./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3630887611 <...> Warning: Permanently added '10.128.1.29' (ED25519) to the list of known hosts. execve("./syz-executor3630887611", ["./syz-executor3630887611"], 0x7fff94a114e0 /* 10 vars */) = 0 brk(NULL) = 0x55557c4ab000 brk(0x55557c4abd40) = 0x55557c4abd40 arch_prctl(ARCH_SET_FS, 0x55557c4ab3c0) = 0 set_tid_address(0x55557c4ab690) = 5073 set_robust_list(0x55557c4ab6a0, 24) = 0 rseq(0x55557c4abce0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor3630887611", 4096) = 28 getrandom("\xcb\x21\x47\xf8\x23\xa6\x74\x1a", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557c4abd40 brk(0x55557c4ccd40) = 0x55557c4ccd40 brk(0x55557c4cd000) = 0x55557c4cd000 mprotect(0x7fbca87e2000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 getpid() = 5073 openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3 write(3, "10000000000", 11) = 11 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 write(3, "20", 2) = 2 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 write(3, "100", 3) = 3 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 write(3, "7 4 1 3", 7) = 7 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 write(3, "0", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 write(3, "5073", 4) = 4 close(3) = 0 mkdir("/syzcgroup", 0777) = 0 mkdir("/syzcgroup/unified", 0777) = 0 mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL) = 0 chmod("/syzcgroup/unified", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/unified/cgroup.subtree_control", O_WRONLY) = 3 write(3, "+cpu", 4) = 4 write(3, "+io", 3) = 3 write(3, "+pids", 5) = 5 close(3) = 0 mkdir("/syzcgroup/net", 0777) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "net") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "devices") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "blkio") = 0 umount2("/syzcgroup/net", 0) = 0 mount("none", "/syzcgroup/net", "cgroup", 0, "freezer") = 0 umount2("/syzcgroup/net", 0) = 0 [ 74.582863][ T5073] cgroup: Unknown subsys name 'net' mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/net", "cgroup", 0, "net_prio,devices,blkio,freezer") = 0 chmod("/syzcgroup/net", 0777) = 0 mkdir("/syzcgroup/cpu", 0777) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuacct") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "hugetlb") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "rlimit") = -1 EINVAL (Invalid argument) mount("none", "/syzcgroup/cpu", "cgroup", 0, "memory") = 0 umount2("/syzcgroup/cpu", 0) = 0 mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) [ 74.765372][ T5073] cgroup: Unknown subsys name 'rlimit' mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb,memory") = ? ERESTARTNOINTR (To be restarted) mount("none", "/syzcgroup/cpu", "cgroup", 0, "cpuset,cpuacct,hugetlb,memory") = 0 chmod("/syzcgroup/cpu", 0777) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cgroup.clone_children", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 openat(AT_FDCWD, "/syzcgroup/cpu/cpuset.memory_pressure_enabled", O_WRONLY|O_CLOEXEC) = 3 write(3, "1", 1) = 1 close(3) = 0 mount(NULL, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, NULL) = -1 EBUSY (Device or resource busy) openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x30\x3a\x4d\x3a\x30\x3a\x01\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a", 21) = 21 close(3) = 0 openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3 write(3, "\x3a\x73\x79\x7a\x31\x3a\x4d\x3a\x31\x3a\x02\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a\x50\x4f\x43", 24) = 24 close(3) = 0 mkdir("./syzkaller.AT5adq", 0700) = 0 chmod("./syzkaller.AT5adq", 0777) = 0 chdir("./syzkaller.AT5adq") = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5074 attached , child_tidptr=0x55557c4ab690) = 5074 [pid 5074] set_robust_list(0x55557c4ab6a0, 24) = 0 [pid 5074] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5074] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3 [pid 5074] openat(AT_FDCWD, "/dev/vhci", O_RDWR) = 4 [pid 5074] dup2(4, 202) = 202 [pid 5074] close(4) = 0 [pid 5074] write(202, "\xff\x00", 2) = 2 [pid 5074] read(202, "\xff\x00\x00\x00", 4) = 4 [pid 5074] rt_sigaction(SIGRT_1, {sa_handler=0x7fbca878c040, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fbca877d950}, NULL, 8) = 0 [pid 5074] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 5074] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fbca7e00000 [pid 5074] mprotect(0x7fbca7e01000, 8388608, PROT_READ|PROT_WRITE) = 0 [pid 5074] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 5074] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fbca8600990, parent_tid=0x7fbca8600990, exit_signal=0, stack=0x7fbca7e00000, stack_size=0x800300, tls=0x7fbca86006c0}./strace-static-x86_64: Process 5078 attached => {parent_tid=[2]}, 88) = 2 [pid 5074] rt_sigprocmask(SIG_SETMASK, [], [pid 5078] rseq(0x7fbca8600fe0, 0x20, 0, 0x53053053) = 0 [pid 5074] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5078] set_robust_list(0x7fbca86009a0, 24 [pid 5074] ioctl(3, HCIDEVUP [pid 5078] <... set_robust_list resumed>) = 0 [pid 5078] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 5078] read(202, "\x01\x03\x0c\x00", 1024) = 4 [pid 5078] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5078] read(202, "\x01\x03\x10\x00", 1024) = 4 [pid 5078] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5078] read(202, "\x01\x01\x10\x00", 1024) = 4 [pid 5078] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5078] read(202, "\x01\x09\x10\x00", 1024) = 4 [pid 5078] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4) = 13 [pid 5078] read(202, "\x01\x05\x10\x00", 1024) = 4 [pid 5078] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4) = 14 [pid 5078] read(202, "\x01\x23\x0c\x00", 1024) = 4 [ 75.106082][ T5077] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 75.114769][ T5077] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 75.123236][ T5077] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [pid 5078] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5078] read(202, "\x01\x14\x0c\x00", 1024) = 4 [pid 5078] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5078] read(202, "\x01\x25\x0c\x00", 1024) = 4 [pid 5078] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5078] read(202, "\x01\x38\x0c\x00", 1024) = 4 [pid 5078] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5078] read(202, "\x01\x39\x0c\x00", 1024) = 4 [pid 5078] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5078] read(202, "\x01\x16\x0c\x02\x00\x7d", 1024) = 6 [pid 5078] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255 [pid 5074] <... ioctl resumed>, 0) = -1 EALREADY (Operation already in progress) [pid 5078] read(202, [ 75.174350][ T5077] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 75.186004][ T5077] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 75.204910][ T5077] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [pid 5074] ioctl(3, HCISETSCAN [pid 5078] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5 [pid 5078] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4) = 7 [pid 5078] rt_sigprocmask(SIG_BLOCK, ~[RT_1], [pid 5074] <... ioctl resumed>, 0x7ffd1a6a5608) = 0 [pid 5078] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 5074] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3 [pid 5078] madvise(0x7fbca7e00000, 8372224, MADV_DONTNEED) = 0 [pid 5074] <... writev resumed>) = 13 [pid 5078] exit(0) = ? [pid 5074] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3 [pid 5078] +++ exited with 0 +++ [pid 5074] <... writev resumed>) = 14 [pid 5074] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3) = 14 [pid 5074] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22 [pid 5074] close(3) = 0 [pid 5074] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5074] setsid() = 1 [pid 5074] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5074] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5074] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5074] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5074] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5074] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5074] unshare(CLONE_NEWNS) = 0 [pid 5074] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5074] unshare(CLONE_NEWIPC) = 0 [pid 5074] unshare(CLONE_NEWCGROUP) = 0 [pid 5074] unshare(CLONE_NEWUTS) = 0 [pid 5074] unshare(CLONE_SYSVSEM) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "16777216", 8) = 8 [pid 5074] close(3) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "536870912", 9) = 9 [pid 5074] close(3) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "1024", 4) = 4 [pid 5074] close(3) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "8192", 4) = 4 [pid 5074] close(3) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "1024", 4) = 4 [pid 5074] close(3) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "1024", 4) = 4 [pid 5074] close(3) = 0 [pid 5074] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5074] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5074] close(3) = 0 [pid 5074] getpid() = 1 [pid 5074] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [pid 5074] kill(-3, SIGKILL) = 0 [pid 5086] <... close resumed>) = ? [pid 5074] kill(3, SIGKILL [pid 5086] +++ killed by SIGKILL +++ [pid 5074] <... kill resumed>) = 0 [pid 5074] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=3, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=615 /* 6.15 s */} --- [pid 5074] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 5074] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 5074] getdents64(3, 0x55557c4ac850 /* 6 entries */, 32768) = 176 [pid 5074] umount2("./0/cgroup.cpu", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] newfstatat(AT_FDCWD, "./0/cgroup.cpu", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] unlink("./0/cgroup.cpu") = 0 [pid 5074] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] unlink("./0/binderfs") = 0 [pid 5074] umount2("./0/cgroup", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] newfstatat(AT_FDCWD, "./0/cgroup", {st_mode=S_IFLNK|0777, st_size=23, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] unlink("./0/cgroup") = 0 [pid 5074] umount2("./0/cgroup.net", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 5074] newfstatat(AT_FDCWD, "./0/cgroup.net", {st_mode=S_IFLNK|0777, st_size=19, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 5074] unlink("./0/cgroup.net") = 0 [ 228.658127][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 228.665144][ C0] rcu: 1-...!: (1 ticks this GP) idle=f744/1/0x4000000000000000 softirq=6822/6822 fqs=0 [ 228.675626][ C0] rcu: (detected by 0, t=10503 jiffies, g=8373, q=658 ncpus=2) [ 228.683294][ C0] Sending NMI from CPU 0 to CPUs 1: [ 228.688522][ C1] NMI backtrace for cpu 1 [ 228.688534][ C1] CPU: 1 PID: 4736 Comm: dhcpcd Not tainted 6.8.0-syzkaller-05271-gf99c5f563c17 #0 [ 228.688551][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 [ 228.688561][ C1] RIP: 0010:lock_release+0x124/0x9d0 [ 228.688608][ C1] Code: 00 65 48 8b 04 25 80 ce 03 00 48 89 44 24 18 48 8d 98 d4 0a 00 00 48 89 d8 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 c3 05 00 00 <83> 3b 00 0f 85 f1 04 00 00 4c 8d b4 24 b0 00 00 00 4c 89 f3 48 c1 [ 228.688621][ C1] RSP: 0018:ffffc90000a08a60 EFLAGS: 00000046 [ 228.688637][ C1] RAX: 0000000000000000 RBX: ffff888018308ad4 RCX: ffffffff8171c080 [ 228.688649][ C1] RDX: 0000000000000000 RSI: ffffffff8bfec640 RDI: ffffffff8bfec600 [ 228.688660][ C1] RBP: ffffc90000a08b90 R08: ffffffff8f86ae6f R09: 1ffffffff1f0d5cd [ 228.688672][ C1] R10: dffffc0000000000 R11: fffffbfff1f0d5ce R12: 1ffff92000141158 [ 228.688685][ C1] R13: ffffffff84ac5555 R14: ffffc90000a08bc0 R15: dffffc0000000000 [ 228.688698][ C1] FS: 00007f8e49f9b740(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 [ 228.688712][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 228.688724][ C1] CR2: 00007f8e4a140b10 CR3: 0000000028508000 CR4: 00000000003506f0 [ 228.688738][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 228.688748][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 228.688758][ C1] Call Trace: [ 228.688765][ C1] [ 228.688772][ C1] ? nmi_cpu_backtrace+0x3c2/0x4d0 [ 228.688803][ C1] ? __pfx_lock_acquire+0x10/0x10 [ 228.688822][ C1] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 228.688846][ C1] ? nmi_handle+0x2a/0x580 [ 228.688872][ C1] ? nmi_cpu_backtrace_handler+0xc/0x20 [ 228.688894][ C1] ? nmi_handle+0x14f/0x580 [ 228.688910][ C1] ? nmi_handle+0x2a/0x580 [ 228.688928][ C1] ? lock_release+0x124/0x9d0 [ 228.688944][ C1] ? default_do_nmi+0x63/0x160 [ 228.688969][ C1] ? exc_nmi+0x123/0x1f0 [ 228.688994][ C1] ? end_repeat_nmi+0xf/0x53 [ 228.689020][ C1] ? debug_object_deactivate+0x2d5/0x390 [ 228.689040][ C1] ? lock_release+0xb0/0x9d0 [ 228.689057][ C1] ? lock_release+0x124/0x9d0 [ 228.689073][ C1] ? lock_release+0x124/0x9d0 [ 228.689092][ C1] ? lock_release+0x124/0x9d0 [ 228.689109][ C1] [ 228.689113][ C1] [ 228.689123][ C1] ? do_raw_spin_lock+0x14f/0x370 [ 228.689147][ C1] ? __pfx_lock_release+0x10/0x10 [ 228.689166][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 228.689192][ C1] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 228.689215][ C1] _raw_spin_unlock_irqrestore+0x79/0x140 [ 228.689237][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 228.689264][ C1] debug_object_deactivate+0x2d5/0x390 [ 228.689283][ C1] ? __pfx_debug_object_deactivate+0x10/0x10 [ 228.689303][ C1] ? timerqueue_add+0x260/0x290 [ 228.689332][ C1] debug_deactivate+0x1b/0x200 [ 228.689355][ C1] __hrtimer_run_queues+0x30f/0xd00 [ 228.689387][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 228.689414][ C1] hrtimer_interrupt+0x396/0x990 [ 228.689448][ C1] __sysvec_apic_timer_interrupt+0x107/0x3a0 [ 228.689477][ C1] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 228.689497][ C1] [ 228.689501][ C1] [ 228.689507][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 228.689533][ C1] RIP: 0010:__sanitizer_cov_trace_cmp8+0x35/0x90 [ 228.689558][ C1] Code: 0c 25 80 ce 03 00 65 8b 05 a0 db 6e 7e a9 00 01 ff 00 74 10 a9 00 01 00 00 74 57 83 b9 14 16 00 00 00 74 4e 8b 81 f0 15 00 00 <83> f8 03 75 43 48 8b 91 f8 15 00 00 44 8b 89 f4 15 00 00 49 c1 e1 [ 228.689571][ C1] RSP: 0018:ffffc900035ff500 EFLAGS: 00000246 [ 228.689591][ C1] RAX: 0000000000000000 RBX: ffffffff81000000 RCX: ffff888018308000 [ 228.689602][ C1] RDX: ffffc900035ff615 RSI: ffffffff81000000 RDI: ffffffff81ecc4e1 [ 228.689614][ C1] RBP: ffffffff81ecc4e1 R08: ffffffff81409149 R09: ffffc900035ff6d0 [ 228.689626][ C1] R10: 0000000000000003 R11: ffffffff8180dbc0 R12: ffffc900035ff5e0 [ 228.689638][ C1] R13: ffffc900035ff630 R14: dffffc0000000000 R15: ffffffff81ecc4e2 [ 228.689650][ C1] ? kmem_cache_alloc_node+0x192/0x380 [ 228.689677][ C1] ? kmem_cache_alloc_node+0x191/0x380 [ 228.689701][ C1] ? 0xffffffff81000000 [ 228.689712][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 228.689738][ C1] ? unwind_next_frame+0x1d9/0x2a00 [ 228.689764][ C1] ? 0xffffffff81000000 [ 228.689775][ C1] ? kmem_cache_alloc_node+0x191/0x380 [ 228.689802][ C1] unwind_next_frame+0x1d9/0x2a00 [ 228.689833][ C1] ? kmem_cache_alloc_node+0x192/0x380 [ 228.689857][ C1] ? kmem_cache_alloc_node+0x192/0x380 [ 228.689882][ C1] ? __kernel_text_address+0xd/0x40 [ 228.689905][ C1] ? kmem_cache_alloc_node+0x192/0x380 [ 228.689929][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 228.689954][ C1] arch_stack_walk+0x151/0x1b0 [ 228.689975][ C1] ? kmem_cache_alloc_node+0x192/0x380 [ 228.690003][ C1] stack_trace_save+0x118/0x1d0 [ 228.690026][ C1] ? __pfx_validate_chain+0x10/0x10 [ 228.690048][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 228.690081][ C1] kasan_save_track+0x3f/0x80 [ 228.690099][ C1] ? kasan_save_track+0x3f/0x80 [ 228.690116][ C1] ? __kasan_slab_alloc+0x66/0x80 [ 228.690135][ C1] ? kmem_cache_alloc_node+0x192/0x380 [ 228.690188][ C1] __kasan_slab_alloc+0x66/0x80 [ 228.690209][ C1] kmem_cache_alloc_node+0x192/0x380 [ 228.690234][ C1] ? dup_task_struct+0x57/0x7d0 [ 228.690255][ C1] dup_task_struct+0x57/0x7d0 [ 228.690272][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 228.690291][ C1] ? lockdep_hardirqs_on+0x99/0x150 [ 228.690311][ C1] copy_process+0x5d1/0x3df0 [ 228.690331][ C1] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 228.690356][ C1] ? __pfx___might_resched+0x10/0x10 [ 228.690380][ C1] ? __pfx_copy_process+0x10/0x10 [ 228.690402][ C1] ? aa_sk_perm+0x967/0xab0 [ 228.690422][ C1] kernel_clone+0x21e/0x8d0 [ 228.690445][ C1] ? __pfx_kernel_clone+0x10/0x10 [ 228.690470][ C1] ? do_sock_setsockopt+0x3e2/0x720 [ 228.690501][ C1] __x64_sys_clone+0x258/0x2a0 [ 228.690523][ C1] ? __pfx___x64_sys_clone+0x10/0x10 [ 228.690551][ C1] ? do_syscall_64+0x10a/0x240 [ 228.690574][ C1] ? do_syscall_64+0xb6/0x240 [ 228.690601][ C1] do_syscall_64+0xfb/0x240 [ 228.690625][ C1] entry_SYSCALL_64_after_hwframe+0x6d/0x75 [ 228.690649][ C1] RIP: 0033:0x7f8e4a04ba12 [ 228.690667][ C1] Code: 41 5d 41 5e 41 5f c3 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 10 48 8b 15 e7 43 0f 00 f7 d8 64 89 02 48 83 [ 228.690680][ C1] RSP: 002b:00007fff3d31e228 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 228.690696][ C1] RAX: ffffffffffffffda RBX: 00005624b41b1601 RCX: 00007f8e4a04ba12 [ 228.690708][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 228.690718][ C1] RBP: 00007fff3d33e798 R08: 0000000000000000 R09: 00005624b41b15d0 [ 228.690728][ C1] R10: 00007f8e49f9ba10 R11: 0000000000000246 R12: 0000000000000000 [ 228.690739][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 00005624b41b1604 [ 228.690758][ C1] [ 228.691518][ C0] rcu: rcu_preempt kthread timer wakeup didn't happen for 10502 jiffies! g8373 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 [ 229.382575][ C0] rcu: Possible timer handling issue on cpu=1 timer-softirq=4283 [ 229.390394][ C0] rcu: rcu_preempt kthread starved for 10503 jiffies! g8373 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1 [ 229.401693][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 229.411680][ C0] rcu: RCU grace-period kthread stack dump: [ 229.417581][ C0] task:rcu_preempt state:I stack:24656 pid:16 tgid:16 ppid:2 flags:0x00004000 [ 229.428035][ C0] Call Trace: [ 229.431334][ C0] [ 229.434303][ C0] __schedule+0x17d3/0x4a20 [ 229.438868][ C0] ? __pfx___schedule+0x10/0x10 [ 229.443752][ C0] ? __pfx_lock_release+0x10/0x10 [ 229.448800][ C0] ? __asan_memset+0x23/0x50 [ 229.453423][ C0] ? __pfx_lockdep_init_map_type+0x10/0x10 [ 229.459253][ C0] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 229.465608][ C0] ? schedule+0x90/0x320 [ 229.469878][ C0] schedule+0x14b/0x320 [ 229.474066][ C0] schedule_timeout+0x1be/0x310 [ 229.478942][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 229.484342][ C0] ? __pfx_process_timeout+0x10/0x10 [ 229.489834][ C0] ? prepare_to_swait_event+0x32e/0x350 [ 229.495424][ C0] rcu_gp_fqs_loop+0x2df/0x1370 [ 229.500307][ C0] ? lockdep_hardirqs_on+0x99/0x150 [ 229.505548][ C0] ? __pfx_rcu_gp_init+0x10/0x10 [ 229.510529][ C0] ? lockdep_hardirqs_on+0x99/0x150 [ 229.515755][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 229.521073][ C0] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 229.527005][ C0] ? finish_swait+0xd4/0x1e0 [ 229.531636][ C0] rcu_gp_kthread+0xa7/0x3b0 [ 229.536266][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 229.541501][ C0] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 229.547432][ C0] ? __kthread_parkme+0x169/0x1d0 [ 229.552487][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 229.557750][ C0] kthread+0x2f0/0x390 [ 229.561849][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 229.567084][ C0] ? __pfx_kthread+0x10/0x10 [ 229.571790][ C0] ret_from_fork+0x4b/0x80 [ 229.576241][ C0] ? __pfx_kthread+0x10/0x10 [ 229.580857][ C0] ret_from_fork_asm+0x1a/0x30 [ 229.585671][ C0]