule+0x1225/0x2470 [ 115.721574] softirqs last enabled at (588): [] __irq_exit_rcu+0x11b/0x180 [ 115.722171] softirqs last disabled at (463): [] __irq_exit_rcu+0x11b/0x180 [ 115.722783] ---[ end trace 0000000000000000 ]--- [ 115.847249] hrtimer: interrupt took 15579 ns [ 122.911281] Bluetooth: hci0: Opcode 0x c03 failed: -110 [ 122.975270] Bluetooth: hci2: Opcode 0x c03 failed: -110 [ 122.975291] Bluetooth: hci1: Opcode 0x c03 failed: -110 [ 123.039263] Bluetooth: hci7: Opcode 0x c03 failed: -110 [ 123.039282] Bluetooth: hci3: Opcode 0x c03 failed: -110 [ 123.040538] Bluetooth: hci4: Opcode 0x c03 failed: -110 VM DIAGNOSIS: 10:59:56 Registers: info registers vcpu 0 RAX=0000000000000000 RBX=0000000000004000 RCX=0000000000000000 RDX=ffff88803a771ac0 RSI=ffffffff8109e135 RDI=0000000000000001 RBP=ffff88803a79ff58 RSP=ffff88803a79ff00 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=ffff88803a79ff58 R13=0000000000000000 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff8109ddb2 RFL=00000093 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00005555560cd400 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f3998d70000 CR3=000000001d470000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=0000564d15292a900000564d15292a70 XMM01=0000000dffffffff0000564d15292a90 XMM02=0000564d1528acc00000000900000007 XMM03=00000001000000030000564d1529bd50 XMM04=00000000000000000000000000000000 XMM05=00000004000000050000564d1528ded0 XMM06=0000564d1525c8200000000000000000 XMM07=0000564d152a0fd00000564d152a6360 XMM08=0202010000ff00ff0000000800000006 XMM09=00000000000000000000000000000000 XMM10=00000000002000000000000000200000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=000000000000002b RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff823c0801 RDI=ffffffff8765c9e0 RBP=ffffffff8765c9a0 RSP=ffff88801ad5f690 R8 =0000000000000001 R9 =000000000000000a R10=000000000000002b R11=0000000000000001 R12=000000000000002b R13=ffffffff8765c9a0 R14=0000000000000010 R15=ffffffff823c07f0 RIP=ffffffff823c0859 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f890c18c700 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f6c16fcb4a1 CR3=0000000019cca000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007f890ecfd7c000007f890ecfd7c8 XMM02=00007f890ecfd7e000007f890ecfd7c0 XMM03=00007f890ecfd7c800007f890ecfd7c0 XMM04=ffffffffffffffffffffffff00000000 XMM05=00000000000000000000000000000000 XMM06=0000000000000000000000524f525245 XMM07=00000000000000000000000000000000 XMM08=000000000000000000524f5252450040 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000