Warning: Permanently added '[localhost]:2766' (ECDSA) to the list of known hosts. 2022/09/14 10:56:58 fuzzer started 2022/09/14 10:56:59 dialing manager at localhost:33849 syzkaller login: [ 40.726177] cgroup: Unknown subsys name 'net' [ 40.849097] cgroup: Unknown subsys name 'rlimit' 2022/09/14 10:57:13 syscalls: 2215 2022/09/14 10:57:13 code coverage: enabled 2022/09/14 10:57:13 comparison tracing: enabled 2022/09/14 10:57:13 extra coverage: enabled 2022/09/14 10:57:13 setuid sandbox: enabled 2022/09/14 10:57:13 namespace sandbox: enabled 2022/09/14 10:57:13 Android sandbox: enabled 2022/09/14 10:57:13 fault injection: enabled 2022/09/14 10:57:13 leak checking: enabled 2022/09/14 10:57:13 net packet injection: enabled 2022/09/14 10:57:13 net device setup: enabled 2022/09/14 10:57:13 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2022/09/14 10:57:13 devlink PCI setup: PCI device 0000:00:10.0 is not available 2022/09/14 10:57:13 USB emulation: enabled 2022/09/14 10:57:13 hci packet injection: enabled 2022/09/14 10:57:13 wifi device emulation: failed to parse kernel version (6.0.0-rc5-next-20220914) 2022/09/14 10:57:13 802.15.4 emulation: enabled 2022/09/14 10:57:13 fetching corpus: 0, signal 0/2000 (executing program) 2022/09/14 10:57:13 fetching corpus: 50, signal 35000/35712 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/41688 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/41729 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/41774 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/41812 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/41862 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/41907 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/41942 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/41983 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/42027 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/42064 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/42101 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/42162 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/42219 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/42259 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/42302 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/42325 (executing program) 2022/09/14 10:57:13 fetching corpus: 81, signal 41550/42325 (executing program) 2022/09/14 10:57:15 starting 8 fuzzer processes 10:57:15 executing program 0: syz_emit_ethernet(0x46, &(0x7f0000000840)={@local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "2ddc20", 0x10, 0x6, 0x0, @local, @local, {[], @ndisc_ra}}}}}, 0x0) 10:57:15 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmmsg$inet6(r0, &(0x7f0000001840)=[{{&(0x7f00000013c0)={0xa, 0x0, 0x0, @loopback}, 0x1c, &(0x7f0000000140)=[{&(0x7f0000000000)="d7061e52", 0x4}], 0x1}}, {{&(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2}, 0x1c, &(0x7f0000001480)=[{&(0x7f0000000080)='0V', 0x2}], 0x1, &(0x7f0000001640)=[@tclass={{0x14}}], 0x18}}], 0x2, 0x0) 10:57:15 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) setsockopt$inet_udp_int(r0, 0x11, 0xb, &(0x7f0000000240)=0x3, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x282, 0x0, @perf_config_ext={0x3, 0x34}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0x1, 0xd6c2}) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x4, 0x9, 0x7, 0x40, 0x0, 0xd0, 0x4800, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x7fffffff, 0x1, @perf_config_ext={0x5, 0x4}, 0x0, 0xffff, 0x8000, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffff7, 0x0, 0x7}, 0x0, 0xf, 0xffffffffffffffff, 0x2) socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000400)={{{@in6=@dev, @in6=@ipv4={""/10, ""/2, @initdev}}}, {{@in6=@mcast1}, 0x0, @in=@empty}}, &(0x7f00000001c0)=0x3c) read(0xffffffffffffffff, &(0x7f0000001040)=""/4096, 0x1000) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, &(0x7f0000000040)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) socket$nl_audit(0x10, 0x3, 0x9) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) [ 56.457200] audit: type=1400 audit(1663153035.123:6): avc: denied { execmem } for pid=282 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 10:57:15 executing program 3: r0 = semget(0x2, 0x1, 0x26a) semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000000)=""/236) semctl$GETZCNT(r0, 0x1, 0xf, &(0x7f0000000100)=""/86) semctl$SEM_STAT_ANY(r0, 0x1, 0x14, &(0x7f0000000180)=""/197) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000280)={{0x3, 0x0, 0xee01, 0xee00, 0xffffffffffffffff, 0x112, 0x6}, 0xfffffffffffff99b, 0x401, 0x0, 0x0, 0x0, 0x0, 0x1}) semctl$GETVAL(0x0, 0x3, 0xc, &(0x7f0000000300)=""/212) r1 = semget$private(0x0, 0x0, 0x20) semctl$GETVAL(r1, 0x1, 0xc, &(0x7f0000000400)=""/242) 10:57:15 executing program 4: perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x7, 0xfbd1) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x41) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue1\x00'}) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x0, 0x20, 0x7) write$sndseq(r1, &(0x7f0000000140)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @control}], 0xfffffdcd) syz_io_uring_setup(0xfb0, &(0x7f0000000200), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f00000001c0)=0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x81266b6, 0x0, 0x0, 0x18}, 0x0) r5 = syz_io_uring_setup(0xb9b, &(0x7f0000000440), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x4bf1, &(0x7f0000000000)={0x0, 0x893c, 0x1, 0x1, 0x187, 0x0, r5}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)=0x0) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000100)=@IORING_OP_POLL_REMOVE={0x7, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r8}}, 0x800) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_FADVISE={0x18, 0x1, 0x0, @fd_index=0x5, 0x4, 0x0, 0x40, 0x2, 0x0, {0x0, r8}}, 0x0) r9 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rpc\x00') r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='projid_map\x00') write$P9_RREADDIR(r10, 0x0, 0x0) getdents(r9, 0x0, 0x0) 10:57:15 executing program 5: syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@random="0b06da998dff", @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x30}, @remote}, @redirect={0x8, 0x0, 0x0, @empty, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @local}}}}}}, 0x0) inotify_init1(0x0) 10:57:15 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000004c0)) 10:57:15 executing program 7: r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x40b01, 0x0) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000340)) ioctl$CDROM_TIMED_MEDIA_CHANGE(r0, 0x5396, &(0x7f0000000040)={0x7fff, 0x1}) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000003c0), 0x500, 0x0) r2 = syz_open_dev$vcsu(&(0x7f0000000380), 0x5, 0x221301) ioctl$CDROM_DEBUG(r2, 0x5330, 0x1) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r1, &(0x7f00000001c0)={0x8}) r3 = socket$netlink(0x10, 0x3, 0x10) r4 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) r5 = dup(r4) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000009effffffca6143954f35e696e380f7090be1a528f4bd69eab42cd928e01cc2715c1247b8c22731dcb2483bdec7654c1380bd27c6"]) ioctl$F2FS_IOC_RESIZE_FS(r3, 0x4008f510, &(0x7f00000004c0)=0x2) ioctl$LOOP_SET_STATUS64(0xffffffffffffffff, 0x4c04, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x5, 0x0, 0x0, "5df0cbe6fdabd2f3df4ef4f785986942cd3abde4a688ab8ac64e3fc9f1fd6b46ff5188f5b347fd4f809c95e509bd80996376c7c843b528adc48ff5476a66c4ec", "76997adcf8341a9ba908142c646d65d888d4f54577b74d6beac185359ce1537275c2c4c839569b788e610ed9e3f5c93bc62f70307ba9dd32fb8f55d16063bcae", "585f24bb3ae12d10afaf3f1a82c1b955b13ba2ce5b3c5445b7f6ef6c03d7c7ef"}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue1\x00'}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000030c0)) mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4, 0x50, r2, 0x9) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x5}, 0x1200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$sg(&(0x7f0000000180), 0x5, 0x10003) r6 = socket$netlink(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000400)=ANY=[@ANYBLOB="140000001d00010000000000000000000400000014a98f45357d0100d7c15cabbd7d63d35ec421d1437fb2c573d2f90f9f8d54e311394136d2fffe511eeef330b2781188e25185ffbd7c1ac2aa15d41a3594308833deeeb2b795274af0e04089f501a625bcfd1a812ba1e2233700d0ba6a2ff5918fe814ddcfb8c50e3b468820fc670522f9fbb574597387e3d57f3f0544a91ef99d18363ea8c782c250080be7318bb1fb37aa1039fa0000000000"], 0x14}], 0x1}, 0x0) [ 57.660627] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 57.664220] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 57.665655] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 57.675566] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 57.680683] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 57.683121] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 57.694029] Bluetooth: hci0: HCI_REQ-0x0c1a [ 57.706791] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 57.709135] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 57.717445] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 57.727152] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 57.729701] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 57.731126] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 57.741800] Bluetooth: hci1: HCI_REQ-0x0c1a [ 57.793190] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 57.802594] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 57.803781] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 57.806172] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 57.807279] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 57.816216] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 57.819121] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 57.820532] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 57.830558] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 57.832207] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 57.833946] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 57.835011] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 57.836717] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 57.848420] Bluetooth: hci3: HCI_REQ-0x0c1a [ 57.852651] Bluetooth: hci5: HCI_REQ-0x0c1a [ 57.902623] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 57.905422] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 57.913568] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 57.916129] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 57.918149] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 57.930623] Bluetooth: hci4: HCI_REQ-0x0c1a [ 59.749860] Bluetooth: hci1: command 0x0409 tx timeout [ 59.750828] Bluetooth: hci0: command 0x0409 tx timeout [ 59.814294] Bluetooth: hci2: Opcode 0x c03 failed: -110 [ 59.877753] Bluetooth: hci5: command 0x0409 tx timeout [ 59.878278] Bluetooth: hci3: command 0x0409 tx timeout [ 59.879063] Bluetooth: hci7: Opcode 0x c03 failed: -110 [ 59.880045] Bluetooth: hci6: Opcode 0x c03 failed: -110 [ 59.941415] Bluetooth: hci4: command 0x0409 tx timeout [ 61.799036] Bluetooth: hci0: command 0x041b tx timeout [ 61.800296] Bluetooth: hci1: command 0x041b tx timeout [ 61.925367] Bluetooth: hci3: command 0x041b tx timeout [ 61.926008] Bluetooth: hci5: command 0x041b tx timeout [ 61.989425] Bluetooth: hci4: command 0x041b tx timeout [ 62.762638] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 62.764039] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 62.764940] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 62.768232] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 62.790970] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 62.792613] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 62.793819] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 62.796677] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 62.797715] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 62.798924] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 62.804450] Bluetooth: hci6: HCI_REQ-0x0c1a [ 62.897778] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 62.908009] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 62.930398] Bluetooth: hci2: HCI_REQ-0x0c1a [ 63.846369] Bluetooth: hci1: command 0x040f tx timeout [ 63.846877] Bluetooth: hci0: command 0x040f tx timeout [ 63.974363] Bluetooth: hci5: command 0x040f tx timeout [ 63.974843] Bluetooth: hci3: command 0x040f tx timeout [ 64.037388] Bluetooth: hci4: command 0x040f tx timeout [ 64.869363] Bluetooth: hci6: command 0x0409 tx timeout [ 64.997467] Bluetooth: hci7: Opcode 0x c03 failed: -110 [ 64.999230] Bluetooth: hci2: command 0x0409 tx timeout [ 65.894959] Bluetooth: hci0: command 0x0419 tx timeout [ 65.895788] Bluetooth: hci1: command 0x0419 tx timeout [ 66.022123] Bluetooth: hci3: command 0x0419 tx timeout [ 66.023868] Bluetooth: hci5: command 0x0419 tx timeout [ 66.086790] Bluetooth: hci4: command 0x0419 tx timeout [ 66.918400] Bluetooth: hci6: command 0x041b tx timeout [ 67.046377] Bluetooth: hci2: command 0x041b tx timeout [ 68.966401] Bluetooth: hci6: command 0x040f tx timeout [ 69.093386] Bluetooth: hci2: command 0x040f tx timeout [ 69.605451] Bluetooth: hci7: Opcode 0x c03 failed: -110 [ 71.013532] Bluetooth: hci6: command 0x0419 tx timeout [ 71.141473] Bluetooth: hci2: command 0x0419 tx timeout [ 74.342368] Bluetooth: hci7: Opcode 0x c03 failed: -110 [ 78.757435] Bluetooth: hci7: Opcode 0x c03 failed: -110 [ 81.303190] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 81.305258] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 81.307183] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 81.310547] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 81.314535] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 81.315840] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 81.322512] Bluetooth: hci7: HCI_REQ-0x0c1a [ 83.365535] Bluetooth: hci7: command 0x0409 tx timeout [ 85.414378] Bluetooth: hci7: command 0x041b tx timeout [ 87.461493] Bluetooth: hci7: command 0x040f tx timeout [ 89.509373] Bluetooth: hci7: command 0x0419 tx timeout 10:58:07 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000004c0)) [ 109.147250] audit: type=1400 audit(1663153087.813:7): avc: denied { open } for pid=3562 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 109.149449] audit: type=1400 audit(1663153087.813:8): avc: denied { kernel } for pid=3562 comm="syz-executor.4" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1 [ 109.158328] hrtimer: interrupt took 30607 ns [ 109.160441] ------------[ cut here ]------------ [ 109.160468] [ 109.160472] ====================================================== [ 109.160477] WARNING: possible circular locking dependency detected [ 109.160482] 6.0.0-rc5-next-20220914 #1 Not tainted [ 109.160492] ------------------------------------------------------ [ 109.160497] syz-executor.4/3563 is trying to acquire lock: [ 109.160506] ffffffff853fa878 ((console_sem).lock){-...}-{2:2}, at: down_trylock+0xe/0x70 [ 109.160559] [ 109.160559] but task is already holding lock: [ 109.160563] ffff88803c127420 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_out+0x53b/0x18d0 [ 109.160604] [ 109.160604] which lock already depends on the new lock. [ 109.160604] [ 109.160608] [ 109.160608] the existing dependency chain (in reverse order) is: [ 109.160613] [ 109.160613] -> #3 (&ctx->lock){....}-{2:2}: [ 109.160634] _raw_spin_lock+0x2a/0x40 [ 109.160661] __perf_event_task_sched_out+0x53b/0x18d0 [ 109.160688] __schedule+0xedd/0x2470 [ 109.160703] schedule+0xda/0x1b0 [ 109.160718] exit_to_user_mode_prepare+0x114/0x1a0 [ 109.160750] syscall_exit_to_user_mode+0x19/0x40 [ 109.160777] do_syscall_64+0x48/0x90 [ 109.160802] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 109.160831] [ 109.160831] -> #2 (&rq->__lock){-.-.}-{2:2}: [ 109.160852] _raw_spin_lock_nested+0x30/0x40 [ 109.160876] raw_spin_rq_lock_nested+0x1e/0x30 [ 109.160895] task_fork_fair+0x63/0x4d0 [ 109.160921] sched_cgroup_fork+0x3d0/0x540 [ 109.160943] copy_process+0x4183/0x6e20 [ 109.160958] kernel_clone+0xe7/0x890 [ 109.160973] user_mode_thread+0xad/0xf0 [ 109.160988] rest_init+0x24/0x250 [ 109.161014] arch_call_rest_init+0xf/0x14 [ 109.161031] start_kernel+0x4c1/0x4e6 [ 109.161046] secondary_startup_64_no_verify+0xe0/0xeb [ 109.161067] [ 109.161067] -> #1 (&p->pi_lock){-.-.}-{2:2}: [ 109.161088] _raw_spin_lock_irqsave+0x39/0x60 [ 109.161112] try_to_wake_up+0xab/0x1920 [ 109.161132] up+0x75/0xb0 [ 109.161150] __up_console_sem+0x6e/0x80 [ 109.161174] console_unlock+0x46a/0x590 [ 109.161199] do_con_write+0xc05/0x1d50 [ 109.161215] con_write+0x21/0x40 [ 109.161230] n_tty_write+0x4d4/0xfe0 [ 109.161249] file_tty_write.constprop.0+0x49c/0x8f0 [ 109.161267] vfs_write+0x9c3/0xd90 [ 109.161303] ksys_write+0x127/0x250 [ 109.161329] do_syscall_64+0x3b/0x90 [ 109.161350] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 109.161386] [ 109.161386] -> #0 ((console_sem).lock){-...}-{2:2}: [ 109.161412] __lock_acquire+0x2a02/0x5e70 [ 109.161438] lock_acquire+0x1a2/0x530 [ 109.161464] _raw_spin_lock_irqsave+0x39/0x60 [ 109.161487] down_trylock+0xe/0x70 [ 109.161507] __down_trylock_console_sem+0x3b/0xd0 [ 109.161537] vprintk_emit+0x16b/0x560 [ 109.161563] vprintk+0x84/0xa0 [ 109.161589] _printk+0xba/0xf1 [ 109.161616] report_bug.cold+0x72/0xab [ 109.161635] handle_bug+0x3c/0x70 [ 109.161655] exc_invalid_op+0x14/0x50 [ 109.161676] asm_exc_invalid_op+0x16/0x20 [ 109.161702] group_sched_out.part.0+0x2c7/0x460 [ 109.161718] ctx_sched_out+0x8f1/0xc10 [ 109.161733] __perf_event_task_sched_out+0x6d0/0x18d0 [ 109.161752] __schedule+0xedd/0x2470 [ 109.161767] schedule+0xda/0x1b0 [ 109.161782] exit_to_user_mode_prepare+0x114/0x1a0 [ 109.161812] syscall_exit_to_user_mode+0x19/0x40 [ 109.161839] do_syscall_64+0x48/0x90 [ 109.161859] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 109.161886] [ 109.161886] other info that might help us debug this: [ 109.161886] [ 109.161890] Chain exists of: [ 109.161890] (console_sem).lock --> &rq->__lock --> &ctx->lock [ 109.161890] [ 109.161913] Possible unsafe locking scenario: [ 109.161913] [ 109.161917] CPU0 CPU1 [ 109.161920] ---- ---- [ 109.161924] lock(&ctx->lock); [ 109.161932] lock(&rq->__lock); [ 109.161942] lock(&ctx->lock); [ 109.161952] lock((console_sem).lock); [ 109.161960] [ 109.161960] *** DEADLOCK *** [ 109.161960] [ 109.161963] 2 locks held by syz-executor.4/3563: [ 109.161974] #0: ffff88806cf37cd8 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x1cf/0x2470 [ 109.162014] #1: ffff88803c127420 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_out+0x53b/0x18d0 [ 109.162057] [ 109.162057] stack backtrace: [ 109.162061] CPU: 1 PID: 3563 Comm: syz-executor.4 Not tainted 6.0.0-rc5-next-20220914 #1 [ 109.162081] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 109.162092] Call Trace: [ 109.162097] [ 109.162103] dump_stack_lvl+0x8b/0xb3 [ 109.162126] check_noncircular+0x263/0x2e0 [ 109.162152] ? format_decode+0x26c/0xb50 [ 109.162175] ? print_circular_bug+0x450/0x450 [ 109.162202] ? enable_ptr_key_workfn+0x20/0x20 [ 109.162224] ? __lockdep_reset_lock+0x180/0x180 [ 109.162257] ? format_decode+0x26c/0xb50 [ 109.162281] ? alloc_chain_hlocks+0x1ec/0x5a0 [ 109.162309] __lock_acquire+0x2a02/0x5e70 [ 109.162343] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 109.162384] lock_acquire+0x1a2/0x530 [ 109.162410] ? down_trylock+0xe/0x70 [ 109.162433] ? rcu_read_unlock+0x40/0x40 [ 109.162463] ? find_held_lock+0x2c/0x110 [ 109.162489] ? vprintk+0x84/0xa0 [ 109.162519] _raw_spin_lock_irqsave+0x39/0x60 [ 109.162544] ? down_trylock+0xe/0x70 [ 109.162565] down_trylock+0xe/0x70 [ 109.162586] ? vprintk+0x84/0xa0 [ 109.162613] __down_trylock_console_sem+0x3b/0xd0 [ 109.162641] vprintk_emit+0x16b/0x560 [ 109.162671] vprintk+0x84/0xa0 [ 109.162699] _printk+0xba/0xf1 [ 109.162727] ? record_print_text.cold+0x16/0x16 [ 109.162760] ? hrtimer_try_to_cancel+0x163/0x2c0 [ 109.162781] ? lock_downgrade+0x6d0/0x6d0 [ 109.162809] ? report_bug.cold+0x66/0xab [ 109.162831] ? group_sched_out.part.0+0x2c7/0x460 [ 109.162849] report_bug.cold+0x72/0xab [ 109.162882] handle_bug+0x3c/0x70 [ 109.162904] exc_invalid_op+0x14/0x50 [ 109.162928] asm_exc_invalid_op+0x16/0x20 [ 109.162957] RIP: 0010:group_sched_out.part.0+0x2c7/0x460 [ 109.162981] Code: 5e 41 5f e9 3b b7 ef ff e8 36 b7 ef ff 65 8b 1d ab 15 ac 7e 31 ff 89 de e8 d6 b3 ef ff 85 db 0f 84 8a 00 00 00 e8 19 b7 ef ff <0f> 0b e9 a5 fe ff ff e8 0d b7 ef ff 48 8d 7d 10 48 b8 00 00 00 00 [ 109.163001] RSP: 0018:ffff88803b3bfc48 EFLAGS: 00010006 [ 109.163015] RAX: 0000000040000002 RBX: 0000000000000000 RCX: 0000000000000000 [ 109.163028] RDX: ffff88801bca0000 RSI: ffffffff81566027 RDI: 0000000000000005 [ 109.163040] RBP: ffff88801bc58000 R08: 0000000000000005 R09: 0000000000000001 [ 109.163052] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88803c127400 [ 109.163068] R13: ffff88806cf3d100 R14: ffffffff8547bfc0 R15: 0000000000000002 [ 109.163091] ? group_sched_out.part.0+0x2c7/0x460 [ 109.163114] ? group_sched_out.part.0+0x2c7/0x460 [ 109.163133] ctx_sched_out+0x8f1/0xc10 [ 109.163152] __perf_event_task_sched_out+0x6d0/0x18d0 [ 109.163177] ? lock_is_held_type+0xd7/0x130 [ 109.163205] ? __perf_cgroup_move+0x160/0x160 [ 109.163229] ? set_next_entity+0x304/0x550 [ 109.163257] ? update_curr+0x267/0x740 [ 109.163286] ? lock_is_held_type+0xd7/0x130 [ 109.163315] __schedule+0xedd/0x2470 [ 109.163336] ? io_schedule_timeout+0x150/0x150 [ 109.163358] schedule+0xda/0x1b0 [ 109.163376] exit_to_user_mode_prepare+0x114/0x1a0 [ 109.163408] syscall_exit_to_user_mode+0x19/0x40 [ 109.163436] do_syscall_64+0x48/0x90 [ 109.163459] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 109.163487] RIP: 0033:0x7f3582d91b19 [ 109.163500] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 109.163516] RSP: 002b:00007f3580307188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 109.163533] RAX: 0000000000000003 RBX: 00007f3582ea4f60 RCX: 00007f3582d91b19 [ 109.163545] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000280 [ 109.163556] RBP: 00007f3582debf6d R08: 0000000000000000 R09: 0000000000000000 [ 109.163567] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 109.163579] R13: 00007ffc955250ff R14: 00007f3580307300 R15: 0000000000022000 [ 109.163598] [ 109.250693] WARNING: CPU: 1 PID: 3563 at kernel/events/core.c:2309 group_sched_out.part.0+0x2c7/0x460 [ 109.251676] Modules linked in: [ 109.252015] CPU: 1 PID: 3563 Comm: syz-executor.4 Not tainted 6.0.0-rc5-next-20220914 #1 [ 109.252849] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 109.254009] RIP: 0010:group_sched_out.part.0+0x2c7/0x460 [ 109.254579] Code: 5e 41 5f e9 3b b7 ef ff e8 36 b7 ef ff 65 8b 1d ab 15 ac 7e 31 ff 89 de e8 d6 b3 ef ff 85 db 0f 84 8a 00 00 00 e8 19 b7 ef ff <0f> 0b e9 a5 fe ff ff e8 0d b7 ef ff 48 8d 7d 10 48 b8 00 00 00 00 [ 109.256451] RSP: 0018:ffff88803b3bfc48 EFLAGS: 00010006 [ 109.257003] RAX: 0000000040000002 RBX: 0000000000000000 RCX: 0000000000000000 [ 109.257748] RDX: ffff88801bca0000 RSI: ffffffff81566027 RDI: 0000000000000005 [ 109.258496] RBP: ffff88801bc58000 R08: 0000000000000005 R09: 0000000000000001 [ 109.259236] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88803c127400 [ 109.259972] R13: ffff88806cf3d100 R14: ffffffff8547bfc0 R15: 0000000000000002 [ 109.260718] FS: 00007f3580307700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 [ 109.261546] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 109.262150] CR2: 00007ffce3896399 CR3: 000000003d066000 CR4: 0000000000350ee0 [ 109.262897] Call Trace: [ 109.263175] [ 109.263419] ctx_sched_out+0x8f1/0xc10 [ 109.263827] __perf_event_task_sched_out+0x6d0/0x18d0 [ 109.264371] ? lock_is_held_type+0xd7/0x130 [ 109.264836] ? __perf_cgroup_move+0x160/0x160 [ 109.265300] ? set_next_entity+0x304/0x550 [ 109.265747] ? update_curr+0x267/0x740 [ 109.266181] ? lock_is_held_type+0xd7/0x130 [ 109.266655] __schedule+0xedd/0x2470 [ 109.267090] ? io_schedule_timeout+0x150/0x150 [ 109.267589] schedule+0xda/0x1b0 [ 109.267955] exit_to_user_mode_prepare+0x114/0x1a0 [ 109.268501] syscall_exit_to_user_mode+0x19/0x40 [ 109.269039] do_syscall_64+0x48/0x90 [ 109.269450] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 109.270017] RIP: 0033:0x7f3582d91b19 [ 109.270419] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 109.272354] RSP: 002b:00007f3580307188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 109.273174] RAX: 0000000000000003 RBX: 00007f3582ea4f60 RCX: 00007f3582d91b19 [ 109.273941] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000280 [ 109.274699] RBP: 00007f3582debf6d R08: 0000000000000000 R09: 0000000000000000 [ 109.275490] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 109.276260] R13: 00007ffc955250ff R14: 00007f3580307300 R15: 0000000000022000 [ 109.277027] [ 109.277285] irq event stamp: 624 [ 109.277673] hardirqs last enabled at (623): [] exit_to_user_mode_prepare+0x109/0x1a0 [ 109.278733] hardirqs last disabled at (624): [] __schedule+0x1225/0x2470 [ 109.279672] softirqs last enabled at (520): [] __irq_exit_rcu+0x11b/0x180 [ 109.280594] softirqs last disabled at (513): [] __irq_exit_rcu+0x11b/0x180 [ 109.281493] ---[ end trace 0000000000000000 ]--- 10:58:08 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000004c0)) [ 116.716237] program syz-executor.7 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 116.820081] ieee80211 phy2: Selected rate control algorithm 'minstrel_ht' [ 117.579479] program syz-executor.7 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 117.594661] ieee80211 phy3: Selected rate control algorithm 'minstrel_ht' 10:58:16 executing program 4: perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x7, 0xfbd1) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x41) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue1\x00'}) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x0, 0x20, 0x7) write$sndseq(r1, &(0x7f0000000140)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @control}], 0xfffffdcd) syz_io_uring_setup(0xfb0, &(0x7f0000000200), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f00000001c0)=0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r4, 0x81266b6, 0x0, 0x0, 0x18}, 0x0) r5 = syz_io_uring_setup(0xb9b, &(0x7f0000000440), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f00000004c0)=0x0, &(0x7f0000000500)) syz_io_uring_setup(0x4bf1, &(0x7f0000000000)={0x0, 0x893c, 0x1, 0x1, 0x187, 0x0, r5}, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)=0x0) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000100)=@IORING_OP_POLL_REMOVE={0x7, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r8}}, 0x800) syz_io_uring_submit(r2, 0x0, &(0x7f0000000180)=@IORING_OP_FADVISE={0x18, 0x1, 0x0, @fd_index=0x5, 0x4, 0x0, 0x40, 0x2, 0x0, {0x0, r8}}, 0x0) r9 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/rpc\x00') r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='projid_map\x00') write$P9_RREADDIR(r10, 0x0, 0x0) getdents(r9, 0x0, 0x0) 10:58:16 executing program 7: r0 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x40b01, 0x0) ioctl$BLKPBSZGET(r0, 0x127b, &(0x7f0000000340)) ioctl$CDROM_TIMED_MEDIA_CHANGE(r0, 0x5396, &(0x7f0000000040)={0x7fff, 0x1}) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000003c0), 0x500, 0x0) r2 = syz_open_dev$vcsu(&(0x7f0000000380), 0x5, 0x221301) ioctl$CDROM_DEBUG(r2, 0x5330, 0x1) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r1, &(0x7f00000001c0)={0x8}) r3 = socket$netlink(0x10, 0x3, 0x10) r4 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) r5 = dup(r4) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000009effffffca6143954f35e696e380f7090be1a528f4bd69eab42cd928e01cc2715c1247b8c22731dcb2483bdec7654c1380bd27c6"]) ioctl$F2FS_IOC_RESIZE_FS(r3, 0x4008f510, &(0x7f00000004c0)=0x2) ioctl$LOOP_SET_STATUS64(0xffffffffffffffff, 0x4c04, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x5, 0x0, 0x0, "5df0cbe6fdabd2f3df4ef4f785986942cd3abde4a688ab8ac64e3fc9f1fd6b46ff5188f5b347fd4f809c95e509bd80996376c7c843b528adc48ff5476a66c4ec", "76997adcf8341a9ba908142c646d65d888d4f54577b74d6beac185359ce1537275c2c4c839569b788e610ed9e3f5c93bc62f70307ba9dd32fb8f55d16063bcae", "585f24bb3ae12d10afaf3f1a82c1b955b13ba2ce5b3c5445b7f6ef6c03d7c7ef"}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue1\x00'}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000030c0)) mmap$perf(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4, 0x50, r2, 0x9) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x5}, 0x1200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$sg(&(0x7f0000000180), 0x5, 0x10003) r6 = socket$netlink(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000400)=ANY=[@ANYBLOB="140000001d00010000000000000000000400000014a98f45357d0100d7c15cabbd7d63d35ec421d1437fb2c573d2f90f9f8d54e311394136d2fffe511eeef330b2781188e25185ffbd7c1ac2aa15d41a3594308833deeeb2b795274af0e04089f501a625bcfd1a812ba1e2233700d0ba6a2ff5918fe814ddcfb8c50e3b468820fc670522f9fbb574597387e3d57f3f0544a91ef99d18363ea8c782c250080be7318bb1fb37aa1039fa0000000000"], 0x14}], 0x1}, 0x0) 10:58:16 executing program 5: syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@random="0b06da998dff", @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x30}, @remote}, @redirect={0x8, 0x0, 0x0, @empty, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @local}}}}}}, 0x0) inotify_init1(0x0) 10:58:16 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f00000004c0)) 10:58:16 executing program 3: r0 = semget(0x2, 0x1, 0x26a) semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000000)=""/236) semctl$GETZCNT(r0, 0x1, 0xf, &(0x7f0000000100)=""/86) semctl$SEM_STAT_ANY(r0, 0x1, 0x14, &(0x7f0000000180)=""/197) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000280)={{0x3, 0x0, 0xee01, 0xee00, 0xffffffffffffffff, 0x112, 0x6}, 0xfffffffffffff99b, 0x401, 0x0, 0x0, 0x0, 0x0, 0x1}) semctl$GETVAL(0x0, 0x3, 0xc, &(0x7f0000000300)=""/212) r1 = semget$private(0x0, 0x0, 0x20) semctl$GETVAL(r1, 0x1, 0xc, &(0x7f0000000400)=""/242) 10:58:16 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) setsockopt$inet_udp_int(r0, 0x11, 0xb, &(0x7f0000000240)=0x3, 0x4) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x282, 0x0, @perf_config_ext={0x3, 0x34}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r1 = syz_open_dev$sg(&(0x7f0000001000), 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0x1, 0xd6c2}) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x4, 0x9, 0x7, 0x40, 0x0, 0xd0, 0x4800, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x7fffffff, 0x1, @perf_config_ext={0x5, 0x4}, 0x0, 0xffff, 0x8000, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffff7, 0x0, 0x7}, 0x0, 0xf, 0xffffffffffffffff, 0x2) socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000400)={{{@in6=@dev, @in6=@ipv4={""/10, ""/2, @initdev}}}, {{@in6=@mcast1}, 0x0, @in=@empty}}, &(0x7f00000001c0)=0x3c) read(0xffffffffffffffff, &(0x7f0000001040)=""/4096, 0x1000) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, &(0x7f0000000040)) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) socket$nl_audit(0x10, 0x3, 0x9) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) 10:58:16 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmmsg$inet6(r0, &(0x7f0000001840)=[{{&(0x7f00000013c0)={0xa, 0x0, 0x0, @loopback}, 0x1c, &(0x7f0000000140)=[{&(0x7f0000000000)="d7061e52", 0x4}], 0x1}}, {{&(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2}, 0x1c, &(0x7f0000001480)=[{&(0x7f0000000080)='0V', 0x2}], 0x1, &(0x7f0000001640)=[@tclass={{0x14}}], 0x18}}], 0x2, 0x0) 10:58:16 executing program 0: syz_emit_ethernet(0x46, &(0x7f0000000840)={@local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "2ddc20", 0x10, 0x6, 0x0, @local, @local, {[], @ndisc_ra}}}}}, 0x0) [ 117.750135] program syz-executor.7 is using a deprecated SCSI ioctl, please convert it to SG_IO 10:58:16 executing program 3: r0 = semget(0x2, 0x1, 0x26a) semctl$SEM_STAT_ANY(r0, 0x0, 0x14, &(0x7f0000000000)=""/236) semctl$GETZCNT(r0, 0x1, 0xf, &(0x7f0000000100)=""/86) semctl$SEM_STAT_ANY(r0, 0x1, 0x14, &(0x7f0000000180)=""/197) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000280)={{0x3, 0x0, 0xee01, 0xee00, 0xffffffffffffffff, 0x112, 0x6}, 0xfffffffffffff99b, 0x401, 0x0, 0x0, 0x0, 0x0, 0x1}) semctl$GETVAL(0x0, 0x3, 0xc, &(0x7f0000000300)=""/212) r1 = semget$private(0x0, 0x0, 0x20) semctl$GETVAL(r1, 0x1, 0xc, &(0x7f0000000400)=""/242) 10:58:16 executing program 0: syz_emit_ethernet(0x46, &(0x7f0000000840)={@local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "2ddc20", 0x10, 0x6, 0x0, @local, @local, {[], @ndisc_ra}}}}}, 0x0) [ 118.087139] ieee80211 phy4: Selected rate control algorithm 'minstrel_ht' VM DIAGNOSIS: 10:58:08 Registers: info registers vcpu 0 RAX=0000000000000001 RBX=ffff888018817988 RCX=ffff888018817a28 RDX=1ffff11003102f3c RSI=ffff888018817a20 RDI=ffffffff8135b60c RBP=ffff8880188179e0 RSP=ffff888018817968 R8 =ffffffff85e2e5be R9 =ffffffff85e2e5c2 R10=ffffed1003102f3e R11=ffff8880188179c8 R12=ffff888018817a50 R13=0000000000000000 R14=ffff888015f03580 R15=ffff88800847b280 RIP=ffffffff811d622e RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007fadc998b900 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fadc8d929e0 CR3=0000000008ee6000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff YMM01=0000000000000000 0000000000000000 3030623438613630 3638616663356134 YMM02=0000000000000000 0000000000000000 3830306234386136 3036386166633561 YMM03=0000000000000000 0000000000000000 2f6c616e72756f6a 2f676f6c2f6e7572 YMM04=0000000000000000 0000000000000000 40e0eba3edc8d937 00000000001375a0 YMM05=0000000000000000 0000000000000000 d3fdd5f48436fbd7 00000000000aead0 YMM06=0000000000000000 0000000000000000 283b68c6680096ad 00000000000ae988 YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM08=0000000000000000 0000000000000000 44495f474f4c5359 530069253d595449 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000200000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 RAX=0000000000000028 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff822b24f1 RDI=ffffffff87641b60 RBP=ffffffff87641b20 RSP=ffff88803b3bf698 R8 =0000000000000001 R9 =000000000000000a R10=0000000000000028 R11=0000000000000001 R12=0000000000000028 R13=ffffffff87641b20 R14=0000000000000010 R15=ffffffff822b24e0 RIP=ffffffff822b2549 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f3580307700 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007ffce3896399 CR3=000000003d066000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 343934312e393031 20205b203a6c656e YMM01=0000000000000000 0000000000000000 3133363631287469 6475612030303431 YMM02=0000000000000000 0000000000000000 656b207b20206465 696e656420203a63 YMM03=0000000000000000 0000000000000000 652d7a7973223d6d 6d6f632032363533 YMM04=0000000000000000 0000000000000000 2037303a38353a30 3120343120706553 YMM05=0000000000000000 0000000000000000 6576655f66726570 3d7373616c637420 YMM06=0000000000000000 0000000000000000 747379733a755f6d 65747379733d7478 YMM07=0000000000000000 0000000000000000 656b3a725f6d6574 7379733a755f6d65 YMM08=0000000000000000 0000000000000000 2e726f7475636578 652d7a7973223d6d YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000