./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4158525256 <...> Warning: Permanently added '10.128.0.204' (ED25519) to the list of known hosts. execve("./syz-executor4158525256", ["./syz-executor4158525256"], 0x7ffd665d0e10 /* 10 vars */) = 0 brk(NULL) = 0x5555566a1000 brk(0x5555566a1d40) = 0x5555566a1d40 arch_prctl(ARCH_SET_FS, 0x5555566a13c0) = 0 set_tid_address(0x5555566a1690) = 5030 set_robust_list(0x5555566a16a0, 24) = 0 rseq(0x5555566a1ce0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor4158525256", 4096) = 28 getrandom("\x9f\x7d\x03\x59\xaa\x53\xac\x79", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555566a1d40 brk(0x5555566c2d40) = 0x5555566c2d40 brk(0x5555566c3000) = 0x5555566c3000 mprotect(0x7f9e22c47000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555566a1690) = 5031 ./strace-static-x86_64: Process 5031 attached [pid 5031] set_robust_list(0x5555566a16a0, 24) = 0 [pid 5031] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [ 83.078918][ T26] audit: type=1400 audit(1697551755.851:83): avc: denied { write } for pid=5027 comm="strace-static-x" path="pipe:[4331]" dev="pipefs" ino=4331 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [pid 5031] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3 [pid 5031] openat(AT_FDCWD, "/dev/vhci", O_RDWR) = 4 [pid 5031] dup2(4, 202) = 202 [pid 5031] close(4) = 0 [pid 5031] write(202, "\xff\x00", 2) = 2 [pid 5031] read(202, "\xff\x00\x00\x00", 4) = 4 [pid 5031] rt_sigaction(SIGRT_1, {sa_handler=0x7f9e22be7d00, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f9e22bd9380}, NULL, 8) = 0 [pid 5031] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5031] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f9e22382000 [pid 5031] mprotect(0x7f9e22383000, 8388608, PROT_READ|PROT_WRITE) = 0 [pid 5031] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5031] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f9e22b82990, parent_tid=0x7f9e22b82990, exit_signal=0, stack=0x7f9e22382000, stack_size=0x800300, tls=0x7f9e22b826c0} => {parent_tid=[2]}, 88) = 2 [pid 5031] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5031] ioctl(3, HCIDEVUP./strace-static-x86_64: Process 5033 attached [pid 5033] rseq(0x7f9e22b82fe0, 0x20, 0, 0x53053053) = 0 [pid 5033] set_robust_list(0x7f9e22b829a0, 24) = 0 [ 83.117371][ T26] audit: type=1400 audit(1697551755.891:84): avc: denied { execmem } for pid=5030 comm="syz-executor415" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 83.137402][ T26] audit: type=1400 audit(1697551755.891:85): avc: denied { mounton } for pid=5031 comm="syz-executor415" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [pid 5033] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5033] read(202, "\x01\x03\x0c\x00", 1024) = 4 [pid 5033] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5033] read(202, "\x01\x03\x10\x00", 1024) = 4 [ 83.164748][ T26] audit: type=1400 audit(1697551755.891:86): avc: denied { mount } for pid=5031 comm="syz-executor415" name="/" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 83.177469][ T5034] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 83.188983][ T26] audit: type=1400 audit(1697551755.891:87): avc: denied { create } for pid=5031 comm="syz-executor415" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 83.198324][ T5034] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [pid 5033] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5033] read(202, "\x01\x01\x10\x00", 1024) = 4 [pid 5033] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5033] read(202, "\x01\x09\x10\x00", 1024) = 4 [pid 5033] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4) = 13 [pid 5033] read(202, "\x01\x05\x10\x00", 1024) = 4 [ 83.215234][ T26] audit: type=1400 audit(1697551755.891:88): avc: denied { read write } for pid=5031 comm="syz-executor415" name="vhci" dev="devtmpfs" ino=1076 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 83.223671][ T5034] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 83.256123][ T26] audit: type=1400 audit(1697551755.891:89): avc: denied { open } for pid=5031 comm="syz-executor415" path="/dev/vhci" dev="devtmpfs" ino=1076 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [pid 5033] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4) = 14 [pid 5033] read(202, "\x01\x23\x0c\x00", 1024) = 4 [pid 5033] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5033] read(202, "\x01\x14\x0c\x00", 1024) = 4 [pid 5033] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5033] read(202, "\x01\x25\x0c\x00", 1024) = 4 [pid 5033] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [ 83.260492][ T5034] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 83.281187][ T26] audit: type=1400 audit(1697551755.921:90): avc: denied { ioctl } for pid=5031 comm="syz-executor415" path="socket:[3557]" dev="sockfs" ino=3557 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 83.288890][ T5034] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [pid 5033] read(202, "\x01\x38\x0c\x00", 1024) = 4 [pid 5033] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5033] read(202, "\x01\x39\x0c\x00", 1024) = 4 [pid 5033] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5033] read(202, "\x01\x16\x0c\x02\x00\x7d", 1024) = 6 [pid 5033] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5033] read(202, [pid 5031] <... ioctl resumed>, 0) = -1 EALREADY (Operation already in progress) [pid 5031] ioctl(3, HCISETSCAN [pid 5033] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5 [pid 5033] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4) = 7 [pid 5033] rt_sigprocmask(SIG_BLOCK, ~[RT_1], NULL, 8) = 0 [pid 5033] madvise(0x7f9e22382000, 8372224, MADV_DONTNEED) = 0 [pid 5033] exit(0) = ? [pid 5033] +++ exited with 0 +++ [pid 5031] <... ioctl resumed>, 0x7ffe1644894c) = 0 [pid 5031] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3) = 13 [pid 5031] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3) = 14 [pid 5031] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3) = 14 [pid 5031] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22 [pid 5031] close(3) = 0 [pid 5031] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5031] setsid() = 1 [pid 5031] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5031] dup2(3, 201) = 201 [pid 5031] close(3) = 0 [pid 5031] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5031] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5031] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5031] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5031] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5031] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5031] unshare(CLONE_NEWNS) = 0 [pid 5031] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5031] unshare(CLONE_NEWIPC) = 0 [pid 5031] unshare(CLONE_NEWCGROUP) = 0 [pid 5031] unshare(CLONE_NEWUTS) = 0 [pid 5031] unshare(CLONE_SYSVSEM) = 0 [pid 5031] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5031] write(3, "16777216", 8) = 8 [pid 5031] close(3) = 0 [pid 5031] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5031] write(3, "536870912", 9) = 9 [pid 5031] close(3) = 0 [pid 5031] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5031] write(3, "1024", 4) = 4 [pid 5031] close(3) = 0 [pid 5031] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5031] write(3, "8192", 4) = 4 [pid 5031] close(3) = 0 [pid 5031] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5031] write(3, "1024", 4) = 4 [pid 5031] close(3) = 0 [pid 5031] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5031] write(3, "1024", 4) = 4 [pid 5031] close(3) = 0 [pid 5031] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5031] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5031] close(3) = 0 [pid 5031] getpid() = 1 [pid 5031] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< 2 [ 83.342802][ T26] audit: type=1400 audit(1697551756.031:92): avc: denied { open } for pid=4464 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [pid 5031] unshare(CLONE_NEWNET) = 0 [pid 5031] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3 [pid 5031] write(3, "0 65535", 7) = 7 [pid 5031] close(3) = 0 [pid 5031] mkdir("/dev/binderfs", 0777) = 0 [pid 5031] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0 [pid 5031] symlink("/dev/binderfs", "./binderfs") = 0 [pid 5031] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5036 attached , child_tidptr=0x5555566a1690) = 3 [pid 5036] set_robust_list(0x5555566a16a0, 24) = 0 [pid 5036] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5036] setpgid(0, 0) = 0 [pid 5036] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5036] write(3, "1000", 4) = 4 [pid 5036] close(3) = 0 [pid 5036] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5036] setns(201, 0) = 0 [pid 5036] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5036] setns(3, 0) = 0 [pid 5036] close(3) = 0 [ 85.412275][ T4434] Bluetooth: hci0: command 0x0409 tx timeout [ 87.095000][ T27] cfg80211: failed to load regulatory.db [ 87.491674][ T4434] Bluetooth: hci0: command 0x041b tx timeout [pid 5036] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=8}, 10 [pid 5031] kill(-3, SIGKILL [pid 5036] <... connect resumed>) = ? [pid 5031] <... kill resumed>) = 0 [pid 5031] kill(3, SIGKILL) = 0 [pid 5036] +++ killed by SIGKILL +++ [pid 5031] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=3, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5031] restart_syscall(<... resuming interrupted kill ...>) = 0 [pid 5031] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5039 attached , child_tidptr=0x5555566a1690) = 4 [pid 5039] set_robust_list(0x5555566a16a0, 24) = 0 [pid 5039] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5039] setpgid(0, 0) = 0 [pid 5039] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5039] write(3, "1000", 4) = 4 [pid 5039] close(3) = 0 [pid 5039] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5039] setns(201, 0) = 0 [pid 5039] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5039] setns(3, 0) = 0 [pid 5039] close(3) = 0 [ 89.571884][ T4434] Bluetooth: hci0: command 0x040f tx timeout [ 91.651692][ T4434] Bluetooth: hci0: command 0x0419 tx timeout [pid 5039] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=8}, 10 [pid 5031] kill(-4, SIGKILL) = 0 [pid 5031] kill(4, SIGKILL [pid 5039] <... connect resumed>) = ? [pid 5039] +++ killed by SIGKILL +++ [pid 5031] <... kill resumed>) = 0 [pid 5031] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=4, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5031] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5041 attached , child_tidptr=0x5555566a1690) = 5 [pid 5041] set_robust_list(0x5555566a16a0, 24) = 0 [pid 5041] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5041] setpgid(0, 0) = 0 [pid 5041] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5041] write(3, "1000", 4) = 4 [pid 5041] close(3) = 0 [pid 5041] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5041] setns(201, 0) = 0 [pid 5041] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5041] setns(3, 0) = 0 [pid 5041] close(3) = 0 [ 93.731630][ T4434] Bluetooth: hci0: command 0x0405 tx timeout [pid 5041] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=8}, 10 [pid 5031] kill(-5, SIGKILL [pid 5041] <... connect resumed>) = ? [pid 5031] <... kill resumed>) = 0 [pid 5031] kill(5, SIGKILL) = 0 [pid 5041] +++ killed by SIGKILL +++ [pid 5031] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=5, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5031] restart_syscall(<... resuming interrupted kill ...>) = 0 [pid 5031] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5044 attached [pid 5044] set_robust_list(0x5555566a16a0, 24) = 0 [pid 5031] <... clone resumed>, child_tidptr=0x5555566a1690) = 6 [pid 5044] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5044] setpgid(0, 0) = 0 [pid 5044] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5044] write(3, "1000", 4) = 4 [pid 5044] close(3) = 0 [pid 5044] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5044] setns(201, 0) = 0 [pid 5044] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5044] setns(3, 0) = 0 [pid 5044] close(3) = 0 [pid 5044] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=8}, 10 [pid 5031] kill(-6, SIGKILL) = 0 [pid 5031] kill(6, SIGKILL) = 0 [pid 5044] <... connect resumed>) = ? [pid 5044] +++ killed by SIGKILL +++ [pid 5031] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=6, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5031] restart_syscall(<... resuming interrupted kill ...>) = 0 [pid 5031] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5047 attached [pid 5047] set_robust_list(0x5555566a16a0, 24) = 0 [pid 5031] <... clone resumed>, child_tidptr=0x5555566a1690) = 7 [pid 5047] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5047] setpgid(0, 0) = 0 [pid 5047] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5047] write(3, "1000", 4) = 4 [pid 5047] close(3) = 0 [pid 5047] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5047] setns(201, 0) = 0 [pid 5047] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5047] setns(3, 0) = 0 [pid 5047] close(3) = 0 [pid 5047] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=8}, 10 [pid 5031] kill(-7, SIGKILL) = 0 [pid 5031] kill(7, SIGKILL [pid 5047] <... connect resumed>) = ? [pid 5031] <... kill resumed>) = 0 [pid 5047] +++ killed by SIGKILL +++ [pid 5031] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=7, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5031] restart_syscall(<... resuming interrupted kill ...>) = 0 [pid 5031] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555566a1690) = 8 ./strace-static-x86_64: Process 5049 attached [pid 5049] set_robust_list(0x5555566a16a0, 24) = 0 [pid 5049] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5049] setpgid(0, 0) = 0 [pid 5049] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5049] write(3, "1000", 4) = 4 [pid 5049] close(3) = 0 [pid 5049] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5049] setns(201, 0) = 0 [pid 5049] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5049] setns(3, 0) = 0 [pid 5049] close(3) = 0 [pid 5049] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=8}, 10 [pid 5031] kill(-8, SIGKILL [pid 5049] <... connect resumed>) = ? [pid 5031] <... kill resumed>) = 0 [pid 5031] kill(8, SIGKILL) = 0 [pid 5049] +++ killed by SIGKILL +++ [pid 5031] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=8, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5031] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5052 attached , child_tidptr=0x5555566a1690) = 9 [pid 5052] set_robust_list(0x5555566a16a0, 24) = 0 [pid 5052] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5052] setpgid(0, 0) = 0 [pid 5052] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5052] write(3, "1000", 4) = 4 [pid 5052] close(3) = 0 [pid 5052] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5052] setns(201, 0) = 0 [pid 5052] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5052] setns(3, 0) = 0 [pid 5052] close(3) = 0 [pid 5052] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=8}, 10 [pid 5031] kill(-9, SIGKILL) = 0 [pid 5052] <... connect resumed>) = ? [pid 5031] kill(9, SIGKILL) = 0 [pid 5052] +++ killed by SIGKILL +++ [pid 5031] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=9, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5031] restart_syscall(<... resuming interrupted kill ...>) = 0 [pid 5031] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5060 attached , child_tidptr=0x5555566a1690) = 10 [pid 5060] set_robust_list(0x5555566a16a0, 24) = 0 [pid 5060] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5060] setpgid(0, 0) = 0 [pid 5060] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5060] write(3, "1000", 4) = 4 [pid 5060] close(3) = 0 [pid 5060] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5060] setns(201, 0) = 0 [pid 5060] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5060] setns(3, 0) = 0 [pid 5060] close(3) = 0 [pid 5060] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=8}, 10 [pid 5031] kill(-10, SIGKILL [pid 5060] <... connect resumed>) = ? [pid 5031] <... kill resumed>) = 0 [pid 5060] +++ killed by SIGKILL +++ [pid 5031] kill(10, SIGKILL) = 0 [pid 5031] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=10, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- [pid 5031] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555566a1690) = 11 ./strace-static-x86_64: Process 5062 attached [pid 5062] set_robust_list(0x5555566a16a0, 24) = 0 [pid 5062] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5062] setpgid(0, 0) = 0 [pid 5062] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5062] write(3, "1000", 4) = 4 [pid 5062] close(3) = 0 [pid 5062] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5062] setns(201, 0) = 0 [pid 5062] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5062] setns(3, 0) = 0 [pid 5062] close(3) = 0 [pid 5062] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=8}, 10) = -1 ECONNREFUSED (Connection refused) [pid 5062] ioctl(-1, BTRFS_IOC_INO_LOOKUP_USER, 0x200000c0) = -1 EBADF (Bad file descriptor) [pid 5062] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5062] setns(201, 0) = 0 [pid 5062] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_RFCOMM) = 5 [pid 5062] setns(3, 0) = 0 [pid 5062] close(3) = 0 [ 123.593569][ T5062] [ 123.595928][ T5062] ====================================================== [ 123.602939][ T5062] WARNING: possible circular locking dependency detected [ 123.609953][ T5062] 6.6.0-rc6-syzkaller-00029-g213f891525c2 #0 Not tainted [ 123.616960][ T5062] ------------------------------------------------------ [ 123.624944][ T5062] syz-executor415/5062 is trying to acquire lock: [ 123.631800][ T5062] ffffffff8e880088 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_dlc_exists+0x5b/0x190 [ 123.641033][ T5062] [ 123.641033][ T5062] but task is already holding lock: [ 123.648400][ T5062] ffffffff8e885008 (rfcomm_ioctl_mutex){+.+.}-{3:3}, at: rfcomm_dev_ioctl+0x8b9/0x1c50 [ 123.658063][ T5062] [ 123.658063][ T5062] which lock already depends on the new lock. [ 123.658063][ T5062] [ 123.668453][ T5062] [ 123.668453][ T5062] the existing dependency chain (in reverse order) is: [ 123.679596][ T5062] [ 123.679596][ T5062] -> #3 (rfcomm_ioctl_mutex){+.+.}-{3:3}: [ 123.687503][ T5062] __mutex_lock+0x181/0x1340 [ 123.692619][ T5062] rfcomm_dev_ioctl+0x8b9/0x1c50 [ 123.698074][ T5062] rfcomm_sock_ioctl+0xb0/0xe0 [ 123.703353][ T5062] sock_do_ioctl+0x113/0x270 [ 123.708550][ T5062] sock_ioctl+0x229/0x6b0 [ 123.713389][ T5062] __x64_sys_ioctl+0x18f/0x210 [ 123.718666][ T5062] do_syscall_64+0x38/0xb0 [ 123.723602][ T5062] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 123.730014][ T5062] [ 123.730014][ T5062] -> #2 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}: [ 123.741465][ T5062] lock_sock_nested+0x3a/0xf0 [ 123.746709][ T5062] rfcomm_sk_state_change+0x6d/0x3a0 [ 123.752624][ T5062] __rfcomm_dlc_close+0x285/0x720 [ 123.758319][ T5062] rfcomm_dlc_close+0x1e7/0x240 [ 123.763790][ T5062] __rfcomm_sock_close+0xa7/0x230 [ 123.769426][ T5062] rfcomm_sock_shutdown+0xd1/0x230 [ 123.775055][ T5062] rfcomm_sock_release+0x5d/0x140 [ 123.780597][ T5062] __sock_release+0xae/0x260 [ 123.785716][ T5062] sock_close+0x1c/0x20 [ 123.790393][ T5062] __fput+0x3f7/0xa70 [ 123.794896][ T5062] task_work_run+0x14d/0x240 [ 123.800007][ T5062] do_exit+0xa92/0x2a20 [ 123.804683][ T5062] do_group_exit+0xd4/0x2a0 [ 123.809705][ T5062] get_signal+0x23ba/0x2790 [ 123.814719][ T5062] arch_do_signal_or_restart+0x90/0x7f0 [ 123.820782][ T5062] exit_to_user_mode_prepare+0x11f/0x240 [ 123.827027][ T5062] syscall_exit_to_user_mode+0x1d/0x60 [ 123.833541][ T5062] do_syscall_64+0x44/0xb0 [ 123.839383][ T5062] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 123.846015][ T5062] [ 123.846015][ T5062] -> #1 (&d->lock){+.+.}-{3:3}: [ 123.853050][ T5062] __mutex_lock+0x181/0x1340 [ 123.858175][ T5062] __rfcomm_dlc_close+0x231/0x720 [ 123.863728][ T5062] rfcomm_dlc_close+0x1e7/0x240 [ 123.869104][ T5062] __rfcomm_sock_close+0xa7/0x230 [ 123.874647][ T5062] rfcomm_sock_shutdown+0xd1/0x230 [ 123.880272][ T5062] rfcomm_sock_release+0x5d/0x140 [ 123.885813][ T5062] __sock_release+0xae/0x260 [ 123.890925][ T5062] sock_close+0x1c/0x20 [ 123.895597][ T5062] __fput+0x3f7/0xa70 [ 123.900096][ T5062] task_work_run+0x14d/0x240 [ 123.905201][ T5062] do_exit+0xa92/0x2a20 [ 123.909875][ T5062] do_group_exit+0xd4/0x2a0 [ 123.914922][ T5062] get_signal+0x23ba/0x2790 [ 123.919956][ T5062] arch_do_signal_or_restart+0x90/0x7f0 [ 123.926667][ T5062] exit_to_user_mode_prepare+0x11f/0x240 [ 123.933357][ T5062] syscall_exit_to_user_mode+0x1d/0x60 [ 123.940985][ T5062] do_syscall_64+0x44/0xb0 [ 123.946813][ T5062] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 123.953371][ T5062] [ 123.953371][ T5062] -> #0 (rfcomm_mutex){+.+.}-{3:3}: [ 123.960764][ T5062] __lock_acquire+0x2e3d/0x5de0 [ 123.966144][ T5062] lock_acquire+0x1ae/0x510 [ 123.971166][ T5062] __mutex_lock+0x181/0x1340 [ 123.976309][ T5062] rfcomm_dlc_exists+0x5b/0x190 [ 123.981676][ T5062] rfcomm_dev_ioctl+0x999/0x1c50 [ 123.987160][ T5062] rfcomm_sock_ioctl+0xb0/0xe0 [ 123.992452][ T5062] sock_do_ioctl+0x113/0x270 [ 123.997571][ T5062] sock_ioctl+0x229/0x6b0 [ 124.002423][ T5062] __x64_sys_ioctl+0x18f/0x210 [ 124.007703][ T5062] do_syscall_64+0x38/0xb0 [ 124.012632][ T5062] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 124.019130][ T5062] [ 124.019130][ T5062] other info that might help us debug this: [ 124.019130][ T5062] [ 124.029343][ T5062] Chain exists of: [ 124.029343][ T5062] rfcomm_mutex --> sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM --> rfcomm_ioctl_mutex [ 124.029343][ T5062] [ 124.044378][ T5062] Possible unsafe locking scenario: [ 124.044378][ T5062] [ 124.051824][ T5062] CPU0 CPU1 [ 124.057183][ T5062] ---- ---- [ 124.062558][ T5062] lock(rfcomm_ioctl_mutex); [ 124.067228][ T5062] lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM); [ 124.075897][ T5062] lock(rfcomm_ioctl_mutex); [ 124.083085][ T5062] lock(rfcomm_mutex); [ 124.087320][ T5062] [ 124.087320][ T5062] *** DEADLOCK *** [ 124.087320][ T5062] [ 124.095454][ T5062] 2 locks held by syz-executor415/5062: [ 124.100986][ T5062] #0: ffff8880290d4130 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sock_ioctl+0xa3/0xe0 [ 124.112383][ T5062] #1: ffffffff8e885008 (rfcomm_ioctl_mutex){+.+.}-{3:3}, at: rfcomm_dev_ioctl+0x8b9/0x1c50 [ 124.123352][ T5062] [ 124.123352][ T5062] stack backtrace: [ 124.129846][ T5062] CPU: 0 PID: 5062 Comm: syz-executor415 Not tainted 6.6.0-rc6-syzkaller-00029-g213f891525c2 #0 [ 124.140302][ T5062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 124.150447][ T5062] Call Trace: [ 124.153738][ T5062] [ 124.156661][ T5062] dump_stack_lvl+0xd9/0x1b0 [ 124.161267][ T5062] check_noncircular+0x311/0x3f0 [ 124.166208][ T5062] ? print_circular_bug+0x750/0x750 [ 124.171410][ T5062] ? kernel_text_address+0x6e/0xd0 [ 124.176563][ T5062] ? arch_stack_walk+0x112/0x170 [ 124.181496][ T5062] __lock_acquire+0x2e3d/0x5de0 [ 124.186364][ T5062] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 124.192354][ T5062] ? save_trace+0x4e/0xb30 [ 124.196791][ T5062] ? _find_first_zero_bit+0x94/0xb0 [ 124.201996][ T5062] ? add_lock_to_list+0x17d/0x380 [ 124.207020][ T5062] lock_acquire+0x1ae/0x510 [ 124.211531][ T5062] ? rfcomm_dlc_exists+0x5b/0x190 [ 124.216562][ T5062] ? lock_sync+0x190/0x190 [ 124.220978][ T5062] ? preempt_count_sub+0x150/0x150 [ 124.226093][ T5062] __mutex_lock+0x181/0x1340 [ 124.230859][ T5062] ? rfcomm_dlc_exists+0x5b/0x190 [ 124.235918][ T5062] ? rfcomm_dlc_exists+0x5b/0x190 [ 124.240948][ T5062] ? cred_has_capability.isra.0+0x192/0x2f0 [ 124.246876][ T5062] ? check_nnp_nosuid.isra.0+0x290/0x290 [ 124.252522][ T5062] ? mutex_lock_io_nested+0x11a0/0x11a0 [ 124.258071][ T5062] ? __might_fault+0x13f/0x1a0 [ 124.262837][ T5062] ? reacquire_held_locks+0x4b0/0x4b0 [ 124.268299][ T5062] ? preempt_count_sub+0x150/0x150 [ 124.273410][ T5062] ? cap_capable+0x1d8/0x240 [ 124.278009][ T5062] ? rfcomm_dlc_exists+0x5b/0x190 [ 124.283026][ T5062] rfcomm_dlc_exists+0x5b/0x190 [ 124.287873][ T5062] rfcomm_dev_ioctl+0x999/0x1c50 [ 124.292901][ T5062] ? rfcomm_dev_state_change+0x170/0x170 [ 124.298617][ T5062] ? reacquire_held_locks+0x4b0/0x4b0 [ 124.303986][ T5062] ? mark_held_locks+0x9f/0xe0 [ 124.308744][ T5062] ? __local_bh_enable_ip+0xa4/0x120 [ 124.314030][ T5062] rfcomm_sock_ioctl+0xb0/0xe0 [ 124.318967][ T5062] sock_do_ioctl+0x113/0x270 [ 124.323568][ T5062] ? get_user_ifreq+0x250/0x250 [ 124.328960][ T5062] ? do_vfs_ioctl+0x379/0x1920 [ 124.333734][ T5062] ? vfs_fileattr_set+0xbf0/0xbf0 [ 124.338782][ T5062] ? ioctl_has_perm.constprop.0.isra.0+0x2f9/0x460 [ 124.345317][ T5062] ? selinux_bprm_creds_for_exec+0xb30/0xb30 [ 124.351312][ T5062] sock_ioctl+0x229/0x6b0 [ 124.355642][ T5062] ? br_ioctl_call+0xb0/0xb0 [ 124.360253][ T5062] ? selinux_file_ioctl+0x17d/0x270 [ 124.365455][ T5062] ? selinux_file_ioctl+0xb5/0x270 [ 124.370582][ T5062] ? br_ioctl_call+0xb0/0xb0 [ 124.375183][ T5062] __x64_sys_ioctl+0x18f/0x210 [ 124.379957][ T5062] do_syscall_64+0x38/0xb0 [ 124.384377][ T5062] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 124.390278][ T5062] RIP: 0033:0x7f9e22bc1d09 [ 124.394687][ T5062] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 124.414294][ T5062] RSP: 002b:00007ffe16448918 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 124.425053][ T5062] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f9e22bc1d09 [ 124.435916][ T5062] RDX: 0000000020000100 RSI: 00000000400452c8 RDI: 0000000000000005 [pid 5062] ioctl(5, RFCOMMCREATEDEV, 0x20000100) = 0 [pid 5062] close(3) = -1 EBADF (Bad file descriptor) [pid 5062] close(4) = 0 [pid 5062] close(5) = 0 [pid 5062] close(6) = -1 EBADF (Bad file descriptor) [pid 5062] close(7) = -1 EBADF (Bad file descriptor) [pid 5062] close(8) = -1 EBADF (Bad file descriptor) [pid 5062] close(9) = -1 EBADF (Bad file descriptor) [pid 5062] close(10) = -1 EBADF (Bad file descriptor) [pid 5062] close(11) = -1 EBADF (Bad file descriptor) [pid 5062] close(12) = -1 EBADF (Bad file descriptor) [pid 5062] close(13) = -1 EBADF (Bad file descriptor) [pid 5062] close(14) = -1 EBADF (Bad file descriptor) [pid 5062] close(15) = -1 EBADF (Bad file descriptor) [pid 5062] close(16) = -1 EBADF (Bad file descriptor) [pid 5062] close(17) = -1 EBADF (Bad file descriptor) [pid 5062] close(18) = -1 EBADF (Bad file descriptor) [pid 5062] close(19) = -1 EBADF (Bad file descriptor) [pid 5062] close(20) = -1 EBADF (Bad file descriptor) [pid 5062] close(21) = -1 EBADF (Bad file descriptor) [pid 5062] close(22) = -1 EBADF (Bad file descriptor) [pid 5062] close(23) = -1 EBADF (Bad file descriptor) [pid 5062] close(24) = -1 EBADF (Bad file descriptor) [pid 5062] close(25) = -1 EBADF (Bad file descriptor) [pid 5062] close(26) = -1 EBADF (Bad file descriptor) [pid 5062] close(27) = -1 EBADF (Bad file descriptor) [pid 5062] close(28) = -1 EBADF (Bad file descriptor) [pid 5062] close(29) = -1 EBADF (Bad file descriptor) [pid 5062] exit_group(0) = ? [pid 5062] +++ exited with 0 +++ [pid 5031] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=11, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5031] restart_syscall(<... resuming interrupted clone ...>) = 0 [ 124.444206][ T5062] RBP: 00000000000f4240 R08: 0000000000000000 R09: 0000555500000000 [ 124.452271][ T5062] R10: 0000555500000000 R11: 0000000000000246 R12: 00007ffe16448960 [ 124.460251][ T5062] R13: 00007ffe16448970 R14: 000000000001ced2 R15: 00007ffe16448930 [ 124.468239][ T5062] [pid 5031] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555566a1690) = 12 ./strace-static-x86_64: Process 5064 attached [pid 5064] set_robust_list(0x5555566a16a0, 24) = 0 [pid 5064] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5064] setpgid(0, 0) = 0 [pid 5064] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5064] write(3, "1000", 4) = 4 [pid 5064] close(3) = 0 [pid 5064] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5064] setns(201, 0) = 0 [pid 5064] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5064] setns(3, 0) = 0 [pid 5064] close(3) = 0 [ 126.531694][ T4434] Bluetooth: hci0: command 0x0405 tx timeout [pid 5064] connect(4, {sa_family=AF_BLUETOOTH, rc_bdaddr=aa:aa:aa:aa:aa:00, rc_channel=8}, 10 [pid 5031] kill(-12, SIGKILL) = 0 [pid 5031] kill(12, SIGKILL) = 0 [pid 5064] <... connect resumed>) = ? [pid 5064] +++ killed by SIGKILL +++ [pid 5031] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=12, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=1 /* 0.01 s */} --- [pid 5031] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555566a1690) = 13 ./strace-static-x86_64: Process 5065 attached [pid 5065] set_robust_list(0x5555566a16a0, 24) = 0 [pid 5065] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5065] setpgid(0, 0) = 0 [pid 5065] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5065] write(3, "1000", 4) = 4 [pid 5065] close(3) = 0 [pid 5065] openat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY) = 3 [pid 5065] setns(201, 0) = 0 [pid 5065] socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM) = 4 [pid 5065] setns(3, 0) = 0 [pid 5065] close(3) = 0