./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2927282040

<...>
Warning: Permanently added '10.128.1.5' (ED25519) to the list of known hosts.
execve("./syz-executor2927282040", ["./syz-executor2927282040"], 0x7ffc9dcd9d90 /* 10 vars */) = 0
brk(NULL)                               = 0x55558c566000
brk(0x55558c566d40)                     = 0x55558c566d40
arch_prctl(ARCH_SET_FS, 0x55558c5663c0) = 0
set_tid_address(0x55558c566690)         = 5079
set_robust_list(0x55558c5666a0, 24)     = 0
rseq(0x55558c566ce0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2927282040", 4096) = 28
getrandom("\xa0\x80\x64\x09\xab\x89\x62\x16", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55558c566d40
brk(0x55558c587d40)                     = 0x55558c587d40
brk(0x55558c588000)                     = 0x55558c588000
mprotect(0x7f9e056dc000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558c566690) = 5080
./strace-static-x86_64: Process 5080 attached
[pid  5080] set_robust_list(0x55558c5666a0, 24) = 0
[pid  5080] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5080] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3
[pid  5080] openat(AT_FDCWD, "/dev/vhci", O_RDWR) = 4
[pid  5080] dup2(4, 202)                = 202
[pid  5080] close(4)                    = 0
[pid  5080] write(202, "\xff\x00", 2)   = 2
[pid  5080] read(202, "\xff\x00\x00\x00", 4) = 4
[pid  5080] rt_sigaction(SIGRT_1, {sa_handler=0x7f9e0567dc90, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9e0566f310}, NULL, 8) = 0
[pid  5080] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid  5080] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9e04e00000
[pid  5080] mprotect(0x7f9e04e01000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5080] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5080] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9e05600990, parent_tid=0x7f9e05600990, exit_signal=0, stack=0x7f9e04e00000, stack_size=0x800300, tls=0x7f9e056006c0}./strace-static-x86_64: Process 5083 attached
 <unfinished ...>
[pid  5083] rseq(0x7f9e05600fe0, 0x20, 0, 0x53053053 <unfinished ...>
[pid  5080] <... clone3 resumed> => {parent_tid=[2]}, 88) = 2
[pid  5080] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid  5083] <... rseq resumed>)         = 0
[pid  5080] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid  5083] set_robust_list(0x7f9e056009a0, 24 <unfinished ...>
[pid  5080] ioctl(3, HCIDEVUP <unfinished ...>
[pid  5083] <... set_robust_list resumed>) = 0
[pid  5083] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5083] read(202, "\x01\x03\x0c\x00", 1024) = 4
[pid  5083] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5083] read(202, "\x01\x03\x10\x00", 1024) = 4
[pid  5083] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5083] read(202, "\x01\x01\x10\x00", 1024) = 4
[pid  5083] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5083] read(202, "\x01\x09\x10\x00", 1024) = 4
[pid  5083] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4) = 13
[pid  5083] read(202, "\x01\x05\x10\x00", 1024) = 4
[pid  5083] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4) = 14
[pid  5083] read(202, "\x01\x23\x0c\x00", 1024) = 4
[   56.163608][   T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   56.184057][   T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   56.202342][   T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[pid  5083] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5083] read(202, "\x01\x14\x0c\x00", 1024) = 4
[pid  5083] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5083] read(202, "\x01\x25\x0c\x00", 1024) = 4
[pid  5083] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5083] read(202, "\x01\x38\x0c\x00", 1024) = 4
[pid  5083] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[   56.236767][   T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   56.266791][   T52] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[pid  5083] read(202, "\x01\x39\x0c\x00", 1024) = 4
[pid  5083] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5083] read(202, "\x01\x16\x0c\x02\x00\x7d", 1024) = 6
[pid  5083] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5083] read(202,  <unfinished ...>
[pid  5080] <... ioctl resumed>, 0)     = -1 EALREADY (Operation already in progress)
[pid  5080] ioctl(3, HCISETSCAN <unfinished ...>
[pid  5083] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5
[pid  5083] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4) = 7
[pid  5083] rt_sigprocmask(SIG_BLOCK, ~[RT_1],  <unfinished ...>
[pid  5080] <... ioctl resumed>, 0x7fff65d8cfcc) = 0
[   56.285160][   T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[pid  5083] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid  5080] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3 <unfinished ...>
[pid  5083] madvise(0x7f9e04e00000, 8372224, MADV_DONTNEED <unfinished ...>
[pid  5080] <... writev resumed>)       = 13
[pid  5080] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3) = 14
[pid  5083] <... madvise resumed>)      = 0
[pid  5083] exit(0 <unfinished ...>
[pid  5080] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3 <unfinished ...>
[pid  5083] <... exit resumed>)         = ?
[pid  5080] <... writev resumed>)       = 14
[pid  5083] +++ exited with 0 +++
[pid  5080] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22
[pid  5080] close(3)                    = 0
[pid  5080] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5080] setsid()                    = 1
[pid  5080] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5080] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5080] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5080] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5080] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5080] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5080] unshare(CLONE_NEWNS)        = 0
[pid  5080] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5080] unshare(CLONE_NEWIPC)       = 0
[pid  5080] unshare(CLONE_NEWCGROUP)    = 0
[pid  5080] unshare(CLONE_NEWUTS)       = 0
[pid  5080] unshare(CLONE_SYSVSEM)      = 0
[pid  5080] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5080] write(3, "16777216", 8)     = 8
[pid  5080] close(3)                    = 0
[pid  5080] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5080] write(3, "536870912", 9)    = 9
[pid  5080] close(3)                    = 0
[pid  5080] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5080] write(3, "1024", 4)         = 4
[pid  5080] close(3)                    = 0
[pid  5080] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5080] write(3, "8192", 4)         = 4
[pid  5080] close(3)                    = 0
[pid  5080] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5080] write(3, "1024", 4)         = 4
[pid  5080] close(3)                    = 0
[pid  5080] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  5080] write(3, "1024", 4)         = 4
[pid  5080] close(3)                    = 0
[pid  5080] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5080] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5080] close(3)                    = 0
[pid  5080] getpid()                    = 1
[pid  5080] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5080] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5080] unshare(CLONE_NEWNET)       = 0
[pid  5080] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5080] write(3, "0 65535", 7)      = 7
[pid  5080] close(3)                    = 0
[pid  5080] mkdir("/dev/binderfs", 0777) = 0
[pid  5080] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5080] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5080] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558c566690) = 3
./strace-static-x86_64: Process 5085 attached
[pid  5085] set_robust_list(0x55558c5666a0, 24) = 0
[pid  5085] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5085] setpgid(0, 0)               = 0
[pid  5085] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5085] write(3, "1000", 4)         = 4
[pid  5085] close(3)                    = 0
[pid  5085] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_SKB, insn_cnt=4, insns=0x20000000, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_UDP6_SENDMSG, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL, ...}, 144) = -1 EFAULT (Bad address)
[pid  5085] write(202, "\x04\x3e\x75\x1d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x73\x01\xa2\x00\x00\x00\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 36) = 36
[pid  5085] write(202, "\x04\x3e\x07\x1b\x47\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 34) = 34
[pid  5085] close(3)                    = -1 EBADF (Bad file descriptor)
[pid  5085] close(4)                    = -1 EBADF (Bad file descriptor)
[pid  5085] close(5)                    = -1 EBADF (Bad file descriptor)
[pid  5085] close(6)                    = -1 EBADF (Bad file descriptor)
[   56.712309][   T52] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585
[   56.721890][   T52] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 52, name: kworker/u9:0
[   56.731207][   T52] preempt_count: 0, expected: 0
[   56.736081][   T52] RCU nest depth: 1, expected: 0
[   56.741073][   T52] 4 locks held by kworker/u9:0/52:
[   56.746199][   T52]  #0: ffff888018b58148 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830
[pid  5085] close(7)                    = -1 EBADF (Bad file descriptor)
[pid  5085] close(8)                    = -1 EBADF (Bad file descriptor)
[pid  5085] close(9)                    = -1 EBADF (Bad file descriptor)
[pid  5085] close(10)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(11)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(12)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(13)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(14)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(15)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(16)                   = -1 EBADF (Bad file descriptor)
[   56.757254][   T52]  #1: ffffc90000bc7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830
[   56.769387][   T52]  #2: ffff88807b768078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0
[   56.780041][   T52]  #3: ffffffff8e334ea0 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0
[   56.790835][   T52] CPU: 0 PID: 52 Comm: kworker/u9:0 Not tainted 6.9.0-rc2-next-20240405-syzkaller #0
[   56.800301][   T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[pid  5085] close(17)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(18)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(19)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(20)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(21)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(22)                   = -1 EBADF (Bad file descriptor)
[   56.810376][   T52] Workqueue: hci0 hci_rx_work
[   56.815061][   T52] Call Trace:
[   56.818330][   T52]  <TASK>
[   56.821255][   T52]  dump_stack_lvl+0x241/0x360
[   56.825950][   T52]  ? __pfx_dump_stack_lvl+0x10/0x10
[   56.831143][   T52]  ? __pfx__printk+0x10/0x10
[   56.835756][   T52]  __might_resched+0x5d4/0x780
[   56.840522][   T52]  ? __mutex_lock+0x112/0xd70
[   56.845192][   T52]  ? __pfx___might_resched+0x10/0x10
[   56.850490][   T52]  __mutex_lock+0xc1/0xd70
[   56.854906][   T52]  ? __pfx_lock_acquire+0x10/0x10
[pid  5085] close(23)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(24)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(25)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(26)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(27)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(28)                   = -1 EBADF (Bad file descriptor)
[pid  5085] close(29)                   = -1 EBADF (Bad file descriptor)
[pid  5085] exit_group(0)               = ?
[   56.859929][   T52]  ? hci_le_create_big_complete_evt+0x3d9/0xae0
[   56.866163][   T52]  ? __pfx_lock_release+0x10/0x10
[   56.871188][   T52]  ? __pfx___mutex_lock+0x10/0x10
[   56.876214][   T52]  ? trace_contention_end+0x3c/0x120
[   56.881500][   T52]  ? skb_pull_data+0x112/0x230
[   56.886263][   T52]  ? hci_conn_set_handle+0x19a/0x270
[   56.891561][   T52]  hci_le_create_big_complete_evt+0x3d9/0xae0
[   56.897662][   T52]  ? __copy_skb_header+0x437/0x5b0
[   56.902787][   T52]  ? hci_le_create_big_complete_evt+0xdb/0xae0
[pid  5085] +++ exited with 0 +++
[pid  5080] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
[pid  5080] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5086 attached
 <unfinished ...>
[pid  5086] set_robust_list(0x55558c5666a0, 24) = 0
[pid  5086] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5080] <... clone resumed>, child_tidptr=0x55558c566690) = 4
[pid  5086] setpgid(0, 0)               = 0
[pid  5086] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[   56.908981][   T52]  ? __pfx_hci_le_create_big_complete_evt+0x10/0x10
[   56.915586][   T52]  ? hci_le_meta_evt+0x366/0x580
[   56.920545][   T52]  ? __pfx_hci_le_create_big_complete_evt+0x10/0x10
[   56.927145][   T52]  hci_event_packet+0xa53/0x1540
[   56.932105][   T52]  ? __pfx_hci_le_meta_evt+0x10/0x10
[   56.937415][   T52]  ? __pfx_hci_event_packet+0x10/0x10
[   56.942797][   T52]  ? do_raw_spin_unlock+0x13c/0x8b0
[   56.948014][   T52]  ? kcov_remote_start+0x9e/0x7e0
[   56.953048][   T52]  ? hci_send_to_monitor+0xd8/0x7f0
[   56.958263][   T52]  ? skb_dequeue+0x113/0x150
[pid  5086] write(3, "1000", 4)         = 4
[pid  5086] close(3)                    = 0
[pid  5086] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_SKB, insn_cnt=4, insns=0x20000000, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_UDP6_SENDMSG, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL, ...}, 144) = -1 EFAULT (Bad address)
[pid  5086] write(202, "\x04\x3e\x75\x1d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x73\x01\xa2\x00\x00\x00\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 36) = 36
[pid  5086] write(202, "\x04\x3e\x07\x1b\x47\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 34) = 34
[pid  5086] close(3)                    = -1 EBADF (Bad file descriptor)
[   56.962846][   T52]  hci_rx_work+0x3e8/0xca0
[   56.967269][   T52]  ? process_scheduled_works+0x945/0x1830
[   56.972983][   T52]  process_scheduled_works+0xa2c/0x1830
[   56.978539][   T52]  ? __pfx_process_scheduled_works+0x10/0x10
[   56.984516][   T52]  ? assign_work+0x364/0x3d0
[   56.989101][   T52]  worker_thread+0x86d/0xd70
[   56.993691][   T52]  ? __kthread_parkme+0x169/0x1d0
[   56.998728][   T52]  ? __pfx_worker_thread+0x10/0x10
[   57.003859][   T52]  kthread+0x2f0/0x390
[   57.007921][   T52]  ? __pfx_worker_thread+0x10/0x10
[pid  5086] close(4)                    = -1 EBADF (Bad file descriptor)
[pid  5086] close(5)                    = -1 EBADF (Bad file descriptor)
[pid  5086] close(6)                    = -1 EBADF (Bad file descriptor)
[pid  5086] close(7)                    = -1 EBADF (Bad file descriptor)
[pid  5086] close(8)                    = -1 EBADF (Bad file descriptor)
[pid  5086] close(9)                    = -1 EBADF (Bad file descriptor)
[pid  5086] close(10)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(11)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(12)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(13)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(14)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(15)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(16)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(17)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(18)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(19)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(20)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(21)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(22)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(23)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(24)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(25)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(26)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(27)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(28)                   = -1 EBADF (Bad file descriptor)
[pid  5086] close(29)                   = -1 EBADF (Bad file descriptor)
[pid  5086] exit_group(0)               = ?
[pid  5086] +++ exited with 0 +++
[pid  5080] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
[   57.013040][   T52]  ? __pfx_kthread+0x10/0x10
[   57.017630][   T52]  ret_from_fork+0x4b/0x80
[   57.022071][   T52]  ? __pfx_kthread+0x10/0x10
[   57.026708][   T52]  ret_from_fork_asm+0x1a/0x30
[   57.031503][   T52]  </TASK>
[   57.034651][   T52] 
[   57.036990][   T52] =============================
[   57.041842][   T52] [ BUG: Invalid wait context ]
[   57.046697][   T52] 6.9.0-rc2-next-20240405-syzkaller #0 Tainted: G        W         
[   57.054681][   T52] -----------------------------
[   57.059519][   T52] kworker/u9:0/52 is trying to lock:
[   57.064790][   T52] ffffffff8f73f868 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0x3d9/0xae0
[   57.075406][   T52] other info that might help us debug this:
[   57.081280][   T52] context-{4:4}
[   57.084736][   T52] 4 locks held by kworker/u9:0/52:
[   57.089852][   T52]  #0: ffff888018b58148 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830
[   57.100839][   T52]  #1: ffffc90000bc7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830
[   57.112852][   T52]  #2: ffff88807b768078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0
[   57.123385][   T52]  #3: ffffffff8e334ea0 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0
[   57.134079][   T52] stack backtrace:
[   57.137785][   T52] CPU: 0 PID: 52 Comm: kworker/u9:0 Tainted: G        W          6.9.0-rc2-next-20240405-syzkaller #0
[   57.148705][   T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[   57.158756][   T52] Workqueue: hci0 hci_rx_work
[   57.163432][   T52] Call Trace:
[   57.166703][   T52]  <TASK>
[   57.169625][   T52]  dump_stack_lvl+0x241/0x360
[   57.174302][   T52]  ? __pfx_dump_stack_lvl+0x10/0x10
[   57.179496][   T52]  ? __pfx__printk+0x10/0x10
[   57.184086][   T52]  __lock_acquire+0x1507/0x1fd0
[   57.188940][   T52]  lock_acquire+0x1ed/0x550
[   57.193442][   T52]  ? hci_le_create_big_complete_evt+0x3d9/0xae0
[   57.199683][   T52]  ? __pfx_lock_acquire+0x10/0x10
[   57.204702][   T52]  ? __mutex_lock+0x112/0xd70
[   57.209375][   T52]  ? __pfx___might_resched+0x10/0x10
[   57.214655][   T52]  __mutex_lock+0x136/0xd70
[   57.219156][   T52]  ? hci_le_create_big_complete_evt+0x3d9/0xae0
[   57.225394][   T52]  ? __pfx_lock_acquire+0x10/0x10
[   57.230411][   T52]  ? hci_le_create_big_complete_evt+0x3d9/0xae0
[   57.236647][   T52]  ? __pfx_lock_release+0x10/0x10
[   57.241679][   T52]  ? __pfx___mutex_lock+0x10/0x10
[   57.246703][   T52]  ? trace_contention_end+0x3c/0x120
[   57.251981][   T52]  ? skb_pull_data+0x112/0x230
[   57.256743][   T52]  ? hci_conn_set_handle+0x19a/0x270
[   57.262024][   T52]  hci_le_create_big_complete_evt+0x3d9/0xae0
[   57.268092][   T52]  ? __copy_skb_header+0x437/0x5b0
[   57.273201][   T52]  ? hci_le_create_big_complete_evt+0xdb/0xae0
[   57.279356][   T52]  ? __pfx_hci_le_create_big_complete_evt+0x10/0x10
[   57.285940][   T52]  ? hci_le_meta_evt+0x366/0x580
[   57.290873][   T52]  ? __pfx_hci_le_create_big_complete_evt+0x10/0x10
[   57.297457][   T52]  hci_event_packet+0xa53/0x1540
[   57.302388][   T52]  ? __pfx_hci_le_meta_evt+0x10/0x10
[   57.307691][   T52]  ? __pfx_hci_event_packet+0x10/0x10
[   57.313071][   T52]  ? do_raw_spin_unlock+0x13c/0x8b0
[   57.318283][   T52]  ? kcov_remote_start+0x9e/0x7e0
[   57.323304][   T52]  ? hci_send_to_monitor+0xd8/0x7f0
[   57.328499][   T52]  ? skb_dequeue+0x113/0x150
[   57.333081][   T52]  hci_rx_work+0x3e8/0xca0
[   57.337497][   T52]  ? process_scheduled_works+0x945/0x1830
[   57.343211][   T52]  process_scheduled_works+0xa2c/0x1830
[   57.348761][   T52]  ? __pfx_process_scheduled_works+0x10/0x10
[   57.354735][   T52]  ? assign_work+0x364/0x3d0
[   57.359316][   T52]  worker_thread+0x86d/0xd70
[pid  5080] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558c566690) = 5
[   57.363908][   T52]  ? __kthread_parkme+0x169/0x1d0
[   57.368924][   T52]  ? __pfx_worker_thread+0x10/0x10
[   57.374024][   T52]  kthread+0x2f0/0x390
[   57.378085][   T52]  ? __pfx_worker_thread+0x10/0x10
[   57.383198][   T52]  ? __pfx_kthread+0x10/0x10
[   57.387779][   T52]  ret_from_fork+0x4b/0x80
[   57.392191][   T52]  ? __pfx_kthread+0x10/0x10
[   57.396774][   T52]  ret_from_fork_asm+0x1a/0x30
[   57.401542][   T52]  </TASK>
[   57.404873][   T52] ==================================================================
[   57.412947][   T52] BUG: KASAN: slab-use-after-free in hci_le_create_big_complete_evt+0x383/0xae0
[   57.421971][   T52] Read of size 8 at addr ffff888022e3c000 by task kworker/u9:0/52
[   57.429763][   T52] 
[   57.432095][   T52] CPU: 0 PID: 52 Comm: kworker/u9:0 Tainted: G        W          6.9.0-rc2-next-20240405-syzkaller #0
[   57.443022][   T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[   57.453067][   T52] Workqueue: hci0 hci_rx_work
[   57.457745][   T52] Call Trace:
[   57.461018][   T52]  <TASK>
[   57.463942][   T52]  dump_stack_lvl+0x241/0x360
[   57.468617][   T52]  ? __pfx_dump_stack_lvl+0x10/0x10
[   57.473815][   T52]  ? __pfx__printk+0x10/0x10
[   57.478395][   T52]  ? _printk+0xd5/0x120
[   57.482541][   T52]  ? __virt_addr_valid+0x183/0x520
[   57.487648][   T52]  ? __virt_addr_valid+0x183/0x520
[   57.492760][   T52]  print_report+0x169/0x550
[   57.497255][   T52]  ? __virt_addr_valid+0x183/0x520
[   57.502365][   T52]  ? __virt_addr_valid+0x183/0x520
[   57.507468][   T52]  ? __virt_addr_valid+0x44e/0x520
[   57.512572][   T52]  ? __phys_addr+0xba/0x170
[   57.517067][   T52]  ? hci_le_create_big_complete_evt+0x383/0xae0
[   57.523323][   T52]  kasan_report+0x143/0x180
[   57.527822][   T52]  ? hci_le_create_big_complete_evt+0x383/0xae0
[   57.534059][   T52]  hci_le_create_big_complete_evt+0x383/0xae0
[   57.540124][   T52]  ? __copy_skb_header+0x437/0x5b0
[   57.545238][   T52]  ? hci_le_create_big_complete_evt+0xdb/0xae0
[   57.551385][   T52]  ? __pfx_hci_le_create_big_complete_evt+0x10/0x10
[   57.557967][   T52]  ? hci_le_meta_evt+0x366/0x580
[   57.562901][   T52]  ? __pfx_hci_le_create_big_complete_evt+0x10/0x10
[   57.569482][   T52]  hci_event_packet+0xa53/0x1540
[   57.574414][   T52]  ? __pfx_hci_le_meta_evt+0x10/0x10
[   57.579699][   T52]  ? __pfx_hci_event_packet+0x10/0x10
[   57.585062][   T52]  ? do_raw_spin_unlock+0x13c/0x8b0
[   57.590259][   T52]  ? kcov_remote_start+0x9e/0x7e0
[   57.595270][   T52]  ? hci_send_to_monitor+0xd8/0x7f0
[   57.600459][   T52]  ? skb_dequeue+0x113/0x150
[   57.605038][   T52]  hci_rx_work+0x3e8/0xca0
[   57.609450][   T52]  ? process_scheduled_works+0x945/0x1830
[   57.615161][   T52]  process_scheduled_works+0xa2c/0x1830
[   57.620704][   T52]  ? __pfx_process_scheduled_works+0x10/0x10
[   57.626674][   T52]  ? assign_work+0x364/0x3d0
[   57.631255][   T52]  worker_thread+0x86d/0xd70
[   57.635840][   T52]  ? __kthread_parkme+0x169/0x1d0
[   57.640852][   T52]  ? __pfx_worker_thread+0x10/0x10
[   57.645954][   T52]  kthread+0x2f0/0x390
[   57.650015][   T52]  ? __pfx_worker_thread+0x10/0x10
[   57.655117][   T52]  ? __pfx_kthread+0x10/0x10
[   57.659714][   T52]  ret_from_fork+0x4b/0x80
[   57.664144][   T52]  ? __pfx_kthread+0x10/0x10
[   57.668741][   T52]  ret_from_fork_asm+0x1a/0x30
[   57.673514][   T52]  </TASK>
[   57.676522][   T52] 
[   57.678833][   T52] Allocated by task 52:
[   57.682973][   T52]  kasan_save_track+0x3f/0x80
[   57.687645][   T52]  __kasan_kmalloc+0x98/0xb0
[   57.692231][   T52]  kmalloc_trace_noprof+0x19c/0x2b0
[   57.697423][   T52]  hci_conn_add+0xc7/0x1440
[   57.701919][   T52]  hci_le_big_sync_established_evt+0x1cf/0xb90
[   57.708084][   T52]  hci_event_packet+0xa53/0x1540
[   57.713048][   T52]  hci_rx_work+0x3e8/0xca0
[   57.717468][   T52]  process_scheduled_works+0xa2c/0x1830
[   57.723008][   T52]  worker_thread+0x86d/0xd70
[   57.727589][   T52]  kthread+0x2f0/0x390
[   57.731649][   T52]  ret_from_fork+0x4b/0x80
[   57.736063][   T52]  ret_from_fork_asm+0x1a/0x30
[   57.740821][   T52] 
[   57.743133][   T52] Freed by task 52:
[   57.746926][   T52]  kasan_save_track+0x3f/0x80
[   57.751597][   T52]  kasan_save_free_info+0x40/0x50
[   57.756612][   T52]  poison_slab_object+0xe0/0x150
[   57.761543][   T52]  __kasan_slab_free+0x37/0x60
[   57.766300][   T52]  kfree+0x149/0x350
[   57.770185][   T52]  device_release+0x99/0x1c0
[   57.774779][   T52]  kobject_put+0x22f/0x480
[   57.779185][   T52]  hci_conn_del+0x911/0xc90
[   57.783678][   T52]  hci_le_create_big_complete_evt+0x619/0xae0
[   57.789750][   T52]  hci_event_packet+0xa53/0x1540
[   57.794685][   T52]  hci_rx_work+0x3e8/0xca0
[   57.799092][   T52]  process_scheduled_works+0xa2c/0x1830
[   57.804645][   T52]  worker_thread+0x86d/0xd70
[   57.809275][   T52]  kthread+0x2f0/0x390
[   57.813350][   T52]  ret_from_fork+0x4b/0x80
[   57.817765][   T52]  ret_from_fork_asm+0x1a/0x30
[   57.822521][   T52] 
[   57.824833][   T52] The buggy address belongs to the object at ffff888022e3c000
[   57.824833][   T52]  which belongs to the cache kmalloc-8k of size 8192
[   57.838876][   T52] The buggy address is located 0 bytes inside of
[   57.838876][   T52]  freed 8192-byte region [ffff888022e3c000, ffff888022e3e000)
[   57.852571][   T52] 
[   57.854883][   T52] The buggy address belongs to the physical page:
[   57.861278][   T52] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22e38
[   57.870025][   T52] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[   57.877568][   T52] flags: 0xfff80000000040(head|node=0|zone=1|lastcpupid=0xfff)
[   57.885126][   T52] page_type: 0xffffefff(slab)
[   57.889817][   T52] raw: 00fff80000000040 ffff888015042280 dead000000000122 0000000000000000
[   57.898400][   T52] raw: 0000000000000000 0000000080020002 00000001ffffefff 0000000000000000
[   57.906973][   T52] head: 00fff80000000040 ffff888015042280 dead000000000122 0000000000000000
[   57.915631][   T52] head: 0000000000000000 0000000080020002 00000001ffffefff 0000000000000000
[   57.924290][   T52] head: 00fff80000000003 ffffea00008b8e01 ffffea00008b8e48 00000000ffffffff
[   57.932966][   T52] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
[   57.941645][   T52] page dumped because: kasan: bad access detected
[   57.948073][   T52] page_owner tracks the page as allocated
[   57.953804][   T52] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5079, tgid 126211378 (strace-static-x), ts 5079, free_ts 55959308873
[   57.974482][   T52]  post_alloc_hook+0x1f3/0x230
[   57.979255][   T52]  get_page_from_freelist+0x2e7e/0x2f40
[   57.984794][   T52]  __alloc_pages_noprof+0x256/0x6c0
[   57.989983][   T52]  alloc_slab_page+0x5f/0x120
[   57.994654][   T52]  allocate_slab+0x5a/0x2e0
[   57.999165][   T52]  ___slab_alloc+0xcd1/0x14b0
[   58.003866][   T52]  __slab_alloc+0x58/0xa0
[   58.008201][   T52]  kmalloc_trace_noprof+0x1d5/0x2b0
[   58.013393][   T52]  tomoyo_init_log+0x11ce/0x2050
[   58.018343][   T52]  tomoyo_supervisor+0x38a/0x11f0
[   58.023356][   T52]  tomoyo_env_perm+0x178/0x210
[   58.028109][   T52]  tomoyo_find_next_domain+0x1384/0x1cf0
[   58.033733][   T52]  tomoyo_bprm_check_security+0x115/0x180
[   58.039444][   T52]  security_bprm_check+0x65/0x90
[   58.044372][   T52]  bprm_execve+0xa56/0x17c0
[   58.048865][   T52]  do_execveat_common+0x553/0x700
[   58.053883][   T52] page last free pid 5079 tgid 5079 stack trace:
[   58.060218][   T52]  free_unref_page+0xd3c/0xec0
[   58.064981][   T52]  __slab_free+0x31b/0x3d0
[   58.069408][   T52]  qlist_free_all+0x9e/0x140
[   58.074006][   T52]  kasan_quarantine_reduce+0x14f/0x170
[   58.079462][   T52]  __kasan_slab_alloc+0x23/0x80
[   58.084307][   T52]  kmalloc_trace_noprof+0x132/0x2b0
[   58.089495][   T52]  tomoyo_init_log+0x11ce/0x2050
[   58.094428][   T52]  tomoyo_supervisor+0x38a/0x11f0
[   58.099441][   T52]  tomoyo_env_perm+0x178/0x210
[   58.104193][   T52]  tomoyo_find_next_domain+0x1384/0x1cf0
[   58.109818][   T52]  tomoyo_bprm_check_security+0x115/0x180
[   58.115529][   T52]  security_bprm_check+0x65/0x90
[   58.120456][   T52]  bprm_execve+0xa56/0x17c0
[   58.124952][   T52]  do_execveat_common+0x553/0x700
[   58.129968][   T52]  __x64_sys_execve+0x92/0xb0
[   58.134638][   T52]  do_syscall_64+0xfb/0x240
[   58.139141][   T52] 
[   58.141452][   T52] Memory state around the buggy address:
[   58.147071][   T52]  ffff888022e3bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   58.155125][   T52]  ffff888022e3bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
./strace-static-x86_64: Process 5087 attached
[pid  5087] set_robust_list(0x55558c5666a0, 24) = 0
[pid  5087] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5087] setpgid(0, 0)               = 0
[pid  5087] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5087] write(3, "1000", 4)         = 4
[pid  5087] close(3)                    = 0
[pid  5087] bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_SKB, insn_cnt=4, insns=0x20000000, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_UDP6_SENDMSG, prog_btf_fd=-1, func_info_rec_size=8, func_info=NULL, func_info_cnt=0, line_info_rec_size=16, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, fd_array=NULL, ...}, 144) = -1 EFAULT (Bad address)
[pid  5087] write(202, "\x04\x3e\x75\x1d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x73\x01\xa2\x00\x00\x00\x00\x00\x95\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 36) = 36
[pid  5087] write(202, "\x04\x3e\x07\x1b\x47\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 34) = 34
[   58.163179][   T52] >ffff888022e3c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   58.171223][   T52]                    ^
[   58.175278][   T52]  ffff888022e3c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   58.183341][   T52]  ffff888022e3c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   58.191392][   T52] ==================================================================
[   58.199654][   T52] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   58.206868][   T52] CPU: 0 PID: 52 Comm: kworker/u9:0 Tainted: G        W          6.9.0-rc2-next-20240405-syzkaller #0
[pid  5087] close(3)                    = -1 EBADF (Bad file descriptor)
[pid  5087] close(4)                    = -1 EBADF (Bad file descriptor)
[pid  5087] close(5)                    = -1 EBADF (Bad file descriptor)
[pid  5087] close(6)                    = -1 EBADF (Bad file descriptor)
[pid  5087] close(7)                    = -1 EBADF (Bad file descriptor)
[pid  5087] close(8)                    = -1 EBADF (Bad file descriptor)
[pid  5087] close(9)                    = -1 EBADF (Bad file descriptor)
[pid  5087] close(10)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(11)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(12)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(13)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(14)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(15)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(16)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(17)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(18)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(19)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(20)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(21)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(22)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(23)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(24)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(25)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(26)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(27)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(28)                   = -1 EBADF (Bad file descriptor)
[pid  5087] close(29)                   = -1 EBADF (Bad file descriptor)
[pid  5087] exit_group(0)               = ?
[pid  5087] +++ exited with 0 +++
[pid  5080] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
[pid  5080] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x55558c566690) = 6
[   58.217819][   T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
[   58.227902][   T52] Workqueue: hci0 hci_rx_work
[   58.232617][   T52] Call Trace:
[   58.235892][   T52]  <TASK>
[   58.238816][   T52]  dump_stack_lvl+0x241/0x360
[   58.243531][   T52]  ? __pfx_dump_stack_lvl+0x10/0x10
[   58.248760][   T52]  ? __pfx__printk+0x10/0x10
[   58.253500][   T52]  ? rcu_is_watching+0x15/0xb0
[   58.258306][   T52]  ? preempt_schedule+0xe1/0xf0
[   58.263172][   T52]  ? vscnprintf+0x5d/0x90
[   58.267503][   T52]  panic+0x349/0x860
[   58.271395][   T52]  ? check_panic_on_warn+0x21/0xb0
[   58.276504][   T52]  ? __pfx_panic+0x10/0x10
[   58.280936][   T52]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   58.286930][   T52]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   58.293254][   T52]  ? print_report+0x502/0x550
[   58.297946][   T52]  check_panic_on_warn+0x86/0xb0
[   58.302907][   T52]  ? hci_le_create_big_complete_evt+0x383/0xae0
[   58.309152][   T52]  end_report+0x77/0x160
[   58.313390][   T52]  kasan_report+0x154/0x180
[   58.317884][   T52]  ? hci_le_create_big_complete_evt+0x383/0xae0
[   58.324123][   T52]  hci_le_create_big_complete_evt+0x383/0xae0
[   58.330184][   T52]  ? __copy_skb_header+0x437/0x5b0
[   58.335294][   T52]  ? hci_le_create_big_complete_evt+0xdb/0xae0
[   58.341463][   T52]  ? __pfx_hci_le_create_big_complete_evt+0x10/0x10
[   58.348076][   T52]  ? hci_le_meta_evt+0x366/0x580
[   58.353048][   T52]  ? __pfx_hci_le_create_big_complete_evt+0x10/0x10
[   58.359676][   T52]  hci_event_packet+0xa53/0x1540
[   58.364623][   T52]  ? __pfx_hci_le_meta_evt+0x10/0x10
[   58.369938][   T52]  ? __pfx_hci_event_packet+0x10/0x10
[   58.375334][   T52]  ? do_raw_spin_unlock+0x13c/0x8b0
[   58.380549][   T52]  ? kcov_remote_start+0x9e/0x7e0
[   58.385579][   T52]  ? hci_send_to_monitor+0xd8/0x7f0
[   58.390780][   T52]  ? skb_dequeue+0x113/0x150
[   58.395362][   T52]  hci_rx_work+0x3e8/0xca0
[   58.399777][   T52]  ? process_scheduled_works+0x945/0x1830
[   58.405487][   T52]  process_scheduled_works+0xa2c/0x1830
[   58.411062][   T52]  ? __pfx_process_scheduled_works+0x10/0x10
[   58.417039][   T52]  ? assign_work+0x364/0x3d0
[   58.421627][   T52]  worker_thread+0x86d/0xd70
[   58.426217][   T52]  ? __kthread_parkme+0x169/0x1d0
[   58.431232][   T52]  ? __pfx_worker_thread+0x10/0x10
[   58.436334][   T52]  kthread+0x2f0/0x390
[   58.440654][   T52]  ? __pfx_worker_thread+0x10/0x10
[   58.445754][   T52]  ? __pfx_kthread+0x10/0x10
[   58.450334][   T52]  ret_from_fork+0x4b/0x80
[   58.454746][   T52]  ? __pfx_kthread+0x10/0x10
[   58.459334][   T52]  ret_from_fork_asm+0x1a/0x30
[   58.464106][   T52]  </TASK>
[   58.467297][   T52] Kernel Offset: disabled
[   58.471605][   T52] Rebooting in 86400 seconds..