./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1785494090

<...>
Warning: Permanently added '10.128.0.239' (ED25519) to the list of known hosts.
execve("./syz-executor1785494090", ["./syz-executor1785494090"], 0x7ffcb7afeb80 /* 10 vars */) = 0
brk(NULL)                               = 0x555593ad2000
brk(0x555593ad2d40)                     = 0x555593ad2d40
arch_prctl(ARCH_SET_FS, 0x555593ad23c0) = 0
set_tid_address(0x555593ad2690)         = 5057
set_robust_list(0x555593ad26a0, 24)     = 0
rseq(0x555593ad2ce0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1785494090", 4096) = 28
getrandom("\x8f\xb0\xde\xb8\xad\x2b\x9b\xaf", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555593ad2d40
brk(0x555593af3d40)                     = 0x555593af3d40
brk(0x555593af4000)                     = 0x555593af4000
mprotect(0x7fcc53dd5000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
chmod("/dev/raw-gadget", 0666)          = 0
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555593ad2690) = 5058
./strace-static-x86_64: Process 5058 attached
[pid  5058] set_robust_list(0x555593ad26a0, 24) = 0
[pid  5058] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5058] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3
[pid  5058] openat(AT_FDCWD, "/dev/vhci", O_RDWR) = 4
[pid  5058] dup2(4, 202)                = 202
[pid  5058] close(4)                    = 0
[pid  5058] write(202, "\xff\x00", 2)   = 2
[pid  5058] read(202, "\xff\x00\x00\x00", 4) = 4
[pid  5058] rt_sigaction(SIGRT_1, {sa_handler=0x7fcc53d74440, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7fcc53d65af0}, NULL, 8) = 0
[pid  5058] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
[pid  5058] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fcc53400000
[pid  5058] mprotect(0x7fcc53401000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5058] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5058] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fcc53c00990, parent_tid=0x7fcc53c00990, exit_signal=0, stack=0x7fcc53400000, stack_size=0x800300, tls=0x7fcc53c006c0}./strace-static-x86_64: Process 5061 attached
 <unfinished ...>
[pid  5061] rseq(0x7fcc53c00fe0, 0x20, 0, 0x53053053 <unfinished ...>
[pid  5058] <... clone3 resumed> => {parent_tid=[2]}, 88) = 2
[pid  5061] <... rseq resumed>)         = 0
[pid  5058] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid  5061] set_robust_list(0x7fcc53c009a0, 24 <unfinished ...>
[pid  5058] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid  5058] ioctl(3, HCIDEVUP <unfinished ...>
[pid  5061] <... set_robust_list resumed>) = 0
[pid  5061] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5061] read(202, "\x01\x03\x0c\x00", 1024) = 4
[pid  5061] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5061] read(202, "\x01\x03\x10\x00", 1024) = 4
[pid  5061] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5061] read(202, "\x01\x01\x10\x00", 1024) = 4
[pid  5061] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5061] read(202, "\x01\x09\x10\x00", 1024) = 4
[pid  5061] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4) = 13
[pid  5061] read(202, "\x01\x05\x10\x00", 1024) = 4
[pid  5061] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4) = 14
[pid  5061] read(202, "\x01\x23\x0c\x00", 1024) = 4
[   54.322957][ T5060] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   54.341344][ T5060] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   54.349066][ T5060] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[pid  5061] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5061] read(202, "\x01\x14\x0c\x00", 1024) = 4
[pid  5061] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5061] read(202, "\x01\x25\x0c\x00", 1024) = 4
[pid  5061] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5061] read(202, "\x01\x38\x0c\x00", 1024) = 4
[pid  5061] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5061] read(202, "\x01\x39\x0c\x00", 1024) = 4
[pid  5061] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5061] read(202, "\x01\x16\x0c\x02\x00\x7d", 1024) = 6
[pid  5061] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5058] <... ioctl resumed>, 0)     = -1 EALREADY (Operation already in progress)
[pid  5061] read(202,  <unfinished ...>
[pid  5058] ioctl(3, HCISETSCAN <unfinished ...>
[pid  5061] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5
[pid  5061] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4) = 7
[pid  5058] <... ioctl resumed>, 0x7ffe592f03b4) = 0
[pid  5061] rt_sigprocmask(SIG_BLOCK, ~[RT_1],  <unfinished ...>
[pid  5058] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3 <unfinished ...>
[pid  5061] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid  5058] <... writev resumed>)       = 13
[pid  5061] madvise(0x7fcc53400000, 8372224, MADV_DONTNEED) = 0
[pid  5061] exit(0)                     = ?
[pid  5058] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3 <unfinished ...>
[pid  5061] +++ exited with 0 +++
[pid  5058] <... writev resumed>)       = 14
[pid  5058] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3) = 14
[pid  5058] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22
[   54.412619][ T5060] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   54.424800][ T5060] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   54.442485][ T5060] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[pid  5058] close(3)                    = 0
[pid  5058] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5058] setsid()                    = 1
[pid  5058] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5058] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5058] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5058] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5058] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5058] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5058] unshare(CLONE_NEWNS)        = 0
[pid  5058] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5058] unshare(CLONE_NEWIPC)       = 0
[pid  5058] unshare(CLONE_NEWCGROUP)    = 0
[pid  5058] unshare(CLONE_NEWUTS)       = 0
[pid  5058] unshare(CLONE_SYSVSEM)      = 0
[pid  5058] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5058] write(3, "16777216", 8)     = 8
[pid  5058] close(3)                    = 0
[pid  5058] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5058] write(3, "536870912", 9)    = 9
[pid  5058] close(3)                    = 0
[pid  5058] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5058] write(3, "1024", 4)         = 4
[pid  5058] close(3)                    = 0
[pid  5058] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5058] write(3, "8192", 4)         = 4
[pid  5058] close(3)                    = 0
[pid  5058] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5058] write(3, "1024", 4)         = 4
[pid  5058] close(3)                    = 0
[pid  5058] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  5058] write(3, "1024", 4)         = 4
[pid  5058] close(3)                    = 0
[pid  5058] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5058] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5058] close(3)                    = 0
[pid  5058] getpid()                    = 1
[pid  5058] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5058] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5058] unshare(CLONE_NEWNET)       = 0
[pid  5058] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5058] write(3, "0 65535", 7)      = 7
[pid  5058] close(3)                    = 0
[pid  5058] mkdir("/dev/binderfs", 0777) = 0
[pid  5058] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5058] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5058] memfd_create("syzkaller", 0) = 3
[pid  5058] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fcc4b000000
[pid  5058] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid  5058] munmap(0x7fcc4b000000, 138412032) = 0
[pid  5058] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5058] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5058] close(3)                    = 0
[pid  5058] close(4)                    = 0
[pid  5058] mkdir("./file0", 0777)      = 0
[   55.029160][ T5058] loop0: detected capacity change from 0 to 32768
[   55.060138][ T5058] =======================================================
[   55.060138][ T5058] WARNING: The mand mount option has been deprecated and
[pid  5058] mount("/dev/loop0", "./file0", "jfs", MS_RDONLY|MS_MANDLOCK|MS_NODIRATIME, "") = 0
[pid  5058] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid  5058] chdir("./file0")            = 0
[pid  5058] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = -1 EBUSY (Device or resource busy)
[pid  5058] openat(AT_FDCWD, ".", O_RDONLY) = 4
[   55.060138][ T5058]          and is ignored by this kernel. Remove the mand
[   55.060138][ T5058]          option from the mount to silence this warning.
[   55.060138][ T5058] =======================================================
[pid  5058] ioctl(4, FITRIM, {start=0x1, len=3328647434077854440, minlen=0}) = 0
[pid  5058] exit_group(1)               = ?
[   55.134654][ T5058] ERROR: (device loop0): dbDiscardAG: -EIO
[   55.134654][ T5058] 
[   55.142792][ T5058] syz-executor178: attempt to access beyond end of device
[   55.142792][ T5058] loop0: rw=2051, sector=18014398509490176, nr_sectors = 8192 limit=32768
[   55.158612][ T5058] JFS: sb_issue_discard(ffff8880239ee000, 2251799813686272, 1024, GFP_NOFS, 0) = -5 => failed!
[   55.169028][ T5058] blkno = 8000000000400, nblocks = 400
[   55.174526][ T5058] ERROR: (device loop0): dbFree: block to be freed is outside the map
[   55.174526][ T5058] 
[   55.215357][ T5058] BUG: Bad page state in process syz-executor178  pfn:2380e
[   55.222908][ T5058] page:ffffea00008e0380 refcount:0 mapcount:0 mapping:0000000000000000 index:0x4 pfn:0x2380e
[   55.233386][ T5058] flags: 0xfff0000000800c(referenced|uptodate|private|node=0|zone=1|lastcpupid=0x7ff)
[   55.242953][ T5058] page_type: 0xffffffff()
[   55.247730][ T5058] raw: 00fff0000000800c ffffea00008d5188 ffffc90003aaf740 0000000000000000
[   55.256365][ T5058] raw: 0000000000000004 ffff8880235449b0 00000000ffffffff 0000000000000000
[   55.265031][ T5058] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
[   55.272330][ T5058] page_owner tracks the page as allocated
[   55.278631][ T5058] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x40c40(GFP_NOFS|__GFP_COMP), pid 5058, tgid 5058 (syz-executor178), ts 55133543100, free_ts 54292281689
[   55.295834][ T5058]  post_alloc_hook+0x1ea/0x210
[   55.300619][ T5058]  get_page_from_freelist+0x33ea/0x3580
[   55.306216][ T5058]  __alloc_pages+0x256/0x680
[   55.310823][ T5058]  alloc_pages_mpol+0x3de/0x650
[   55.315763][ T5058]  folio_alloc+0x12b/0x330
[   55.320189][ T5058]  filemap_alloc_folio+0xdf/0x500
[   55.325239][ T5058]  do_read_cache_folio+0xed/0x820
[   55.330283][ T5058]  do_read_cache_page+0x30/0x200
[   55.335286][ T5058]  __get_metapage+0x330/0x1050
[   55.340063][ T5058]  dbAllocCtl+0xd5/0x920
[   55.344338][ T5058]  dbAllocAG+0x28f/0x10b0
[   55.348673][ T5058]  dbDiscardAG+0x352/0xa10
[   55.353072][ T5058]  jfs_ioc_trim+0x433/0x670
[   55.357623][ T5058]  jfs_ioctl+0x2d0/0x3e0
[   55.361869][ T5058]  __se_sys_ioctl+0xfc/0x170
[   55.366503][ T5058]  do_syscall_64+0xfb/0x240
[   55.371021][ T5058] page last free pid 5059 tgid 5059 stack trace:
[   55.377378][ T5058]  free_unref_page_prepare+0x95d/0xa80
[   55.382854][ T5058]  free_unref_page+0x37/0x3f0
[   55.387590][ T5058]  __put_partials+0xeb/0x130
[   55.392198][ T5058]  put_cpu_partial+0x17c/0x250
[   55.396998][ T5058]  __slab_free+0x2ea/0x3d0
[   55.401421][ T5058]  qlist_free_all+0x5e/0xc0
[   55.405994][ T5058]  kasan_quarantine_reduce+0x14f/0x170
[   55.411489][ T5058]  __kasan_slab_alloc+0x23/0x80
[   55.416367][ T5058]  __kmalloc_node+0x202/0x4e0
[   55.421054][ T5058]  kvmalloc_node+0x72/0x190
[   55.425610][ T5058]  seq_read_iter+0x202/0xd60
[   55.430205][ T5058]  vfs_read+0x97b/0xb70
[   55.434390][ T5058]  ksys_read+0x1a0/0x2c0
[   55.438633][ T5058]  do_syscall_64+0xfb/0x240
[   55.443122][ T5058]  entry_SYSCALL_64_after_hwframe+0x6d/0x75
[   55.453127][ T5058] Modules linked in:
[   55.457429][ T5058] CPU: 0 PID: 5058 Comm: syz-executor178 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
[   55.467498][ T5058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
[   55.477547][ T5058] Call Trace:
[   55.480823][ T5058]  <TASK>
[   55.483749][ T5058]  dump_stack_lvl+0x241/0x360
[   55.488413][ T5058]  ? __pfx_dump_stack_lvl+0x10/0x10
[   55.493594][ T5058]  ? __pfx_print_modules+0x10/0x10
[   55.498712][ T5058]  bad_page+0x14c/0x170
[   55.502862][ T5058]  free_unref_page_prepare+0xa28/0xa80
[   55.508311][ T5058]  free_unref_page_list+0x5a3/0x850
[   55.513507][ T5058]  ? __mod_zone_page_state+0xda/0x150
[   55.518879][ T5058]  release_pages+0x2117/0x2400
[   55.523649][ T5058]  ? __pfx_release_pages+0x10/0x10
[   55.528755][ T5058]  ? __pfx_delete_from_page_cache_batch+0x10/0x10
[   55.535180][ T5058]  ? mlock_drain_local+0x79/0x490
[   55.540199][ T5058]  ? mlock_drain_local+0x79/0x490
[   55.545210][ T5058]  ? mlock_drain_local+0x28d/0x490
[   55.550314][ T5058]  __folio_batch_release+0x84/0x100
[   55.555506][ T5058]  truncate_inode_pages_range+0x457/0xf70
[   55.561227][ T5058]  ? mark_lock+0x9a/0x350
[   55.565551][ T5058]  ? __pfx_truncate_inode_pages_range+0x10/0x10
[   55.571807][ T5058]  ? __pfx_call_rcu+0x10/0x10
[   55.576481][ T5058]  dbUnmount+0x115/0x190
[   55.580721][ T5058]  jfs_umount+0x238/0x3a0
[   55.585054][ T5058]  jfs_put_super+0x8a/0x190
[   55.589549][ T5058]  ? __pfx_jfs_put_super+0x10/0x10
[   55.594651][ T5058]  generic_shutdown_super+0x136/0x2d0
[   55.600019][ T5058]  kill_block_super+0x44/0x90
[   55.604690][ T5058]  deactivate_locked_super+0xc4/0x130
[   55.610056][ T5058]  cleanup_mnt+0x426/0x4c0
[   55.614467][ T5058]  ? _raw_spin_unlock_irq+0x23/0x50
[   55.619659][ T5058]  task_work_run+0x24f/0x310
[   55.624246][ T5058]  ? __pfx_task_work_run+0x10/0x10
[   55.629373][ T5058]  ? do_exit+0xa16/0x27e0
[   55.633705][ T5058]  ? kmem_cache_free+0x102/0x2b0
[   55.638640][ T5058]  do_exit+0xa1b/0x27e0
[   55.642796][ T5058]  ? __pfx_do_exit+0x10/0x10
[   55.647395][ T5058]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   55.653376][ T5058]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   55.659700][ T5058]  ? _raw_spin_unlock_irq+0x23/0x50
[   55.664891][ T5058]  ? lockdep_hardirqs_on+0x99/0x150
[   55.670084][ T5058]  do_group_exit+0x207/0x2c0
[   55.674673][ T5058]  __x64_sys_exit_group+0x3f/0x40
[   55.679707][ T5058]  do_syscall_64+0xfb/0x240
[   55.684207][ T5058]  entry_SYSCALL_64_after_hwframe+0x6d/0x75
[   55.690096][ T5058] RIP: 0033:0x7fcc53d4c389
[   55.694504][ T5058] Code: Unable to access opcode bytes at 0x7fcc53d4c35f.
[   55.701512][ T5058] RSP: 002b:00007ffe592f0338 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   55.709936][ T5058] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fcc53d4c389
[pid  5058] +++ exited with 1 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5058, si_uid=0, si_status=1, si_utime=2 /* 0.02 s */, si_stime=52 /* 0.52 s */} ---
exit_group(0)                           = ?
+++ exited with 0 +++
[