Warning: Permanently added '[localhost]:29351' (ECDSA) to the list of known hosts.
2022/09/14 11:13:30 fuzzer started
2022/09/14 11:13:30 dialing manager at localhost:33849
syzkaller login: [ 41.196727] cgroup: Unknown subsys name 'net'
[ 41.300322] cgroup: Unknown subsys name 'rlimit'
2022/09/14 11:13:44 syscalls: 2215
2022/09/14 11:13:44 code coverage: enabled
2022/09/14 11:13:44 comparison tracing: enabled
2022/09/14 11:13:44 extra coverage: enabled
2022/09/14 11:13:44 setuid sandbox: enabled
2022/09/14 11:13:44 namespace sandbox: enabled
2022/09/14 11:13:44 Android sandbox: enabled
2022/09/14 11:13:44 fault injection: enabled
2022/09/14 11:13:44 leak checking: enabled
2022/09/14 11:13:44 net packet injection: enabled
2022/09/14 11:13:44 net device setup: enabled
2022/09/14 11:13:44 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2022/09/14 11:13:44 devlink PCI setup: PCI device 0000:00:10.0 is not available
2022/09/14 11:13:44 USB emulation: enabled
2022/09/14 11:13:44 hci packet injection: enabled
2022/09/14 11:13:44 wifi device emulation: failed to parse kernel version (6.0.0-rc5-next-20220914 )
2022/09/14 11:13:44 802.15.4 emulation: enabled
2022/09/14 11:13:44 fetching corpus: 0, signal 0/2000 (executing program)
2022/09/14 11:13:44 fetching corpus: 50, signal 29827/32810 (executing program)
2022/09/14 11:13:44 fetching corpus: 100, signal 47254/50650 (executing program)
2022/09/14 11:13:44 fetching corpus: 150, signal 54305/58429 (executing program)
2022/09/14 11:13:44 fetching corpus: 200, signal 61045/65614 (executing program)
2022/09/14 11:13:45 fetching corpus: 250, signal 67643/72372 (executing program)
2022/09/14 11:13:45 fetching corpus: 300, signal 73734/78421 (executing program)
2022/09/14 11:13:45 fetching corpus: 350, signal 79374/83976 (executing program)
2022/09/14 11:13:45 fetching corpus: 400, signal 82531/87173 (executing program)
2022/09/14 11:13:45 fetching corpus: 450, signal 88044/92096 (executing program)
2022/09/14 11:13:45 fetching corpus: 500, signal 92097/95639 (executing program)
2022/09/14 11:13:46 fetching corpus: 550, signal 95814/98935 (executing program)
2022/09/14 11:13:46 fetching corpus: 600, signal 99102/101865 (executing program)
2022/09/14 11:13:46 fetching corpus: 650, signal 102577/104636 (executing program)
2022/09/14 11:13:46 fetching corpus: 700, signal 105681/107158 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/107416 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/107498 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/107580 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/107672 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/107760 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/107856 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/107950 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/108039 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/108121 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/108200 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/108305 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/108394 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/108485 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/108571 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/108666 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/108752 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/108840 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/108932 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/109031 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/109117 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/109216 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/109301 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/109400 (executing program)
2022/09/14 11:13:46 fetching corpus: 706, signal 105940/109476 (executing program)
2022/09/14 11:13:47 fetching corpus: 706, signal 105940/109568 (executing program)
2022/09/14 11:13:47 fetching corpus: 706, signal 105940/109669 (executing program)
2022/09/14 11:13:47 fetching corpus: 706, signal 105940/109764 (executing program)
2022/09/14 11:13:47 fetching corpus: 706, signal 105940/109850 (executing program)
2022/09/14 11:13:47 fetching corpus: 706, signal 105940/109943 (executing program)
2022/09/14 11:13:47 fetching corpus: 706, signal 105940/110033 (executing program)
2022/09/14 11:13:47 fetching corpus: 706, signal 105940/110131 (executing program)
2022/09/14 11:13:47 fetching corpus: 706, signal 105940/110212 (executing program)
2022/09/14 11:13:47 fetching corpus: 706, signal 105940/110331 (executing program)
2022/09/14 11:13:47 fetching corpus: 706, signal 105940/110378 (executing program)
2022/09/14 11:13:47 fetching corpus: 706, signal 105940/110378 (executing program)
2022/09/14 11:13:49 starting 8 fuzzer processes
11:13:49 executing program 0:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/locks\x00', 0x0, 0x0)
preadv(r0, &(0x7f00000003c0)=[{&(0x7f0000000000)=""/139, 0x8b}], 0x1, 0x8, 0x0)
11:13:49 executing program 1:
write$selinux_attr(0xffffffffffffffff, &(0x7f0000000000)='system_u:object_r:apt_var_log_t:s0\x00', 0x23)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'})
ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f00000001c0)=ANY=[@ANYBLOB="010011"])
11:13:49 executing program 2:
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x0)
ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, 0x0)
11:13:49 executing program 5:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x9d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
flistxattr(r0, 0x0, 0x0)
11:13:49 executing program 3:
syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000000)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="2c7766646e6f3d014f29ef99ad8b2ee6ab88d3ddf9f64fb3263bd7d202acf75f549842835dcf4ecacd3bf6ef28ae3dc96c80ff23", @ANYRESHEX, @ANYBLOB=',\x00'])
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f0000000240)={0xc0000008})
epoll_wait(0xffffffffffffffff, &(0x7f0000000300)=[{}, {}, {}], 0x3, 0x5)
fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000180)=']{\x00', 0x0, r0)
acct(&(0x7f00000001c0)='./file1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/mdstat\x00', 0x0, 0x0)
ioctl$AUTOFS_IOC_EXPIRE(0xffffffffffffffff, 0x810c9365, &(0x7f0000000340)={{0x101, 0x7}, 0x100, './file1\x00'})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = fsopen(&(0x7f0000000040)='rpc_pipefs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r3, 0x6, 0x0, 0x0, 0x0)
fsmount(r3, 0x0, 0x0)
11:13:49 executing program 6:
r0 = syz_mount_image$tmpfs(&(0x7f00000006c0), &(0x7f0000000700)='./file0\x00', 0x0, 0x0, 0x0, 0x1, &(0x7f0000000b80)=ANY=[])
fsetxattr(r0, 0x0, 0x0, 0x0, 0x0)
11:13:49 executing program 4:
r0 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0x1, 0x4)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c)
setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4)
sendmmsg$inet6(r0, &(0x7f0000002fc0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)="2aed6b2e912b9b602fb9d8f259d4c688fd6bea53c8134f5a03dcd57f96c7e9e918aec068a10c1f40e570d5f1b1a1cead337e49a95835c9385c30b5bf203f05032df110bce50a656a9c2f030b5ea70a70c7313dc626480d1b8077fe1522b851504fe8380e91196e523a8658165761f7e3457b0e401d62ff0f844e3a1d77426edfd17df7d600b20713f02f1fe3fe8b47c15deefc12b753ad5ccd9505d6f21a73db73e887", 0xa3}, {&(0x7f0000000200)="03f67ae6b8ad23ed9a712d8c9040e430a6b1ccaa027e8dea10fa438db0307c66f18ece952d5ee12abb53f52fe9a706aea3d873996316356bf81be138aad04eb5ff3a1f01128181e977c5a6e4b606cfca35d49e0e55bc22bd0cdb38302efd786d00529ecfce5044ee83b934ec2c", 0x6d}, {&(0x7f0000000280)="dc0f3025220dd22e59a8379a40ba57a2ba8812efc31672a461339ace6107a263a69ba84ee4b34f90e951c1256169c039ecde889e9f253f2b9cca9ada9c3050b88b67a42814394b1a60a68c0c34cf21ba2af90d9340f729080f496a833ea7f88269a09a275f188329be91e75a4781ebf4af525232a825d1017f0c6ec88609ae4d97dafdb249b0f00f714b39737c64", 0x8e}], 0x3}}, {{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000600)="b41d23ce3c4343be62d292f5400966ce32c95319c3d69beaa06b1feaa4f7e2623ff664ae696df81d86ac626371460d7183febfa45e7c9ab7d32eec64178835f6316a2965a627e3d652fee419959e41f08cd0e2ea3887f05b4118beb38da9669a072428f0c8998d3591743a0daa9e0fa5f3853ca59c604a987c0574", 0x7b}], 0x1}}], 0x2, 0x4000001)
setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000), 0x4)
[ 60.023733] audit: type=1400 audit(1663154029.431:6): avc: denied { execmem } for pid=283 comm="syz-executor.0" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
11:13:49 executing program 7:
openat$hwrng(0xffffffffffffff9c, 0x0, 0x420280, 0x0)
[ 61.262058] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 61.265140] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 61.266695] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 61.270336] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 61.273308] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 61.274683] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 61.280393] Bluetooth: hci0: HCI_REQ-0x0c1a
[ 61.307824] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 61.309483] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 61.312182] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 61.317202] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 61.319948] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[ 61.321382] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 61.329871] Bluetooth: hci1: HCI_REQ-0x0c1a
[ 61.403004] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 61.417380] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 61.418973] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 61.421112] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[ 61.422561] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 61.424163] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 61.425314] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 61.426367] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[ 61.427464] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 61.428825] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 61.430058] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[ 61.431145] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 61.434636] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[ 61.440324] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 61.441467] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 61.442682] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[ 61.443706] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 61.447411] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[ 61.449404] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[ 61.450215] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3
[ 61.451099] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[ 61.452726] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[ 61.452969] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 61.455864] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[ 61.457829] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 61.458001] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[ 61.460326] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 61.464711] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[ 61.466201] Bluetooth: hci4: HCI_REQ-0x0c1a
[ 61.472047] Bluetooth: hci2: HCI_REQ-0x0c1a
[ 61.484106] Bluetooth: hci3: HCI_REQ-0x0c1a
[ 61.486328] Bluetooth: hci6: HCI_REQ-0x0c1a
[ 61.521017] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3
[ 61.522734] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[ 61.535538] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[ 61.536901] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[ 61.539899] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[ 61.545190] Bluetooth: hci5: HCI_REQ-0x0c1a
[ 61.582168] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[ 61.587635] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3
[ 61.596699] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[ 61.621358] Bluetooth: hci7: HCI_REQ-0x0c1a
[ 63.351119] Bluetooth: hci1: command 0x0409 tx timeout
[ 63.352022] Bluetooth: hci0: command 0x0409 tx timeout
[ 63.478876] Bluetooth: hci4: command 0x0409 tx timeout
[ 63.542930] Bluetooth: hci2: command 0x0409 tx timeout
[ 63.543843] Bluetooth: hci6: command 0x0409 tx timeout
[ 63.544359] Bluetooth: hci3: command 0x0409 tx timeout
[ 63.606792] Bluetooth: hci5: command 0x0409 tx timeout
[ 63.670792] Bluetooth: hci7: command 0x0409 tx timeout
[ 65.399818] Bluetooth: hci0: command 0x041b tx timeout
[ 65.400358] Bluetooth: hci1: command 0x041b tx timeout
[ 65.526868] Bluetooth: hci4: command 0x041b tx timeout
[ 65.590937] Bluetooth: hci3: command 0x041b tx timeout
[ 65.592096] Bluetooth: hci6: command 0x041b tx timeout
[ 65.594565] Bluetooth: hci2: command 0x041b tx timeout
[ 65.654836] Bluetooth: hci5: command 0x041b tx timeout
[ 65.718898] Bluetooth: hci7: command 0x041b tx timeout
[ 67.448420] Bluetooth: hci1: command 0x040f tx timeout
[ 67.448976] Bluetooth: hci0: command 0x040f tx timeout
[ 67.575782] Bluetooth: hci4: command 0x040f tx timeout
[ 67.638815] Bluetooth: hci2: command 0x040f tx timeout
[ 67.639343] Bluetooth: hci6: command 0x040f tx timeout
[ 67.640443] Bluetooth: hci3: command 0x040f tx timeout
[ 67.702820] Bluetooth: hci5: command 0x040f tx timeout
[ 67.766788] Bluetooth: hci7: command 0x040f tx timeout
[ 69.494819] Bluetooth: hci0: command 0x0419 tx timeout
[ 69.495323] Bluetooth: hci1: command 0x0419 tx timeout
[ 69.623792] Bluetooth: hci4: command 0x0419 tx timeout
[ 69.687844] Bluetooth: hci3: command 0x0419 tx timeout
[ 69.688526] Bluetooth: hci6: command 0x0419 tx timeout
[ 69.688990] Bluetooth: hci2: command 0x0419 tx timeout
[ 69.751838] Bluetooth: hci5: command 0x0419 tx timeout
[ 69.815783] Bluetooth: hci7: command 0x0419 tx timeout
11:14:47 executing program 1:
write$selinux_attr(0xffffffffffffffff, &(0x7f0000000000)='system_u:object_r:apt_var_log_t:s0\x00', 0x23)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'})
ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f00000001c0)=ANY=[@ANYBLOB="010011"])
[ 118.193676] loop3: detected capacity change from 0 to 40
11:14:47 executing program 1:
write$selinux_attr(0xffffffffffffffff, &(0x7f0000000000)='system_u:object_r:apt_var_log_t:s0\x00', 0x23)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'})
ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f00000001c0)=ANY=[@ANYBLOB="010011"])
[ 118.217432] audit: type=1400 audit(1663154087.625:7): avc: denied { open } for pid=3781 comm="syz-executor.3" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[ 118.218955] audit: type=1400 audit(1663154087.625:8): avc: denied { kernel } for pid=3781 comm="syz-executor.3" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
[ 118.245673] ------------[ cut here ]------------
[ 118.245694]
[ 118.245698] ======================================================
[ 118.245701] WARNING: possible circular locking dependency detected
[ 118.245706] 6.0.0-rc5-next-20220914 #1 Not tainted
[ 118.245713] ------------------------------------------------------
[ 118.245716] syz-executor.3/3783 is trying to acquire lock:
[ 118.245722] ffffffff853fa878 ((console_sem).lock){....}-{2:2}, at: down_trylock+0xe/0x70
[ 118.245764]
[ 118.245764] but task is already holding lock:
[ 118.245767] ffff88800e88e820 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_out+0x53b/0x18d0
[ 118.245795]
[ 118.245795] which lock already depends on the new lock.
[ 118.245795]
[ 118.245799]
[ 118.245799] the existing dependency chain (in reverse order) is:
[ 118.245802]
[ 118.245802] -> #3 (&ctx->lock){....}-{2:2}:
[ 118.245816] _raw_spin_lock+0x2a/0x40
[ 118.245833] __perf_event_task_sched_out+0x53b/0x18d0
[ 118.245846] __schedule+0xedd/0x2470
[ 118.245856] preempt_schedule_common+0x45/0xc0
[ 118.245868] __cond_resched+0x17/0x30
[ 118.245878] __mutex_lock+0xa3/0x14d0
[ 118.245889] __do_sys_perf_event_open+0x1eec/0x32c0
[ 118.245902] do_syscall_64+0x3b/0x90
[ 118.245916] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 118.245933]
[ 118.245933] -> #2 (&rq->__lock){-.-.}-{2:2}:
[ 118.245947] _raw_spin_lock_nested+0x30/0x40
[ 118.245961] raw_spin_rq_lock_nested+0x1e/0x30
[ 118.245974] task_fork_fair+0x63/0x4d0
[ 118.245991] sched_cgroup_fork+0x3d0/0x540
[ 118.246005] copy_process+0x4183/0x6e20
[ 118.246016] kernel_clone+0xe7/0x890
[ 118.246025] user_mode_thread+0xad/0xf0
[ 118.246036] rest_init+0x24/0x250
[ 118.246051] arch_call_rest_init+0xf/0x14
[ 118.246064] start_kernel+0x4c1/0x4e6
[ 118.246074] secondary_startup_64_no_verify+0xe0/0xeb
[ 118.246088]
[ 118.246088] -> #1 (&p->pi_lock){-.-.}-{2:2}:
[ 118.246101] _raw_spin_lock_irqsave+0x39/0x60
[ 118.246116] try_to_wake_up+0xab/0x1920
[ 118.246129] up+0x75/0xb0
[ 118.246140] __up_console_sem+0x6e/0x80
[ 118.246156] console_unlock+0x46a/0x590
[ 118.246171] do_con_write+0xc05/0x1d50
[ 118.246183] con_write+0x21/0x40
[ 118.246192] n_tty_write+0x4d4/0xfe0
[ 118.246205] file_tty_write.constprop.0+0x49c/0x8f0
[ 118.246217] vfs_write+0x9c3/0xd90
[ 118.246235] ksys_write+0x127/0x250
[ 118.246251] do_syscall_64+0x3b/0x90
[ 118.246264] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 118.246280]
[ 118.246280] -> #0 ((console_sem).lock){....}-{2:2}:
[ 118.246294] __lock_acquire+0x2a02/0x5e70
[ 118.246310] lock_acquire+0x1a2/0x530
[ 118.246325] _raw_spin_lock_irqsave+0x39/0x60
[ 118.246340] down_trylock+0xe/0x70
[ 118.246352] __down_trylock_console_sem+0x3b/0xd0
[ 118.246367] vprintk_emit+0x16b/0x560
[ 118.246383] vprintk+0x84/0xa0
[ 118.246399] _printk+0xba/0xf1
[ 118.246416] report_bug.cold+0x72/0xab
[ 118.246428] handle_bug+0x3c/0x70
[ 118.246441] exc_invalid_op+0x14/0x50
[ 118.246454] asm_exc_invalid_op+0x16/0x20
[ 118.246469] group_sched_out.part.0+0x2c7/0x460
[ 118.246480] ctx_sched_out+0x8f1/0xc10
[ 118.246489] __perf_event_task_sched_out+0x6d0/0x18d0
[ 118.246501] __schedule+0xedd/0x2470
[ 118.246511] preempt_schedule_common+0x45/0xc0
[ 118.246522] __cond_resched+0x17/0x30
[ 118.246532] __mutex_lock+0xa3/0x14d0
[ 118.246543] __do_sys_perf_event_open+0x1eec/0x32c0
[ 118.246555] do_syscall_64+0x3b/0x90
[ 118.246568] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 118.246584]
[ 118.246584] other info that might help us debug this:
[ 118.246584]
[ 118.246587] Chain exists of:
[ 118.246587] (console_sem).lock --> &rq->__lock --> &ctx->lock
[ 118.246587]
[ 118.246602] Possible unsafe locking scenario:
[ 118.246602]
[ 118.246604] CPU0 CPU1
[ 118.246607] ---- ----
[ 118.246609] lock(&ctx->lock);
[ 118.246615] lock(&rq->__lock);
[ 118.246621] lock(&ctx->lock);
[ 118.246627] lock((console_sem).lock);
[ 118.246633]
[ 118.246633] *** DEADLOCK ***
[ 118.246633]
[ 118.246635] 2 locks held by syz-executor.3/3783:
[ 118.246642] #0: ffff88806cf37cd8 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x1cf/0x2470
[ 118.246667] #1: ffff88800e88e820 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_out+0x53b/0x18d0
[ 118.246695]
[ 118.246695] stack backtrace:
[ 118.246697] CPU: 1 PID: 3783 Comm: syz-executor.3 Not tainted 6.0.0-rc5-next-20220914 #1
[ 118.246710] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 118.246718] Call Trace:
[ 118.246722]
[ 118.246726] dump_stack_lvl+0x8b/0xb3
[ 118.246741] check_noncircular+0x263/0x2e0
[ 118.246757] ? format_decode+0x26c/0xb50
[ 118.246773] ? print_circular_bug+0x450/0x450
[ 118.246789] ? enable_ptr_key_workfn+0x20/0x20
[ 118.246803] ? lock_release+0x547/0x750
[ 118.246820] ? format_decode+0x26c/0xb50
[ 118.246835] ? alloc_chain_hlocks+0x1ec/0x5a0
[ 118.246852] __lock_acquire+0x2a02/0x5e70
[ 118.246873] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 118.246895] lock_acquire+0x1a2/0x530
[ 118.246911] ? down_trylock+0xe/0x70
[ 118.246926] ? rcu_read_unlock+0x40/0x40
[ 118.246946] ? vprintk+0x84/0xa0
[ 118.246963] _raw_spin_lock_irqsave+0x39/0x60
[ 118.246979] ? down_trylock+0xe/0x70
[ 118.246992] down_trylock+0xe/0x70
[ 118.247005] ? vprintk+0x84/0xa0
[ 118.247021] __down_trylock_console_sem+0x3b/0xd0
[ 118.247038] vprintk_emit+0x16b/0x560
[ 118.247057] vprintk+0x84/0xa0
[ 118.247074] _printk+0xba/0xf1
[ 118.247091] ? record_print_text.cold+0x16/0x16
[ 118.247112] ? report_bug.cold+0x66/0xab
[ 118.247126] ? group_sched_out.part.0+0x2c7/0x460
[ 118.247138] report_bug.cold+0x72/0xab
[ 118.247152] handle_bug+0x3c/0x70
[ 118.247166] exc_invalid_op+0x14/0x50
[ 118.247180] asm_exc_invalid_op+0x16/0x20
[ 118.247197] RIP: 0010:group_sched_out.part.0+0x2c7/0x460
[ 118.247211] Code: 5e 41 5f e9 3b b7 ef ff e8 36 b7 ef ff 65 8b 1d ab 15 ac 7e 31 ff 89 de e8 d6 b3 ef ff 85 db 0f 84 8a 00 00 00 e8 19 b7 ef ff <0f> 0b e9 a5 fe ff ff e8 0d b7 ef ff 48 8d 7d 10 48 b8 00 00 00 00
[ 118.247224] RSP: 0018:ffff88803cfbf978 EFLAGS: 00010006
[ 118.247233] RAX: 0000000040000002 RBX: 0000000000000000 RCX: 0000000000000000
[ 118.247240] RDX: ffff888015f68000 RSI: ffffffff81566027 RDI: 0000000000000005
[ 118.247248] RBP: ffff88803cff8000 R08: 0000000000000005 R09: 0000000000000001
[ 118.247255] R10: 0000000000000000 R11: ffffffff865ac05b R12: ffff88800e88e800
[ 118.247263] R13: ffff88806cf3d100 R14: ffffffff8547c660 R15: 0000000000000002
[ 118.247274] ? group_sched_out.part.0+0x2c7/0x460
[ 118.247287] ? group_sched_out.part.0+0x2c7/0x460
[ 118.247300] ctx_sched_out+0x8f1/0xc10
[ 118.247313] __perf_event_task_sched_out+0x6d0/0x18d0
[ 118.247328] ? lock_is_held_type+0xd7/0x130
[ 118.247346] ? __perf_cgroup_move+0x160/0x160
[ 118.247358] ? set_next_entity+0x304/0x550
[ 118.247375] ? update_curr+0x267/0x740
[ 118.247393] ? lock_is_held_type+0xd7/0x130
[ 118.247411] __schedule+0xedd/0x2470
[ 118.247424] ? io_schedule_timeout+0x150/0x150
[ 118.247435] ? find_held_lock+0x2c/0x110
[ 118.247451] ? lock_is_held_type+0xd7/0x130
[ 118.247469] ? __cond_resched+0x17/0x30
[ 118.247480] preempt_schedule_common+0x45/0xc0
[ 118.247493] __cond_resched+0x17/0x30
[ 118.247503] __mutex_lock+0xa3/0x14d0
[ 118.247516] ? lock_is_held_type+0xd7/0x130
[ 118.247533] ? __do_sys_perf_event_open+0x1eec/0x32c0
[ 118.247548] ? mutex_lock_io_nested+0x1310/0x1310
[ 118.247560] ? lock_release+0x3b2/0x750
[ 118.247577] ? __up_read+0x192/0x730
[ 118.247591] ? up_write+0x480/0x480
[ 118.247606] ? _raw_spin_unlock_irqrestore+0x28/0x60
[ 118.247624] __do_sys_perf_event_open+0x1eec/0x32c0
[ 118.247641] ? perf_compat_ioctl+0x130/0x130
[ 118.247653] ? xfd_validate_state+0x59/0x180
[ 118.247676] ? syscall_enter_from_user_mode+0x1d/0x50
[ 118.247694] ? syscall_enter_from_user_mode+0x1d/0x50
[ 118.247713] do_syscall_64+0x3b/0x90
[ 118.247727] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 118.247744] RIP: 0033:0x7fc6816bcb19
[ 118.247753] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 118.247764] RSP: 002b:00007fc67ec32188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
[ 118.247775] RAX: ffffffffffffffda RBX: 00007fc6817cff60 RCX: 00007fc6816bcb19
[ 118.247783] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000080
[ 118.247790] RBP: 00007fc681716f6d R08: 0000000000000000 R09: 0000000000000000
[ 118.247797] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
[ 118.247805] R13: 00007fff6830cf0f R14: 00007fc67ec32300 R15: 0000000000022000
[ 118.247817]
[ 118.309469] WARNING: CPU: 1 PID: 3783 at kernel/events/core.c:2309 group_sched_out.part.0+0x2c7/0x460
[ 118.310159] Modules linked in:
[ 118.310407] CPU: 1 PID: 3783 Comm: syz-executor.3 Not tainted 6.0.0-rc5-next-20220914 #1
[ 118.311000] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 118.311831] RIP: 0010:group_sched_out.part.0+0x2c7/0x460
[ 118.312234] Code: 5e 41 5f e9 3b b7 ef ff e8 36 b7 ef ff 65 8b 1d ab 15 ac 7e 31 ff 89 de e8 d6 b3 ef ff 85 db 0f 84 8a 00 00 00 e8 19 b7 ef ff <0f> 0b e9 a5 fe ff ff e8 0d b7 ef ff 48 8d 7d 10 48 b8 00 00 00 00
[ 118.313581] RSP: 0018:ffff88803cfbf978 EFLAGS: 00010006
[ 118.313969] RAX: 0000000040000002 RBX: 0000000000000000 RCX: 0000000000000000
[ 118.314490] RDX: ffff888015f68000 RSI: ffffffff81566027 RDI: 0000000000000005
[ 118.315012] RBP: ffff88803cff8000 R08: 0000000000000005 R09: 0000000000000001
[ 118.315536] R10: 0000000000000000 R11: ffffffff865ac05b R12: ffff88800e88e800
[ 118.316062] R13: ffff88806cf3d100 R14: ffffffff8547c660 R15: 0000000000000002
[ 118.316591] FS: 00007fc67ec32700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
[ 118.317181] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 118.317621] CR2: 00007ff2fbddfb70 CR3: 000000001b3a0000 CR4: 0000000000350ee0
[ 118.318152] Call Trace:
[ 118.318347]
[ 118.318523] ctx_sched_out+0x8f1/0xc10
[ 118.318820] __perf_event_task_sched_out+0x6d0/0x18d0
[ 118.319210] ? lock_is_held_type+0xd7/0x130
[ 118.319541] ? __perf_cgroup_move+0x160/0x160
[ 118.319874] ? set_next_entity+0x304/0x550
[ 118.320191] ? update_curr+0x267/0x740
[ 118.320489] ? lock_is_held_type+0xd7/0x130
[ 118.320822] __schedule+0xedd/0x2470
[ 118.321109] ? io_schedule_timeout+0x150/0x150
[ 118.321463] ? find_held_lock+0x2c/0x110
[ 118.321783] ? lock_is_held_type+0xd7/0x130
[ 118.322114] ? __cond_resched+0x17/0x30
[ 118.322414] preempt_schedule_common+0x45/0xc0
[ 118.322758] __cond_resched+0x17/0x30
[ 118.323047] __mutex_lock+0xa3/0x14d0
[ 118.323338] ? lock_is_held_type+0xd7/0x130
[ 118.323665] ? __do_sys_perf_event_open+0x1eec/0x32c0
[ 118.324050] ? mutex_lock_io_nested+0x1310/0x1310
[ 118.324408] ? lock_release+0x3b2/0x750
[ 118.324712] ? __up_read+0x192/0x730
[ 118.325002] ? up_write+0x480/0x480
[ 118.325280] ? _raw_spin_unlock_irqrestore+0x28/0x60
[ 118.325672] __do_sys_perf_event_open+0x1eec/0x32c0
[ 118.326046] ? perf_compat_ioctl+0x130/0x130
[ 118.326382] ? xfd_validate_state+0x59/0x180
[ 118.326723] ? syscall_enter_from_user_mode+0x1d/0x50
[ 118.327116] ? syscall_enter_from_user_mode+0x1d/0x50
[ 118.327514] do_syscall_64+0x3b/0x90
[ 118.327801] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 118.328193] RIP: 0033:0x7fc6816bcb19
[ 118.328469] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 118.329823] RSP: 002b:00007fc67ec32188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
[ 118.330385] RAX: ffffffffffffffda RBX: 00007fc6817cff60 RCX: 00007fc6816bcb19
[ 118.330905] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000080
[ 118.331433] RBP: 00007fc681716f6d R08: 0000000000000000 R09: 0000000000000000
[ 118.331959] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
[ 118.332488] R13: 00007fff6830cf0f R14: 00007fc67ec32300 R15: 0000000000022000
[ 118.333017]
[ 118.333196] irq event stamp: 2286
[ 118.333463] hardirqs last enabled at (2285): [] _raw_spin_unlock_irqrestore+0x28/0x60
[ 118.334170] hardirqs last disabled at (2286): [] __schedule+0x1225/0x2470
[ 118.334796] softirqs last enabled at (2030): [] __irq_exit_rcu+0x11b/0x180
[ 118.335430] softirqs last disabled at (1973): [] __irq_exit_rcu+0x11b/0x180
[ 118.336067] ---[ end trace 0000000000000000 ]---
11:14:47 executing program 1:
write$selinux_attr(0xffffffffffffffff, &(0x7f0000000000)='system_u:object_r:apt_var_log_t:s0\x00', 0x23)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'})
ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f00000001c0)=ANY=[@ANYBLOB="010011"])
11:14:48 executing program 1:
write$selinux_attr(0xffffffffffffffff, &(0x7f0000000000)='system_u:object_r:apt_var_log_t:s0\x00', 0x23)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'})
ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f00000001c0)=ANY=[@ANYBLOB="010011"])
11:14:48 executing program 1:
write$selinux_attr(0xffffffffffffffff, &(0x7f0000000000)='system_u:object_r:apt_var_log_t:s0\x00', 0x23)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'})
ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f00000001c0)=ANY=[@ANYBLOB="010011"])
[ 118.761440] loop3: detected capacity change from 0 to 40
11:14:48 executing program 1:
write$selinux_attr(0xffffffffffffffff, &(0x7f0000000000)='system_u:object_r:apt_var_log_t:s0\x00', 0x23)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00'})
ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f00000001c0)=ANY=[@ANYBLOB="010011"])
[ 118.881408] Process accounting resumed
11:14:48 executing program 3:
syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000000)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="2c7766646e6f3d014f29ef99ad8b2ee6ab88d3ddf9f64fb3263bd7d202acf75f549842835dcf4ecacd3bf6ef28ae3dc96c80ff23", @ANYRESHEX, @ANYBLOB=',\x00'])
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f0000000240)={0xc0000008})
epoll_wait(0xffffffffffffffff, &(0x7f0000000300)=[{}, {}, {}], 0x3, 0x5)
fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000180)=']{\x00', 0x0, r0)
acct(&(0x7f00000001c0)='./file1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/mdstat\x00', 0x0, 0x0)
ioctl$AUTOFS_IOC_EXPIRE(0xffffffffffffffff, 0x810c9365, &(0x7f0000000340)={{0x101, 0x7}, 0x100, './file1\x00'})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = fsopen(&(0x7f0000000040)='rpc_pipefs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r3, 0x6, 0x0, 0x0, 0x0)
fsmount(r3, 0x0, 0x0)
[ 118.923581] loop3: detected capacity change from 0 to 40
11:14:48 executing program 7:
syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000000)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0xa015000)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002480)='fd/3\x00')
mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB="2c7766646e6f3d014f29ef99ad8b2ee6ab88d3ddf9f64fb3263bd7d202acf75f549842835dcf4ecacd3bf6ef28ae3dc96c80ff23", @ANYRESHEX, @ANYBLOB=',\x00'])
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f0000000240)={0xc0000008})
epoll_wait(0xffffffffffffffff, &(0x7f0000000300)=[{}, {}, {}], 0x3, 0x5)
fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000180)=']{\x00', 0x0, r0)
acct(&(0x7f00000001c0)='./file1\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/mdstat\x00', 0x0, 0x0)
ioctl$AUTOFS_IOC_EXPIRE(0xffffffffffffffff, 0x810c9365, &(0x7f0000000340)={{0x101, 0x7}, 0x100, './file1\x00'})
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = fsopen(&(0x7f0000000040)='rpc_pipefs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r3, 0x6, 0x0, 0x0, 0x0)
fsmount(r3, 0x0, 0x0)
[ 119.056111] loop7: detected capacity change from 0 to 40
[ 119.150633] Process accounting resumed
[ 119.186321] Process accounting resumed
[ 120.194667] syz-executor.2 (298) used greatest stack depth: 24544 bytes left
[ 124.406794] Bluetooth: hci0: Opcode 0x c03 failed: -110
[ 124.534785] Bluetooth: hci7: Opcode 0x c03 failed: -110
[ 124.535778] Bluetooth: hci6: Opcode 0x c03 failed: -110
[ 124.535943] Bluetooth: hci2: Opcode 0x c03 failed: -110
VM DIAGNOSIS:
11:14:47 Registers:
info registers vcpu 0
RAX=1ffffffff0b74cf5 RBX=ffffffff85ba67ac RCX=ffffffff816377ce RDX=0000000000000000
RSI=ffffffff85ebf94a RDI=ffffffff85ba6784 RBP=ffffffff85ba67ac RSP=ffff88801bdaf360
R8 =ffffffff85ebf94a R9 =ffffffff85ecb7ec R10=ffffed10037b5e92 R11=000000000003603d
R12=ffffffff85ba67ac R13=ffffffff85ba6784 R14=ffffffff85ba67a8 R15=dffffc0000000000
RIP=ffffffff8111ac7f RFL=00000217 [----APC] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff88806ce00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007fa88a55d1f0 CR3=000000003cb12000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 756e696c2d34365f 3638782f62696c2f
YMM01=0000000000000000 0000000000000000 6461657268747062 696c2f756e672d78
YMM02=0000000000000000 0000000000000000 00302e6f732e6461 657268747062696c
YMM03=0000000000000000 0000000000000000 2f756e672d78756e 696c2d34365f3638
YMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000
info registers vcpu 1
RAX=0000000000000067 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff822b24f1 RDI=ffffffff87641b60 RBP=ffffffff87641b20 RSP=ffff88803cfbf3c8
R8 =0000000000000001 R9 =000000000000000a R10=0000000000000067 R11=0000000000000001
R12=0000000000000067 R13=ffffffff87641b20 R14=0000000000000010 R15=ffffffff822b24e0
RIP=ffffffff822b2549 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007fc67ec32700 00000000 00000000
GS =0000 ffff88806cf00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007ff2fbddfb70 CR3=000000001b3a0000 CR4=00350ee0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM01=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff
YMM02=0000000000000000 0000000000000000 00524f5252450040 0000000000000000
YMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM04=0000000000000000 0000000000000000 0000000000000000 00000000000000ff
YMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM06=0000000000000000 0000000000000000 0000000000000000 000000524f525245
YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM08=0000000000000000 0000000000000000 0000000000000000 00524f5252450040
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000