100, 0x80, 0x80, 0x9}, {0x15, 0x3f, 0x1f, 0x9}, {0x58, 0x0, 0xe, 0x7}]}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r0, 0xc0182101, &(0x7f0000000200)={0x0, 0x4, 0x5}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000080)=[@dead_binder_done, @request_death={0x400c630e, 0x2}, @increfs_done={0x40106308, 0x3}, @dead_binder_done, @request_death={0x400c630e, 0x3}], 0x30, 0x0, &(0x7f0000000100)="a0d168a34c50426720bf5cefe8be626daa8ada8b1003095bd168bbde1fb4ac446fd2ece05a914a659b45fffc3106bd71"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x4, 0x3, "df01b6", 0x40, 0x81}) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:10 executing program 5: setsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000), 0x4) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$IMCTRLREQ(r1, 0x80044945, &(0x7f0000000080)={0x4005, 0x8, 0x6, 0x8}) 14:07:10 executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x3, &(0x7f0000000180)=[{0x100, 0x80, 0x80, 0x9}, {0x15, 0x3f, 0x1f, 0x9}, {0x58, 0x0, 0xe, 0x7}]}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r0, 0xc0182101, &(0x7f0000000200)={0x0, 0x4, 0x5}) (async) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000080)=[@dead_binder_done, @request_death={0x400c630e, 0x2}, @increfs_done={0x40106308, 0x3}, @dead_binder_done, @request_death={0x400c630e, 0x3}], 0x30, 0x0, &(0x7f0000000100)="a0d168a34c50426720bf5cefe8be626daa8ada8b1003095bd168bbde1fb4ac446fd2ece05a914a659b45fffc3106bd71"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x4, 0x3, "df01b6", 0x40, 0x81}) (async) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:10 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000080)={0x2, [0x9, 0x1], 0x7}, 0x10) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0xdbe, [0x1ff, 0x6], 0x7}, 0x10) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000080)={0x2, [0x9, 0x1], 0x7}, 0x10) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0xdbe, [0x1ff, 0x6], 0x7}, 0x10) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:10 executing program 4: r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x20400) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, 0x0, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x88, 0x0, &(0x7f0000000200)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000080)={@fda={0x66646185, 0x7, 0x0, 0x1c}, @fda={0x66646185, 0x3, 0x2, 0x7}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000140)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x3, 0x0, 0x2a}, @fda={0x66646185, 0xa, 0x1, 0x11}}, &(0x7f00000001c0)={0x0, 0x18, 0x38}}}], 0x1f, 0x0, &(0x7f00000002c0)="e65af5387836c32b988fddc786405418e97048eb482e1f53ecb4e69f6c2738"}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x800448f0, 0x0) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:10 executing program 3: r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x3, &(0x7f0000000180)=[{0x100, 0x80, 0x80, 0x9}, {0x15, 0x3f, 0x1f, 0x9}, {0x58, 0x0, 0xe, 0x7}]}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r0, 0xc0182101, &(0x7f0000000200)={0x0, 0x4, 0x5}) (async) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000080)=[@dead_binder_done, @request_death={0x400c630e, 0x2}, @increfs_done={0x40106308, 0x3}, @dead_binder_done, @request_death={0x400c630e, 0x3}], 0x30, 0x0, &(0x7f0000000100)="a0d168a34c50426720bf5cefe8be626daa8ada8b1003095bd168bbde1fb4ac446fd2ece05a914a659b45fffc3106bd71"}) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x4, 0x3, "df01b6", 0x40, 0x81}) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:10 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000080)) 14:07:10 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000080)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)) (async) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000080)) (async) 14:07:10 executing program 4: r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x20400) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, 0x0, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x88, 0x0, &(0x7f0000000200)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000080)={@fda={0x66646185, 0x7, 0x0, 0x1c}, @fda={0x66646185, 0x3, 0x2, 0x7}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000140)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x3, 0x0, 0x2a}, @fda={0x66646185, 0xa, 0x1, 0x11}}, &(0x7f00000001c0)={0x0, 0x18, 0x38}}}], 0x1f, 0x0, &(0x7f00000002c0)="e65af5387836c32b988fddc786405418e97048eb482e1f53ecb4e69f6c2738"}) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x800448f0, 0x0) (async) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:10 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000080)) 14:07:10 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0x6, 0xa2, 0x7, 0x101, 0x1, "000800201cce7b00"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000000)={0x0, 0x5, 0x6, 0x4, 0xc, "2acbc4e205e8d30b"}) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:10 executing program 5: r0 = syz_init_net_socket$ax25(0x3, 0x2, 0xca) ioctl$SIOCAX25ADDUID(r0, 0x89e1, &(0x7f0000000540)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0xffffffffffffffff}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$KDFONTOP_GET(r1, 0x4b72, &(0x7f00000004c0)={0x1, 0x1, 0x1c, 0x19, 0xf5, &(0x7f00000000c0)}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r2, 0x80045105, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000000)={'tunl0\x00', 0x0, 0x700, 0x8, 0x81, 0xd99b, {{0x6, 0x4, 0x0, 0x1, 0x18, 0x67, 0x0, 0xff, 0x4, 0x0, @multicast1, @multicast1, {[@noop]}}}}}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r3, 0x400448dc, 0x0) 14:07:10 executing program 4: r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x20400) (async) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, 0x0, 0x0) (async) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x88, 0x0, &(0x7f0000000200)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000080)={@fda={0x66646185, 0x7, 0x0, 0x1c}, @fda={0x66646185, 0x3, 0x2, 0x7}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000100)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000140)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x3, 0x0, 0x2a}, @fda={0x66646185, 0xa, 0x1, 0x11}}, &(0x7f00000001c0)={0x0, 0x18, 0x38}}}], 0x1f, 0x0, &(0x7f00000002c0)="e65af5387836c32b988fddc786405418e97048eb482e1f53ecb4e69f6c2738"}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x800448f0, 0x0) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:10 executing program 5: r0 = syz_init_net_socket$ax25(0x3, 0x2, 0xca) ioctl$SIOCAX25ADDUID(r0, 0x89e1, &(0x7f0000000540)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0xffffffffffffffff}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$KDFONTOP_GET(r1, 0x4b72, &(0x7f00000004c0)={0x1, 0x1, 0x1c, 0x19, 0xf5, &(0x7f00000000c0)}) (async) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r2, 0x80045105, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000000)={'tunl0\x00', 0x0, 0x700, 0x8, 0x81, 0xd99b, {{0x6, 0x4, 0x0, 0x1, 0x18, 0x67, 0x0, 0xff, 0x4, 0x0, @multicast1, @multicast1, {[@noop]}}}}}) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r3, 0x400448dc, 0x0) 14:07:10 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0x6, 0xa2, 0x7, 0x101, 0x1, "000800201cce7b00"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000000)={0x0, 0x5, 0x6, 0x4, 0xc, "2acbc4e205e8d30b"}) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r0, 0x0, 0x0) (async) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0x6, 0xa2, 0x7, 0x101, 0x1, "000800201cce7b00"}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r2, 0x0, 0x0) (async) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000000)={0x0, 0x5, 0x6, 0x4, 0xc, "2acbc4e205e8d30b"}) (async) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:10 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x14800, 0x0) write$bt_hci(r1, &(0x7f00000000c0)={0x1, @write_le_host_supported={{0xc6d, 0x2}, {0x3f, 0x7f}}}, 0x11) [ 2785.012780] Bluetooth: hci1 command 0x0401 tx timeout 14:07:10 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x14800, 0x0) write$bt_hci(r1, &(0x7f00000000c0)={0x1, @write_le_host_supported={{0xc6d, 0x2}, {0x3f, 0x7f}}}, 0x11) 14:07:10 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) (async) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0x6, 0xa2, 0x7, 0x101, 0x1, "000800201cce7b00"}) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) (async) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000000)={0x0, 0x5, 0x6, 0x4, 0xc, "2acbc4e205e8d30b"}) (async) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:10 executing program 5: r0 = syz_init_net_socket$ax25(0x3, 0x2, 0xca) ioctl$SIOCAX25ADDUID(r0, 0x89e1, &(0x7f0000000540)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0xffffffffffffffff}) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$KDFONTOP_GET(r1, 0x4b72, &(0x7f00000004c0)={0x1, 0x1, 0x1c, 0x19, 0xf5, &(0x7f00000000c0)}) (async) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r2, 0x80045105, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000000)={'tunl0\x00', 0x0, 0x700, 0x8, 0x81, 0xd99b, {{0x6, 0x4, 0x0, 0x1, 0x18, 0x67, 0x0, 0xff, 0x4, 0x0, @multicast1, @multicast1, {[@noop]}}}}}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r3, 0x400448dc, 0x0) 14:07:10 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x14800, 0x0) write$bt_hci(r1, &(0x7f00000000c0)={0x1, @write_le_host_supported={{0xc6d, 0x2}, {0x3f, 0x7f}}}, 0x11) 14:07:10 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0x100, [0x5d4c93, 0xfffffff7], 0x5b27}, 0x10) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:10 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) recvmsg$unix(r2, &(0x7f00000003c0)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000001440)=[{&(0x7f0000000100)=""/50, 0x32}, {&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000000140)=""/214, 0xd6}, {&(0x7f0000000240)=""/139, 0x8b}, {&(0x7f0000000300)=""/192, 0xc0}], 0x5}, 0x1) ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, &(0x7f0000001540)) connect$ax25(0xffffffffffffffff, &(0x7f00000014c0)={{0x3, @null, 0x5}, [@bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @null]}, 0x48) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x400000, 0x0) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0xfffffe6d) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:10 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SNDCTL_SEQ_GETINCOUNT(0xffffffffffffffff, 0x80045105, &(0x7f0000000000)) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:10 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0x100, [0x5d4c93, 0xfffffff7], 0x5b27}, 0x10) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:10 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) (async) recvmsg$unix(r2, &(0x7f00000003c0)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000001440)=[{&(0x7f0000000100)=""/50, 0x32}, {&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000000140)=""/214, 0xd6}, {&(0x7f0000000240)=""/139, 0x8b}, {&(0x7f0000000300)=""/192, 0xc0}], 0x5}, 0x1) (async) ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, &(0x7f0000001540)) connect$ax25(0xffffffffffffffff, &(0x7f00000014c0)={{0x3, @null, 0x5}, [@bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @null]}, 0x48) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x400000, 0x0) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0xfffffe6d) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:10 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0x100, [0x5d4c93, 0xfffffff7], 0x5b27}, 0x10) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async, rerun: 64) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (rerun: 64) 14:07:10 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SNDCTL_SEQ_GETINCOUNT(0xffffffffffffffff, 0x80045105, &(0x7f0000000000)) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async, rerun: 32) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (rerun: 32) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000180)={&(0x7f0000000340)=[r2, r3, r4, r5, 0x0], &(0x7f0000000380)=[0x102, 0x80, 0x1], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_RESET(0xffffffffffffffff, 0xc01064c4, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0, 0x0, r4, r6, r7], 0x5}) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) recvmsg$unix(r2, &(0x7f00000003c0)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000001440)=[{&(0x7f0000000100)=""/50, 0x32}, {&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000000140)=""/214, 0xd6}, {&(0x7f0000000240)=""/139, 0x8b}, {&(0x7f0000000300)=""/192, 0xc0}], 0x5}, 0x1) ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, &(0x7f0000001540)) (async) connect$ax25(0xffffffffffffffff, &(0x7f00000014c0)={{0x3, @null, 0x5}, [@bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @null]}, 0x48) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x400000, 0x0) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0xfffffe6d) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) r1 = socket$unix(0x1, 0x5, 0x0) (rerun: 32) recvmsg$unix(r1, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) (async, rerun: 32) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) (rerun: 32) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000180)={&(0x7f0000000340)=[r2, r3, r4, r5, 0x0], &(0x7f0000000380)=[0x102, 0x80, 0x1], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_RESET(0xffffffffffffffff, 0xc01064c4, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0, 0x0, r4, r6, r7], 0x5}) (async, rerun: 32) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (rerun: 32) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SNDCTL_SEQ_GETINCOUNT(0xffffffffffffffff, 0x80045105, &(0x7f0000000000)) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x8000, 0x0) ioctl$SNDCTL_TMR_STOP(r0, 0x5403) ioctl$SNDCTL_SYNTH_INFO(r0, 0xc08c5102, &(0x7f00000002c0)={"25ec1ee77d136d98c9bae571069f7c13053967c1df5ccea7321a8601c39a", 0x0, 0x1, 0x0, 0x3, 0x4, 0x85bb, 0x1f, 0x2, [0x1f, 0x3, 0x80, 0x7fffffff, 0x2, 0x2, 0x200, 0x2ae039e6, 0x3ff, 0x180000, 0x396af9ac, 0x12, 0x1ff, 0x8, 0x0, 0x8, 0x4a0, 0x7fff, 0xffffffff]}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) write$P9_RLCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0xf, 0x2, {{0x10, 0x2, 0x1}, 0x2370}}, 0x18) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) write$bt_hci(r1, &(0x7f00000001c0)={0x1, @le_set_ext_scan_params={{0x2041, 0xab}, {0xe0, 0x4, 0x8, "aaf26c8543ab4eb152fa5bbeaca3a006c061fd8e1768ab99807522c901df872d4361a016d192108cfc56d366b1ed2c26ecf4a5c2157939ca40cd8156f2ca9126455d32b9dd35ad4b0e975b34390c1e58e2c654f52e71500d3a1f48d8efbbb02b0acf24ebe73b5b0c6865ab292bd447e42508b2f0543c48d4cd8bb4c394b5ae400a36f8830de87704b61247f91c3784deacf650d9e4f3e5edae1345c9ebc0ccef0859b164e1b499ef"}}}, 0xaf) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f00000000c0)={0x60, 0x140f, 0x100, 0x0, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'rdma_cm\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xd, 0x45, 'opa_vnic\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x11, 0x45, 'ib_multicast\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x2400c801) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000180)={0x3f, [0x6, 0x20], 0x8}, 0x10) r2 = accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @null}, [@rose, @netrom, @rose, @bcast, @netrom, @default, @rose, @netrom]}, &(0x7f0000000000)=0x48) bind$ax25(r2, &(0x7f0000000100)={{0x3, @null, 0x6}, [@null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast]}, 0x48) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f0000000180)={&(0x7f0000000340)=[r2, r3, r4, r5, 0x0], &(0x7f0000000380)=[0x102, 0x80, 0x1], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_RESET(0xffffffffffffffff, 0xc01064c4, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0, 0x0, r4, r6, r7], 0x5}) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000180)={0x3f, [0x6, 0x20], 0x8}, 0x10) (async) r2 = accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @null}, [@rose, @netrom, @rose, @bcast, @netrom, @default, @rose, @netrom]}, &(0x7f0000000000)=0x48) bind$ax25(r2, &(0x7f0000000100)={{0x3, @null, 0x6}, [@null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast]}, 0x48) 14:07:11 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x8000, 0x0) ioctl$SNDCTL_TMR_STOP(r0, 0x5403) ioctl$SNDCTL_SYNTH_INFO(r0, 0xc08c5102, &(0x7f00000002c0)={"25ec1ee77d136d98c9bae571069f7c13053967c1df5ccea7321a8601c39a", 0x0, 0x1, 0x0, 0x3, 0x4, 0x85bb, 0x1f, 0x2, [0x1f, 0x3, 0x80, 0x7fffffff, 0x2, 0x2, 0x200, 0x2ae039e6, 0x3ff, 0x180000, 0x396af9ac, 0x12, 0x1ff, 0x8, 0x0, 0x8, 0x4a0, 0x7fff, 0xffffffff]}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) write$P9_RLCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0xf, 0x2, {{0x10, 0x2, 0x1}, 0x2370}}, 0x18) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) write$bt_hci(r1, &(0x7f00000001c0)={0x1, @le_set_ext_scan_params={{0x2041, 0xab}, {0xe0, 0x4, 0x8, "aaf26c8543ab4eb152fa5bbeaca3a006c061fd8e1768ab99807522c901df872d4361a016d192108cfc56d366b1ed2c26ecf4a5c2157939ca40cd8156f2ca9126455d32b9dd35ad4b0e975b34390c1e58e2c654f52e71500d3a1f48d8efbbb02b0acf24ebe73b5b0c6865ab292bd447e42508b2f0543c48d4cd8bb4c394b5ae400a36f8830de87704b61247f91c3784deacf650d9e4f3e5edae1345c9ebc0ccef0859b164e1b499ef"}}}, 0xaf) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f00000000c0)={0x60, 0x140f, 0x100, 0x0, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'rdma_cm\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xd, 0x45, 'opa_vnic\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x11, 0x45, 'ib_multicast\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x2400c801) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x8000, 0x0) (async) ioctl$SNDCTL_TMR_STOP(r0, 0x5403) (async) ioctl$SNDCTL_SYNTH_INFO(r0, 0xc08c5102, &(0x7f00000002c0)={"25ec1ee77d136d98c9bae571069f7c13053967c1df5ccea7321a8601c39a", 0x0, 0x1, 0x0, 0x3, 0x4, 0x85bb, 0x1f, 0x2, [0x1f, 0x3, 0x80, 0x7fffffff, 0x2, 0x2, 0x200, 0x2ae039e6, 0x3ff, 0x180000, 0x396af9ac, 0x12, 0x1ff, 0x8, 0x0, 0x8, 0x4a0, 0x7fff, 0xffffffff]}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) (async) write$P9_RLCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0xf, 0x2, {{0x10, 0x2, 0x1}, 0x2370}}, 0x18) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) write$bt_hci(r1, &(0x7f00000001c0)={0x1, @le_set_ext_scan_params={{0x2041, 0xab}, {0xe0, 0x4, 0x8, "aaf26c8543ab4eb152fa5bbeaca3a006c061fd8e1768ab99807522c901df872d4361a016d192108cfc56d366b1ed2c26ecf4a5c2157939ca40cd8156f2ca9126455d32b9dd35ad4b0e975b34390c1e58e2c654f52e71500d3a1f48d8efbbb02b0acf24ebe73b5b0c6865ab292bd447e42508b2f0543c48d4cd8bb4c394b5ae400a36f8830de87704b61247f91c3784deacf650d9e4f3e5edae1345c9ebc0ccef0859b164e1b499ef"}}}, 0xaf) (async) socket$nl_rdma(0x10, 0x3, 0x14) (async) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f00000000c0)={0x60, 0x140f, 0x100, 0x0, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'rdma_cm\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xd, 0x45, 'opa_vnic\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x11, 0x45, 'ib_multicast\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x2400c801) (async) 14:07:11 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000000)=0x6e) clock_gettime(0x0, &(0x7f0000006340)={0x0, 0x0}) clock_gettime(0x2, &(0x7f00000063c0)) recvmmsg$unix(r0, &(0x7f0000006200)=[{{&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000400)=[{&(0x7f0000000180)=""/60, 0x3c}, {&(0x7f00000001c0)=""/99, 0x63}, {&(0x7f0000000240)=""/40, 0x28}, {&(0x7f0000000280)=""/126, 0x7e}, {&(0x7f0000000300)=""/85, 0x55}, {&(0x7f0000000380)=""/107, 0x6b}], 0x6, &(0x7f0000000480)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}], 0x138}}, {{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000005c0)=""/4096, 0x1000}], 0x1, &(0x7f0000001600)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x38}}, {{&(0x7f0000001640)=@abs, 0x6e, &(0x7f0000001780)=[{&(0x7f00000016c0)=""/53, 0x35}, {&(0x7f0000001700)=""/87, 0x57}], 0x2}}, {{&(0x7f00000017c0), 0x6e, &(0x7f0000002b80)=[{&(0x7f0000001840)=""/219, 0xdb}, {&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f0000002940)=""/140, 0x8c}, {&(0x7f0000002a00)=""/126, 0x7e}, {&(0x7f0000002a80)=""/238, 0xee}], 0x5, &(0x7f0000002c00)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{&(0x7f0000002c80)=@abs, 0x6e, &(0x7f00000060c0)=[{&(0x7f0000002d00)=""/58, 0x3a}, {&(0x7f0000002d40)=""/175, 0xaf}, {&(0x7f0000002e00)=""/4096, 0x1000}, {&(0x7f0000003e00)=""/7, 0x7}, {&(0x7f0000003e40)=""/4096, 0x1000}, {&(0x7f0000004e40)=""/88, 0x58}, {&(0x7f0000004ec0)=""/242, 0xf2}, {&(0x7f0000004fc0)=""/185, 0xb9}, {&(0x7f0000005080)=""/4096, 0x1000}, {&(0x7f0000006080)=""/18, 0x12}], 0xa, &(0x7f0000006180)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x60}}], 0x5, 0x2, &(0x7f0000006380)={r1, r2+60000000}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x800448f0, 0x0) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000000)=0x6e) clock_gettime(0x0, &(0x7f0000006340)={0x0, 0x0}) clock_gettime(0x2, &(0x7f00000063c0)) recvmmsg$unix(r0, &(0x7f0000006200)=[{{&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000400)=[{&(0x7f0000000180)=""/60, 0x3c}, {&(0x7f00000001c0)=""/99, 0x63}, {&(0x7f0000000240)=""/40, 0x28}, {&(0x7f0000000280)=""/126, 0x7e}, {&(0x7f0000000300)=""/85, 0x55}, {&(0x7f0000000380)=""/107, 0x6b}], 0x6, &(0x7f0000000480)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}], 0x138}}, {{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000005c0)=""/4096, 0x1000}], 0x1, &(0x7f0000001600)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x38}}, {{&(0x7f0000001640)=@abs, 0x6e, &(0x7f0000001780)=[{&(0x7f00000016c0)=""/53, 0x35}, {&(0x7f0000001700)=""/87, 0x57}], 0x2}}, {{&(0x7f00000017c0), 0x6e, &(0x7f0000002b80)=[{&(0x7f0000001840)=""/219, 0xdb}, {&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f0000002940)=""/140, 0x8c}, {&(0x7f0000002a00)=""/126, 0x7e}, {&(0x7f0000002a80)=""/238, 0xee}], 0x5, &(0x7f0000002c00)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{&(0x7f0000002c80)=@abs, 0x6e, &(0x7f00000060c0)=[{&(0x7f0000002d00)=""/58, 0x3a}, {&(0x7f0000002d40)=""/175, 0xaf}, {&(0x7f0000002e00)=""/4096, 0x1000}, {&(0x7f0000003e00)=""/7, 0x7}, {&(0x7f0000003e40)=""/4096, 0x1000}, {&(0x7f0000004e40)=""/88, 0x58}, {&(0x7f0000004ec0)=""/242, 0xf2}, {&(0x7f0000004fc0)=""/185, 0xb9}, {&(0x7f0000005080)=""/4096, 0x1000}, {&(0x7f0000006080)=""/18, 0x12}], 0xa, &(0x7f0000006180)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x60}}], 0x5, 0x2, &(0x7f0000006380)={r1, r2+60000000}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x800448f0, 0x0) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) accept$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000000)=0x6e) (async) clock_gettime(0x0, &(0x7f0000006340)) (async) clock_gettime(0x2, &(0x7f00000063c0)) (async) recvmmsg$unix(r0, &(0x7f0000006200)=[{{&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000400)=[{&(0x7f0000000180)=""/60, 0x3c}, {&(0x7f00000001c0)=""/99, 0x63}, {&(0x7f0000000240)=""/40, 0x28}, {&(0x7f0000000280)=""/126, 0x7e}, {&(0x7f0000000300)=""/85, 0x55}, {&(0x7f0000000380)=""/107, 0x6b}], 0x6, &(0x7f0000000480)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}], 0x138}}, {{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000005c0)=""/4096, 0x1000}], 0x1, &(0x7f0000001600)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x38}}, {{&(0x7f0000001640)=@abs, 0x6e, &(0x7f0000001780)=[{&(0x7f00000016c0)=""/53, 0x35}, {&(0x7f0000001700)=""/87, 0x57}], 0x2}}, {{&(0x7f00000017c0), 0x6e, &(0x7f0000002b80)=[{&(0x7f0000001840)=""/219, 0xdb}, {&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f0000002940)=""/140, 0x8c}, {&(0x7f0000002a00)=""/126, 0x7e}, {&(0x7f0000002a80)=""/238, 0xee}], 0x5, &(0x7f0000002c00)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{&(0x7f0000002c80)=@abs, 0x6e, &(0x7f00000060c0)=[{&(0x7f0000002d00)=""/58, 0x3a}, {&(0x7f0000002d40)=""/175, 0xaf}, {&(0x7f0000002e00)=""/4096, 0x1000}, {&(0x7f0000003e00)=""/7, 0x7}, {&(0x7f0000003e40)=""/4096, 0x1000}, {&(0x7f0000004e40)=""/88, 0x58}, {&(0x7f0000004ec0)=""/242, 0xf2}, {&(0x7f0000004fc0)=""/185, 0xb9}, {&(0x7f0000005080)=""/4096, 0x1000}, {&(0x7f0000006080)=""/18, 0x12}], 0xa, &(0x7f0000006180)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x60}}], 0x5, 0x2, &(0x7f0000006380)={r1, r2+60000000}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r3, 0x800448f0, 0x0) (async) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000180)={0x3f, [0x6, 0x20], 0x8}, 0x10) r2 = accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @null}, [@rose, @netrom, @rose, @bcast, @netrom, @default, @rose, @netrom]}, &(0x7f0000000000)=0x48) bind$ax25(r2, &(0x7f0000000100)={{0x3, @null, 0x6}, [@null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast]}, 0x48) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000180)={0x3f, [0x6, 0x20], 0x8}, 0x10) (async) accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @null}, [@rose, @netrom, @rose, @bcast, @netrom, @default, @rose, @netrom]}, &(0x7f0000000000)=0x48) (async) bind$ax25(r2, &(0x7f0000000100)={{0x3, @null, 0x6}, [@null, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast]}, 0x48) (async) 14:07:11 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000000)=0x6e) clock_gettime(0x0, &(0x7f0000006340)={0x0, 0x0}) clock_gettime(0x2, &(0x7f00000063c0)) recvmmsg$unix(r0, &(0x7f0000006200)=[{{&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000400)=[{&(0x7f0000000180)=""/60, 0x3c}, {&(0x7f00000001c0)=""/99, 0x63}, {&(0x7f0000000240)=""/40, 0x28}, {&(0x7f0000000280)=""/126, 0x7e}, {&(0x7f0000000300)=""/85, 0x55}, {&(0x7f0000000380)=""/107, 0x6b}], 0x6, &(0x7f0000000480)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}], 0x138}}, {{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000005c0)=""/4096, 0x1000}], 0x1, &(0x7f0000001600)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x38}}, {{&(0x7f0000001640)=@abs, 0x6e, &(0x7f0000001780)=[{&(0x7f00000016c0)=""/53, 0x35}, {&(0x7f0000001700)=""/87, 0x57}], 0x2}}, {{&(0x7f00000017c0), 0x6e, &(0x7f0000002b80)=[{&(0x7f0000001840)=""/219, 0xdb}, {&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f0000002940)=""/140, 0x8c}, {&(0x7f0000002a00)=""/126, 0x7e}, {&(0x7f0000002a80)=""/238, 0xee}], 0x5, &(0x7f0000002c00)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{&(0x7f0000002c80)=@abs, 0x6e, &(0x7f00000060c0)=[{&(0x7f0000002d00)=""/58, 0x3a}, {&(0x7f0000002d40)=""/175, 0xaf}, {&(0x7f0000002e00)=""/4096, 0x1000}, {&(0x7f0000003e00)=""/7, 0x7}, {&(0x7f0000003e40)=""/4096, 0x1000}, {&(0x7f0000004e40)=""/88, 0x58}, {&(0x7f0000004ec0)=""/242, 0xf2}, {&(0x7f0000004fc0)=""/185, 0xb9}, {&(0x7f0000005080)=""/4096, 0x1000}, {&(0x7f0000006080)=""/18, 0x12}], 0xa, &(0x7f0000006180)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x60}}], 0x5, 0x2, &(0x7f0000006380)={r1, r2+60000000}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x800448f0, 0x0) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) accept$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000000)=0x6e) (async) clock_gettime(0x0, &(0x7f0000006340)) (async) clock_gettime(0x2, &(0x7f00000063c0)) (async) recvmmsg$unix(r0, &(0x7f0000006200)=[{{&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000400)=[{&(0x7f0000000180)=""/60, 0x3c}, {&(0x7f00000001c0)=""/99, 0x63}, {&(0x7f0000000240)=""/40, 0x28}, {&(0x7f0000000280)=""/126, 0x7e}, {&(0x7f0000000300)=""/85, 0x55}, {&(0x7f0000000380)=""/107, 0x6b}], 0x6, &(0x7f0000000480)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}], 0x138}}, {{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000005c0)=""/4096, 0x1000}], 0x1, &(0x7f0000001600)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x38}}, {{&(0x7f0000001640)=@abs, 0x6e, &(0x7f0000001780)=[{&(0x7f00000016c0)=""/53, 0x35}, {&(0x7f0000001700)=""/87, 0x57}], 0x2}}, {{&(0x7f00000017c0), 0x6e, &(0x7f0000002b80)=[{&(0x7f0000001840)=""/219, 0xdb}, {&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f0000002940)=""/140, 0x8c}, {&(0x7f0000002a00)=""/126, 0x7e}, {&(0x7f0000002a80)=""/238, 0xee}], 0x5, &(0x7f0000002c00)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{&(0x7f0000002c80)=@abs, 0x6e, &(0x7f00000060c0)=[{&(0x7f0000002d00)=""/58, 0x3a}, {&(0x7f0000002d40)=""/175, 0xaf}, {&(0x7f0000002e00)=""/4096, 0x1000}, {&(0x7f0000003e00)=""/7, 0x7}, {&(0x7f0000003e40)=""/4096, 0x1000}, {&(0x7f0000004e40)=""/88, 0x58}, {&(0x7f0000004ec0)=""/242, 0xf2}, {&(0x7f0000004fc0)=""/185, 0xb9}, {&(0x7f0000005080)=""/4096, 0x1000}, {&(0x7f0000006080)=""/18, 0x12}], 0xa, &(0x7f0000006180)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x60}}], 0x5, 0x2, &(0x7f0000006380)={r1, r2+60000000}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r3, 0x800448f0, 0x0) (async) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:11 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x8000, 0x0) ioctl$SNDCTL_TMR_STOP(r0, 0x5403) ioctl$SNDCTL_SYNTH_INFO(r0, 0xc08c5102, &(0x7f00000002c0)={"25ec1ee77d136d98c9bae571069f7c13053967c1df5ccea7321a8601c39a", 0x0, 0x1, 0x0, 0x3, 0x4, 0x85bb, 0x1f, 0x2, [0x1f, 0x3, 0x80, 0x7fffffff, 0x2, 0x2, 0x200, 0x2ae039e6, 0x3ff, 0x180000, 0x396af9ac, 0x12, 0x1ff, 0x8, 0x0, 0x8, 0x4a0, 0x7fff, 0xffffffff]}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) (async) write$P9_RLCREATE(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0xf, 0x2, {{0x10, 0x2, 0x1}, 0x2370}}, 0x18) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async, rerun: 32) write$bt_hci(r1, &(0x7f00000001c0)={0x1, @le_set_ext_scan_params={{0x2041, 0xab}, {0xe0, 0x4, 0x8, "aaf26c8543ab4eb152fa5bbeaca3a006c061fd8e1768ab99807522c901df872d4361a016d192108cfc56d366b1ed2c26ecf4a5c2157939ca40cd8156f2ca9126455d32b9dd35ad4b0e975b34390c1e58e2c654f52e71500d3a1f48d8efbbb02b0acf24ebe73b5b0c6865ab292bd447e42508b2f0543c48d4cd8bb4c394b5ae400a36f8830de87704b61247f91c3784deacf650d9e4f3e5edae1345c9ebc0ccef0859b164e1b499ef"}}}, 0xaf) (rerun: 32) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f00000000c0)={0x60, 0x140f, 0x100, 0x0, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'rdma_cm\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xd, 0x45, 'opa_vnic\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x11, 0x45, 'ib_multicast\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x2400c801) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000080)={0x1000, [0xb727, 0x6], 0x1000}, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$IMCLEAR_L2(r1, 0x80044946, &(0x7f00000000c0)=0x5) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0xcc, 0x4) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0x3, [0x6, 0x9], 0x7ff}, 0x10) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x5c1ec0, 0x0) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000080)={0x1000, [0xb727, 0x6], 0x1000}, 0x10) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$IMCLEAR_L2(r1, 0x80044946, &(0x7f00000000c0)=0x5) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0xcc, 0x4) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async, rerun: 64) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) (rerun: 64) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0x3, [0x6, 0x9], 0x7ff}, 0x10) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x5c1ec0, 0x0) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000080)={0x1000, [0xb727, 0x6], 0x1000}, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$IMCLEAR_L2(r1, 0x80044946, &(0x7f00000000c0)=0x5) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0xcc, 0x4) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) (async, rerun: 32) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0x3, [0x6, 0x9], 0x7ff}, 0x10) (rerun: 32) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x5c1ec0, 0x0) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x5c1ec0, 0x0) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) 14:07:11 executing program 3: ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$SIOCX25SCALLUSERDATA(0xffffffffffffffff, 0x89e5, &(0x7f0000000080)={0x47, "f899e428c58719623053632f32465219ddc706355e7a26ebf773d9e623899707817d9cb5bf59b90d5d0b9e24d4e8b78e283c2405e39b31d301750f26c187ebb2770cb87c6a486dd618a2218ee19d0375d29cc6d520728429c8e0dcc6c7c8ef97d66fe06accfd4171d88641ad84f538ee40a28d7a881089d171195f2f36aeba24"}) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000140)={0x86cb}, 0x8) 14:07:11 executing program 5: clock_gettime(0x0, &(0x7f00000098c0)={0x0, 0x0}) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000009680)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)}], 0x1, &(0x7f0000006180)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}], 0x90}}, {{&(0x7f0000000200)=@abs, 0x6e, &(0x7f00000013c0)=[{&(0x7f0000000280)=""/58, 0x3a}, {&(0x7f00000002c0)=""/204, 0xcc}, {&(0x7f00000003c0)=""/4096, 0x1000}], 0x3, &(0x7f0000001400)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x30}}, {{&(0x7f0000001440)=@abs, 0x6e, &(0x7f0000002800)=[{&(0x7f00000014c0)=""/120, 0x78}, {&(0x7f0000001540)=""/193, 0xc1}, {&(0x7f0000001640)=""/4096, 0x1000}, {&(0x7f0000002640)}, {&(0x7f0000002680)=""/164, 0xa4}, {&(0x7f0000002740)=""/159, 0x9f}], 0x6}}, {{0x0, 0x0, &(0x7f00000038c0)=[{&(0x7f0000002880)}, {&(0x7f00000028c0)=""/4096, 0x1000}], 0x2, &(0x7f0000003900)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{&(0x7f0000003940), 0x6e, &(0x7f0000003b40)=[{&(0x7f00000039c0)=""/99, 0x63}, {&(0x7f0000003a40)=""/244, 0xf4}], 0x2}}, {{&(0x7f0000003b80)=@abs, 0x6e, &(0x7f0000005f80)=[{&(0x7f0000003c00)=""/97, 0x61}, {&(0x7f0000003c80)=""/4096, 0x1000}, {&(0x7f0000004c80)=""/190, 0xbe}, {&(0x7f0000004d40)=""/4096, 0x1000}, {&(0x7f0000005d40)=""/82, 0x52}, {&(0x7f0000005dc0)=""/137, 0x89}, {&(0x7f0000005e80)=""/110, 0x6e}, {&(0x7f0000005f00)=""/82, 0x52}], 0x8, &(0x7f0000006000)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xe0}}, {{&(0x7f0000006100), 0x6e, &(0x7f00000067c0), 0x0, &(0x7f0000006880)=ANY=[@ANYBLOB="28000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0c00000b000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="18000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000002c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0xf0}}, {{&(0x7f0000006980), 0x6e, &(0x7f0000008e40)=[{&(0x7f0000006a00)=""/154, 0x9a}, {&(0x7f0000006ac0)=""/4096, 0x1000}, {&(0x7f0000007ac0)=""/17, 0x11}, {&(0x7f0000007b00)=""/191, 0xbf}, {&(0x7f0000007bc0)=""/3, 0x3}, {&(0x7f0000007c00)=""/216, 0xd8}, {&(0x7f0000007d00)=""/168, 0xa8}, {&(0x7f0000007dc0)=""/120, 0x78}, {&(0x7f0000007e40)=""/4096, 0x1000}], 0x9}}, {{&(0x7f0000008f00)=@abs, 0x6e, &(0x7f0000009580)=[{&(0x7f0000008f80)=""/140, 0x8c}, {&(0x7f0000009040)=""/253, 0xfd}, {&(0x7f0000009140)=""/61, 0x3d}, {&(0x7f0000009180)=""/189, 0xbd}, {&(0x7f0000009240)=""/103, 0x67}, {&(0x7f00000092c0)=""/186, 0xba}, {&(0x7f0000009380)=""/105, 0x69}, {&(0x7f0000009400)=""/131, 0x83}, {&(0x7f00000094c0)=""/179, 0xb3}], 0x9, &(0x7f0000009640)=[@cred={{0x1c}}], 0x20}}], 0x9, 0x100, &(0x7f0000009900)={r0, r1+60000000}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f0000000040)=0x4, 0x4) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$MEDIA_REQUEST_IOC_QUEUE(0xffffffffffffffff, 0x7c80, 0x0) ioctl$sock_bt_hci(r2, 0x400448de, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x10a01) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$IMCTRLREQ(r1, 0x80044945, &(0x7f0000000000)={0x4001, 0xffffffff, 0xfffffffe, 0x7}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 3: ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async, rerun: 64) ioctl$SIOCX25SCALLUSERDATA(0xffffffffffffffff, 0x89e5, &(0x7f0000000080)={0x47, "f899e428c58719623053632f32465219ddc706355e7a26ebf773d9e623899707817d9cb5bf59b90d5d0b9e24d4e8b78e283c2405e39b31d301750f26c187ebb2770cb87c6a486dd618a2218ee19d0375d29cc6d520728429c8e0dcc6c7c8ef97d66fe06accfd4171d88641ad84f538ee40a28d7a881089d171195f2f36aeba24"}) (async, rerun: 64) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000140)={0x86cb}, 0x8) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$IMCTRLREQ(r1, 0x80044945, &(0x7f0000000000)={0x4001, 0xffffffff, 0xfffffffe, 0x7}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 5: clock_gettime(0x0, &(0x7f00000098c0)={0x0, 0x0}) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000009680)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)}], 0x1, &(0x7f0000006180)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}], 0x90}}, {{&(0x7f0000000200)=@abs, 0x6e, &(0x7f00000013c0)=[{&(0x7f0000000280)=""/58, 0x3a}, {&(0x7f00000002c0)=""/204, 0xcc}, {&(0x7f00000003c0)=""/4096, 0x1000}], 0x3, &(0x7f0000001400)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x30}}, {{&(0x7f0000001440)=@abs, 0x6e, &(0x7f0000002800)=[{&(0x7f00000014c0)=""/120, 0x78}, {&(0x7f0000001540)=""/193, 0xc1}, {&(0x7f0000001640)=""/4096, 0x1000}, {&(0x7f0000002640)}, {&(0x7f0000002680)=""/164, 0xa4}, {&(0x7f0000002740)=""/159, 0x9f}], 0x6}}, {{0x0, 0x0, &(0x7f00000038c0)=[{&(0x7f0000002880)}, {&(0x7f00000028c0)=""/4096, 0x1000}], 0x2, &(0x7f0000003900)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{&(0x7f0000003940), 0x6e, &(0x7f0000003b40)=[{&(0x7f00000039c0)=""/99, 0x63}, {&(0x7f0000003a40)=""/244, 0xf4}], 0x2}}, {{&(0x7f0000003b80)=@abs, 0x6e, &(0x7f0000005f80)=[{&(0x7f0000003c00)=""/97, 0x61}, {&(0x7f0000003c80)=""/4096, 0x1000}, {&(0x7f0000004c80)=""/190, 0xbe}, {&(0x7f0000004d40)=""/4096, 0x1000}, {&(0x7f0000005d40)=""/82, 0x52}, {&(0x7f0000005dc0)=""/137, 0x89}, {&(0x7f0000005e80)=""/110, 0x6e}, {&(0x7f0000005f00)=""/82, 0x52}], 0x8, &(0x7f0000006000)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xe0}}, {{&(0x7f0000006100), 0x6e, &(0x7f00000067c0), 0x0, &(0x7f0000006880)=ANY=[@ANYBLOB="28000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0c00000b000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="18000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000002c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0xf0}}, {{&(0x7f0000006980), 0x6e, &(0x7f0000008e40)=[{&(0x7f0000006a00)=""/154, 0x9a}, {&(0x7f0000006ac0)=""/4096, 0x1000}, {&(0x7f0000007ac0)=""/17, 0x11}, {&(0x7f0000007b00)=""/191, 0xbf}, {&(0x7f0000007bc0)=""/3, 0x3}, {&(0x7f0000007c00)=""/216, 0xd8}, {&(0x7f0000007d00)=""/168, 0xa8}, {&(0x7f0000007dc0)=""/120, 0x78}, {&(0x7f0000007e40)=""/4096, 0x1000}], 0x9}}, {{&(0x7f0000008f00)=@abs, 0x6e, &(0x7f0000009580)=[{&(0x7f0000008f80)=""/140, 0x8c}, {&(0x7f0000009040)=""/253, 0xfd}, {&(0x7f0000009140)=""/61, 0x3d}, {&(0x7f0000009180)=""/189, 0xbd}, {&(0x7f0000009240)=""/103, 0x67}, {&(0x7f00000092c0)=""/186, 0xba}, {&(0x7f0000009380)=""/105, 0x69}, {&(0x7f0000009400)=""/131, 0x83}, {&(0x7f00000094c0)=""/179, 0xb3}], 0x9, &(0x7f0000009640)=[@cred={{0x1c}}], 0x20}}], 0x9, 0x100, &(0x7f0000009900)={r0, r1+60000000}) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f0000000040)=0x4, 0x4) (async) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$MEDIA_REQUEST_IOC_QUEUE(0xffffffffffffffff, 0x7c80, 0x0) ioctl$sock_bt_hci(r2, 0x400448de, 0x0) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x10a01) 14:07:11 executing program 3: ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$SIOCX25SCALLUSERDATA(0xffffffffffffffff, 0x89e5, &(0x7f0000000080)={0x47, "f899e428c58719623053632f32465219ddc706355e7a26ebf773d9e623899707817d9cb5bf59b90d5d0b9e24d4e8b78e283c2405e39b31d301750f26c187ebb2770cb87c6a486dd618a2218ee19d0375d29cc6d520728429c8e0dcc6c7c8ef97d66fe06accfd4171d88641ad84f538ee40a28d7a881089d171195f2f36aeba24"}) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000140)={0x86cb}, 0x8) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) ioctl$SIOCX25SCALLUSERDATA(0xffffffffffffffff, 0x89e5, &(0x7f0000000080)={0x47, "f899e428c58719623053632f32465219ddc706355e7a26ebf773d9e623899707817d9cb5bf59b90d5d0b9e24d4e8b78e283c2405e39b31d301750f26c187ebb2770cb87c6a486dd618a2218ee19d0375d29cc6d520728429c8e0dcc6c7c8ef97d66fe06accfd4171d88641ad84f538ee40a28d7a881089d171195f2f36aeba24"}) (async) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000140)={0x86cb}, 0x8) (async) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$IMCTRLREQ(r1, 0x80044945, &(0x7f0000000000)={0x4001, 0xffffffff, 0xfffffffe, 0x7}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$IMCTRLREQ(r1, 0x80044945, &(0x7f0000000000)={0x4001, 0xffffffff, 0xfffffffe, 0x7}) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000000000), &(0x7f0000000080)=0x4) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 5: clock_gettime(0x0, &(0x7f00000098c0)={0x0, 0x0}) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000009680)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)}], 0x1, &(0x7f0000006180)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}], 0x90}}, {{&(0x7f0000000200)=@abs, 0x6e, &(0x7f00000013c0)=[{&(0x7f0000000280)=""/58, 0x3a}, {&(0x7f00000002c0)=""/204, 0xcc}, {&(0x7f00000003c0)=""/4096, 0x1000}], 0x3, &(0x7f0000001400)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x30}}, {{&(0x7f0000001440)=@abs, 0x6e, &(0x7f0000002800)=[{&(0x7f00000014c0)=""/120, 0x78}, {&(0x7f0000001540)=""/193, 0xc1}, {&(0x7f0000001640)=""/4096, 0x1000}, {&(0x7f0000002640)}, {&(0x7f0000002680)=""/164, 0xa4}, {&(0x7f0000002740)=""/159, 0x9f}], 0x6}}, {{0x0, 0x0, &(0x7f00000038c0)=[{&(0x7f0000002880)}, {&(0x7f00000028c0)=""/4096, 0x1000}], 0x2, &(0x7f0000003900)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{&(0x7f0000003940), 0x6e, &(0x7f0000003b40)=[{&(0x7f00000039c0)=""/99, 0x63}, {&(0x7f0000003a40)=""/244, 0xf4}], 0x2}}, {{&(0x7f0000003b80)=@abs, 0x6e, &(0x7f0000005f80)=[{&(0x7f0000003c00)=""/97, 0x61}, {&(0x7f0000003c80)=""/4096, 0x1000}, {&(0x7f0000004c80)=""/190, 0xbe}, {&(0x7f0000004d40)=""/4096, 0x1000}, {&(0x7f0000005d40)=""/82, 0x52}, {&(0x7f0000005dc0)=""/137, 0x89}, {&(0x7f0000005e80)=""/110, 0x6e}, {&(0x7f0000005f00)=""/82, 0x52}], 0x8, &(0x7f0000006000)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xe0}}, {{&(0x7f0000006100), 0x6e, &(0x7f00000067c0), 0x0, &(0x7f0000006880)=ANY=[@ANYBLOB="28000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0c00000b000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="18000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000002c000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0xf0}}, {{&(0x7f0000006980), 0x6e, &(0x7f0000008e40)=[{&(0x7f0000006a00)=""/154, 0x9a}, {&(0x7f0000006ac0)=""/4096, 0x1000}, {&(0x7f0000007ac0)=""/17, 0x11}, {&(0x7f0000007b00)=""/191, 0xbf}, {&(0x7f0000007bc0)=""/3, 0x3}, {&(0x7f0000007c00)=""/216, 0xd8}, {&(0x7f0000007d00)=""/168, 0xa8}, {&(0x7f0000007dc0)=""/120, 0x78}, {&(0x7f0000007e40)=""/4096, 0x1000}], 0x9}}, {{&(0x7f0000008f00)=@abs, 0x6e, &(0x7f0000009580)=[{&(0x7f0000008f80)=""/140, 0x8c}, {&(0x7f0000009040)=""/253, 0xfd}, {&(0x7f0000009140)=""/61, 0x3d}, {&(0x7f0000009180)=""/189, 0xbd}, {&(0x7f0000009240)=""/103, 0x67}, {&(0x7f00000092c0)=""/186, 0xba}, {&(0x7f0000009380)=""/105, 0x69}, {&(0x7f0000009400)=""/131, 0x83}, {&(0x7f00000094c0)=""/179, 0xb3}], 0x9, &(0x7f0000009640)=[@cred={{0x1c}}], 0x20}}], 0x9, 0x100, &(0x7f0000009900)={r0, r1+60000000}) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f0000000040)=0x4, 0x4) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$MEDIA_REQUEST_IOC_QUEUE(0xffffffffffffffff, 0x7c80, 0x0) ioctl$sock_bt_hci(r2, 0x400448de, 0x0) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x10a01) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x9735c09342a9bbc2, 0x3}) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x17, &(0x7f0000000080)="65f27cac0349618ce9ce2968ccb3fc807a8799b78cc8926b4eef4ffbb922d8ee00633bbc356c33c1ef254fd94a896f70aa120415607b93db767b18d16c842184b4ca0ccc31fd3063bd0a385832b776ca0a1edd68d24a275b5350f24c28e7b09bd94cd3be2869240373735cde09f74e6971224c1e09bd6db9aea8dd5ffd023162113366ae76cf79453821ad738dd43874560da2ee049bcd20aa1ab5df404c0bb04ab798edcbaa5bca2dbdb74b34d9") ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r2, 0x0, 0x0) getpeername$ax25(r2, &(0x7f00000001c0)={{0x3, @netrom}, [@null, @null, @netrom, @default, @remote, @rose, @rose, @bcast]}, &(0x7f0000000140)=0x48) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000000000), &(0x7f0000000080)=0x4) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x9735c09342a9bbc2, 0x3}) (async) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x17, &(0x7f0000000080)="65f27cac0349618ce9ce2968ccb3fc807a8799b78cc8926b4eef4ffbb922d8ee00633bbc356c33c1ef254fd94a896f70aa120415607b93db767b18d16c842184b4ca0ccc31fd3063bd0a385832b776ca0a1edd68d24a275b5350f24c28e7b09bd94cd3be2869240373735cde09f74e6971224c1e09bd6db9aea8dd5ffd023162113366ae76cf79453821ad738dd43874560da2ee049bcd20aa1ab5df404c0bb04ab798edcbaa5bca2dbdb74b34d9") (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async, rerun: 32) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (rerun: 32) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r2, 0x0, 0x0) (async) getpeername$ax25(r2, &(0x7f00000001c0)={{0x3, @netrom}, [@null, @null, @netrom, @default, @remote, @rose, @rose, @bcast]}, &(0x7f0000000140)=0x48) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000000000), &(0x7f0000000080)=0x4) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x17, &(0x7f0000000080)="65f27cac0349618ce9ce2968ccb3fc807a8799b78cc8926b4eef4ffbb922d8ee00633bbc356c33c1ef254fd94a896f70aa120415607b93db767b18d16c842184b4ca0ccc31fd3063bd0a385832b776ca0a1edd68d24a275b5350f24c28e7b09bd94cd3be2869240373735cde09f74e6971224c1e09bd6db9aea8dd5ffd023162113366ae76cf79453821ad738dd43874560da2ee049bcd20aa1ab5df404c0bb04ab798edcbaa5bca2dbdb74b34d9") ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r2, 0x0, 0x0) getpeername$ax25(r2, &(0x7f00000001c0)={{0x3, @netrom}, [@null, @null, @netrom, @default, @remote, @rose, @rose, @bcast]}, &(0x7f0000000140)=0x48) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r1, 0x17, &(0x7f0000000080)="65f27cac0349618ce9ce2968ccb3fc807a8799b78cc8926b4eef4ffbb922d8ee00633bbc356c33c1ef254fd94a896f70aa120415607b93db767b18d16c842184b4ca0ccc31fd3063bd0a385832b776ca0a1edd68d24a275b5350f24c28e7b09bd94cd3be2869240373735cde09f74e6971224c1e09bd6db9aea8dd5ffd023162113366ae76cf79453821ad738dd43874560da2ee049bcd20aa1ab5df404c0bb04ab798edcbaa5bca2dbdb74b34d9") (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) getpeername$ax25(r2, 0x0, 0x0) (async) getpeername$ax25(r2, &(0x7f00000001c0)={{0x3, @netrom}, [@null, @null, @netrom, @default, @remote, @rose, @rose, @bcast]}, &(0x7f0000000140)=0x48) (async) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x9735c09342a9bbc2, 0x3}) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x9735c09342a9bbc2, 0x3}) (async) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) (async) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) ioctl$SNDCTL_TMR_START(r1, 0x5402) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, &(0x7f0000000080)="fd087b4d7ed16425d10939f76ebf8683f2ab5b8f62fab9d77d1ea9336af2fe0bbef4c7366a480f4898998311db385b0d928e50ba12ec89a1d36a1cdba4d3ae959543c255a52f28ff50f80e6e34d7cf989f105834f596ed89e8be32592e72df69cc945ad9b2bbea4aee1a7831a96cf21d856af0b324b6c0b2be6e13327e5b7bf0c1abc3a35f4a0bd6dd638237ffccf049b085947fbd7696cf0b32b7dc4ffc2fca68") 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f0000000080)={"9ca7475f488e86a4c0c9837941336a515f31385233b3d34b0c189a1ae1f0", 0xeccd, 0x1f, 0x7ff, [0x0, 0x6, 0x2, 0x100, 0x9, 0x5, 0x0, 0x80000000, 0x6, 0x4, 0x2, 0x80000000, 0x318e6df9, 0x9, 0x9, 0x5, 0x4, 0x9]}) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async, rerun: 32) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) (rerun: 32) ioctl$SNDCTL_TMR_START(r1, 0x5402) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, &(0x7f0000000080)="fd087b4d7ed16425d10939f76ebf8683f2ab5b8f62fab9d77d1ea9336af2fe0bbef4c7366a480f4898998311db385b0d928e50ba12ec89a1d36a1cdba4d3ae959543c255a52f28ff50f80e6e34d7cf989f105834f596ed89e8be32592e72df69cc945ad9b2bbea4aee1a7831a96cf21d856af0b324b6c0b2be6e13327e5b7bf0c1abc3a35f4a0bd6dd638237ffccf049b085947fbd7696cf0b32b7dc4ffc2fca68") syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448dc, &(0x7f0000000080)="fd087b4d7ed16425d10939f76ebf8683f2ab5b8f62fab9d77d1ea9336af2fe0bbef4c7366a480f4898998311db385b0d928e50ba12ec89a1d36a1cdba4d3ae959543c255a52f28ff50f80e6e34d7cf989f105834f596ed89e8be32592e72df69cc945ad9b2bbea4aee1a7831a96cf21d856af0b324b6c0b2be6e13327e5b7bf0c1abc3a35f4a0bd6dd638237ffccf049b085947fbd7696cf0b32b7dc4ffc2fca68") (async) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f0000000080)={"9ca7475f488e86a4c0c9837941336a515f31385233b3d34b0c189a1ae1f0", 0xeccd, 0x1f, 0x7ff, [0x0, 0x6, 0x2, 0x100, 0x9, 0x5, 0x0, 0x80000000, 0x6, 0x4, 0x2, 0x80000000, 0x318e6df9, 0x9, 0x9, 0x5, 0x4, 0x9]}) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) ioctl$SNDCTL_TMR_START(r1, 0x5402) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) (async) ioctl$SNDCTL_TMR_START(r1, 0x5402) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async, rerun: 32) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (rerun: 32) ioctl$sock_bt_hci(r0, 0x400448dc, &(0x7f0000000080)="fd087b4d7ed16425d10939f76ebf8683f2ab5b8f62fab9d77d1ea9336af2fe0bbef4c7366a480f4898998311db385b0d928e50ba12ec89a1d36a1cdba4d3ae959543c255a52f28ff50f80e6e34d7cf989f105834f596ed89e8be32592e72df69cc945ad9b2bbea4aee1a7831a96cf21d856af0b324b6c0b2be6e13327e5b7bf0c1abc3a35f4a0bd6dd638237ffccf049b085947fbd7696cf0b32b7dc4ffc2fca68") 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f0000000080)={"9ca7475f488e86a4c0c9837941336a515f31385233b3d34b0c189a1ae1f0", 0xeccd, 0x1f, 0x7ff, [0x0, 0x6, 0x2, 0x100, 0x9, 0x5, 0x0, 0x80000000, 0x6, 0x4, 0x2, 0x80000000, 0x318e6df9, 0x9, 0x9, 0x5, 0x4, 0x9]}) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448dd, &(0x7f00000002c0)="c488074deaf0c51bac3b8fffece3612850d461da54ce9f120eba33ff78565aa626eab2b5c6b0c2f9acb8cb66d92c7484") r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000280)={r3, 0x3, r2, 0xfffffffc, 0x80000}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f00000001c0)=0x1) r4 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r4, 0x0, 0x0) getsockname$ax25(r4, &(0x7f0000000300)={{0x3, @default}, [@bcast, @netrom, @netrom, @remote, @null, @null, @rose, @netrom]}, &(0x7f0000000380)=0x48) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r5 = accept$ax25(0xffffffffffffffff, &(0x7f0000000200)={{0x3, @bcast}, [@remote, @rose, @rose, @remote, @rose, @remote, @netrom, @netrom]}, &(0x7f0000000000)=0x5225629ed16c8d06) ioctl$sock_ax25_SIOCADDRT(r5, 0x890b, &(0x7f0000000100)={@default, @bcast, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast]}) [ 2785.568454] Bluetooth: hci3 command 0x03f2 tx timeout 14:07:11 executing program 5: ioctl$SNDCTL_SYNTH_MEMAVL(0xffffffffffffffff, 0xc004510e, &(0x7f0000000000)=0x9) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448ca, 0x0) ioctl$SNDCTL_TMR_SOURCE(0xffffffffffffffff, 0xc0045406) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r1, 0x40285107) ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000080)=0x370) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$unix(0x1, 0x5, 0x0) getpeername$unix(r1, &(0x7f0000000080), &(0x7f0000000000)=0x6e) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448dd, &(0x7f00000002c0)="c488074deaf0c51bac3b8fffece3612850d461da54ce9f120eba33ff78565aa626eab2b5c6b0c2f9acb8cb66d92c7484") r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000280)={r3, 0x3, r2, 0xfffffffc, 0x80000}) (async) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f00000001c0)=0x1) (async) r4 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r4, 0x0, 0x0) (async) getsockname$ax25(r4, &(0x7f0000000300)={{0x3, @default}, [@bcast, @netrom, @netrom, @remote, @null, @null, @rose, @netrom]}, &(0x7f0000000380)=0x48) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r5 = accept$ax25(0xffffffffffffffff, &(0x7f0000000200)={{0x3, @bcast}, [@remote, @rose, @rose, @remote, @rose, @remote, @netrom, @netrom]}, &(0x7f0000000000)=0x5225629ed16c8d06) ioctl$sock_ax25_SIOCADDRT(r5, 0x890b, &(0x7f0000000100)={@default, @bcast, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast]}) 14:07:11 executing program 5: ioctl$SNDCTL_SYNTH_MEMAVL(0xffffffffffffffff, 0xc004510e, &(0x7f0000000000)=0x9) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448ca, 0x0) ioctl$SNDCTL_TMR_SOURCE(0xffffffffffffffff, 0xc0045406) (async) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r1, 0x40285107) ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000080)=0x370) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = socket$unix(0x1, 0x5, 0x0) getpeername$unix(r1, &(0x7f0000000080), &(0x7f0000000000)=0x6e) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 5: ioctl$SNDCTL_SYNTH_MEMAVL(0xffffffffffffffff, 0xc004510e, &(0x7f0000000000)=0x9) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448ca, 0x0) ioctl$SNDCTL_TMR_SOURCE(0xffffffffffffffff, 0xc0045406) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r1, 0x40285107) ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000080)=0x370) ioctl$SNDCTL_SYNTH_MEMAVL(0xffffffffffffffff, 0xc004510e, &(0x7f0000000000)=0x9) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448ca, 0x0) (async) ioctl$SNDCTL_TMR_SOURCE(0xffffffffffffffff, 0xc0045406) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) (async) ioctl$SNDCTL_FM_LOAD_INSTR(r1, 0x40285107) (async) ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000080)=0x370) (async) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$unix(0x1, 0x5, 0x0) getpeername$unix(r1, &(0x7f0000000080), &(0x7f0000000000)=0x6e) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448dd, &(0x7f00000002c0)="c488074deaf0c51bac3b8fffece3612850d461da54ce9f120eba33ff78565aa626eab2b5c6b0c2f9acb8cb66d92c7484") r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000280)={r3, 0x3, r2, 0xfffffffc, 0x80000}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f00000001c0)=0x1) r4 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r4, 0x0, 0x0) getsockname$ax25(r4, &(0x7f0000000300)={{0x3, @default}, [@bcast, @netrom, @netrom, @remote, @null, @null, @rose, @netrom]}, &(0x7f0000000380)=0x48) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r5 = accept$ax25(0xffffffffffffffff, &(0x7f0000000200)={{0x3, @bcast}, [@remote, @rose, @rose, @remote, @rose, @remote, @netrom, @netrom]}, &(0x7f0000000000)=0x5225629ed16c8d06) ioctl$sock_ax25_SIOCADDRT(r5, 0x890b, &(0x7f0000000100)={@default, @bcast, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast]}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r1, 0x400448dd, &(0x7f00000002c0)="c488074deaf0c51bac3b8fffece3612850d461da54ce9f120eba33ff78565aa626eab2b5c6b0c2f9acb8cb66d92c7484") (async) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000280)={r3, 0x3, r2, 0xfffffffc, 0x80000}) (async) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f00000001c0)=0x1) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) getpeername$ax25(r4, 0x0, 0x0) (async) getsockname$ax25(r4, &(0x7f0000000300)={{0x3, @default}, [@bcast, @netrom, @netrom, @remote, @null, @null, @rose, @netrom]}, &(0x7f0000000380)=0x48) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) accept$ax25(0xffffffffffffffff, &(0x7f0000000200)={{0x3, @bcast}, [@remote, @rose, @rose, @remote, @rose, @remote, @netrom, @netrom]}, &(0x7f0000000000)=0x5225629ed16c8d06) (async) ioctl$sock_ax25_SIOCADDRT(r5, 0x890b, &(0x7f0000000100)={@default, @bcast, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast]}) (async) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x8000}, 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) write$apparmor_current(r2, 0x0, 0x0) write$9p(r1, &(0x7f0000000080)="3eb6c44bf2f4671b50cf22984769d835c3b2857e56ae8ad03f7a87e6ee846b532e3f80cc100f9b21276e1d0aa6c925b9758332962b818f8b4744d954d6ae8de5f9dbac9427c57749fc3e14716a8f256759888edeeff40fe6b639e60c647938b14d7f6dce99a37d3e5e938c689bc35f9be2489ac7f804bac5cb387aeb8dd3", 0x7e) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x80000) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000080)={0x0, 0x2, r0, 0x7fffffff}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)=ANY=[@ANYBLOB="011300"], 0x7) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f00000000c0)={0x2, [0x800, 0x800], 0x9}, 0x10) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x8000}, 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) write$apparmor_current(r2, 0x0, 0x0) (async, rerun: 64) write$9p(r1, &(0x7f0000000080)="3eb6c44bf2f4671b50cf22984769d835c3b2857e56ae8ad03f7a87e6ee846b532e3f80cc100f9b21276e1d0aa6c925b9758332962b818f8b4744d954d6ae8de5f9dbac9427c57749fc3e14716a8f256759888edeeff40fe6b639e60c647938b14d7f6dce99a37d3e5e938c689bc35f9be2489ac7f804bac5cb387aeb8dd3", 0x7e) (async, rerun: 64) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x8000}, 0x6) (async, rerun: 32) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) (rerun: 32) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x80000) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000080)={0x0, 0x2, r0, 0x7fffffff}) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)=ANY=[@ANYBLOB="011300"], 0x7) (async) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f00000000c0)={0x2, [0x800, 0x800], 0x9}, 0x10) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) setsockopt$MISDN_TIME_STAMP(r1, 0x0, 0x1, &(0x7f0000000080), 0x4) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$SNDCTL_SEQ_NRMIDIS(r2, 0x8004510b, &(0x7f0000000000)) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) (async) write$apparmor_current(r2, 0x0, 0x0) (async, rerun: 32) write$9p(r1, &(0x7f0000000080)="3eb6c44bf2f4671b50cf22984769d835c3b2857e56ae8ad03f7a87e6ee846b532e3f80cc100f9b21276e1d0aa6c925b9758332962b818f8b4744d954d6ae8de5f9dbac9427c57749fc3e14716a8f256759888edeeff40fe6b639e60c647938b14d7f6dce99a37d3e5e938c689bc35f9be2489ac7f804bac5cb387aeb8dd3", 0x7e) (rerun: 32) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x80000) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000080)={0x0, 0x2, r0, 0x7fffffff}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)=ANY=[@ANYBLOB="011300"], 0x7) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f00000000c0)={0x2, [0x800, 0x800], 0x9}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x80000) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000080)={0x0, 0x2, r0, 0x7fffffff}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r2, &(0x7f0000000400)=ANY=[@ANYBLOB="011300"], 0x7) (async) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f00000000c0)={0x2, [0x800, 0x800], 0x9}, 0x10) (async) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) setsockopt$MISDN_TIME_STAMP(r1, 0x0, 0x1, &(0x7f0000000080), 0x4) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_NRMIDIS(r2, 0x8004510b, &(0x7f0000000000)) (async) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) setsockopt$MISDN_TIME_STAMP(r1, 0x0, 0x1, &(0x7f0000000080), 0x4) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$SNDCTL_SEQ_NRMIDIS(r2, 0x8004510b, &(0x7f0000000000)) (async) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000040)=0xfff7fffe, 0x4) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xc4) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000080)=@rose={'rose', 0x0}, 0x10) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x2, 0x1}, 0x6) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x3}, 0x6) 14:07:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000000)={0x2, 0x9, "4ee5a6", 0x20, 0x3f}) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x3}, 0x6) 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000040)=0xfff7fffe, 0x4) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xc4) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000080)=@rose={'rose', 0x0}, 0x10) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x2, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000040)=0xfff7fffe, 0x4) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) getpeername$ax25(r1, 0x0, 0x0) (async) syz_init_net_socket$ax25(0x3, 0x2, 0xc4) (async) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000080)=@rose={'rose', 0x0}, 0x10) (async) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x2, 0x1}, 0x6) (async) [ 2785.808688] Bluetooth: hci2 command 0x0401 tx timeout 14:07:11 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000040)=0xfff7fffe, 0x4) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) (async) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xc4) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000080)=@rose={'rose', 0x0}, 0x10) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x2, 0x1}, 0x6) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x3}, 0x6) 14:07:11 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x4c, 0x140f, 0x2, 0x70bd29, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'ib_srpt\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'rdma_cm\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xb, 0x45, 'smc_ib\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x810}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, 0x1406, 0x300, 0x70bd2d, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000090}, 0x20004040) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/custom0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x4, 0x1}, 0x6) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)={0x1, @delete_reserved_lt_addr={{0xc75, 0x1}, {0x7f}}}, 0x5) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x204c01) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000080)={0x0, 0x1ad, "0536fd", 0x8, 0x1}) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f00000000c0)=0xa673, 0x4) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)={0x1, @delete_reserved_lt_addr={{0xc75, 0x1}, {0x7f}}}, 0x5) (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x204c01) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000080)={0x0, 0x1ad, "0536fd", 0x8, 0x1}) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f00000000c0)=0xa673, 0x4) 14:07:11 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x4c, 0x140f, 0x2, 0x70bd29, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'ib_srpt\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'rdma_cm\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xb, 0x45, 'smc_ib\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x810}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, 0x1406, 0x300, 0x70bd2d, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000090}, 0x20004040) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/custom0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x4, 0x1}, 0x6) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)={0x1, @delete_reserved_lt_addr={{0xc75, 0x1}, {0x7f}}}, 0x5) (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x204c01) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000080)={0x0, 0x1ad, "0536fd", 0x8, 0x1}) (async, rerun: 64) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async, rerun: 64) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f00000000c0)=0xa673, 0x4) 14:07:11 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x4c, 0x140f, 0x2, 0x70bd29, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'ib_srpt\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'rdma_cm\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xb, 0x45, 'smc_ib\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x810}, 0x0) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, 0x1406, 0x300, 0x70bd2d, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000090}, 0x20004040) (async) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/custom0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x4, 0x1}, 0x6) 14:07:11 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) ioctl$sock_ax25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000080)={@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x0, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null]}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x1, 0x4}, 0x6) ioctl$SIOCAX25NOUID(0xffffffffffffffff, 0x89e3, &(0x7f0000000000)=0x1) 14:07:12 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000000)={0x2, 0x9, "4ee5a6", 0x20, 0x3f}) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000000)={0x2, 0x9, "4ee5a6", 0x20, 0x3f}) (async) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) (async) 14:07:12 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x1402, 0x400, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz0\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x1}, 0x6) ioctl$SNDCTL_FM_LOAD_INSTR(0xffffffffffffffff, 0x40285107) 14:07:12 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) ioctl$sock_ax25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000080)={@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x0, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null]}) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x1, 0x4}, 0x6) (async) ioctl$SIOCAX25NOUID(0xffffffffffffffff, 0x89e3, &(0x7f0000000000)=0x1) 14:07:12 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x1402, 0x400, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz0\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x1}, 0x6) ioctl$SNDCTL_FM_LOAD_INSTR(0xffffffffffffffff, 0x40285107) 14:07:12 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) ioctl$sock_ax25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000080)={@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x0, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null]}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x1, 0x4}, 0x6) (async) ioctl$SIOCAX25NOUID(0xffffffffffffffff, 0x89e3, &(0x7f0000000000)=0x1) 14:07:12 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4, 0x4}, 0x6) 14:07:12 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x1402, 0x400, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz0\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) (async, rerun: 32) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x1}, 0x6) (async, rerun: 32) ioctl$SNDCTL_FM_LOAD_INSTR(0xffffffffffffffff, 0x40285107) 14:07:12 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000000)={0x0, 0x800, "de5c6c", 0x2c, 0x3}) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040), 0x6) 14:07:12 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4, 0x4}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4, 0x4}, 0x6) (async) 14:07:12 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4, 0x4}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4, 0x4}, 0x6) (async) 14:07:12 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000000)={0x0, 0x800, "de5c6c", 0x2c, 0x3}) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040), 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000000)={0x0, 0x800, "de5c6c", 0x2c, 0x3}) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) 14:07:12 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000040)=0xfff7fffe, 0x4) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xc4) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000080)=@rose={'rose', 0x0}, 0x10) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x2, 0x1}, 0x6) [ 2787.088114] Bluetooth: hci1 command 0x0401 tx timeout 14:07:13 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000000)={0x2, 0x9, "4ee5a6", 0x20, 0x3f}) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:13 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000000)={0x0, 0x800, "de5c6c", 0x2c, 0x3}) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040), 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000000)={0x0, 0x800, "de5c6c", 0x2c, 0x3}) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) 14:07:13 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x8000}, 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:13 executing program 4: ioctl$SNDCTL_SYNTH_MEMAVL(0xffffffffffffffff, 0xc004510e, &(0x7f0000000000)=0x9) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448ca, 0x0) ioctl$SNDCTL_TMR_SOURCE(0xffffffffffffffff, 0xc0045406) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r1, 0x40285107) ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000080)=0x370) 14:07:13 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)={0x1, @disconn_phy_link={{0x437, 0x2}, {0xc8, 0x7f}}}, 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) 14:07:13 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)={0x1, @disconn_phy_link={{0x437, 0x2}, {0xc8, 0x7f}}}, 0x6) (async) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) 14:07:13 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f00000000c0)={0x3, @default, 0xffffffffffffffff}) write$apparmor_current(r1, 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r1, 0x80047c05, &(0x7f0000000000)) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r2, 0x40285107) 14:07:13 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)={0x1, @disconn_phy_link={{0x437, 0x2}, {0xc8, 0x7f}}}, 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000080)={0x1, @disconn_phy_link={{0x437, 0x2}, {0xc8, 0x7f}}}, 0x6) (async) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000), 0x6) (async) 14:07:13 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f00000000c0)={0x3, @default, 0xffffffffffffffff}) write$apparmor_current(r1, 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r1, 0x80047c05, &(0x7f0000000000)) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r2, 0x40285107) 14:07:13 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f00000000c0)={0x3, @default, 0xffffffffffffffff}) write$apparmor_current(r1, 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r1, 0x80047c05, &(0x7f0000000000)) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r2, 0x40285107) 14:07:13 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0x6, [0x5, 0x80000001], 0x1}, 0x10) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:13 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f00000000c0)={0x3, @default, 0xffffffffffffffff}) write$apparmor_current(r1, 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r1, 0x80047c05, &(0x7f0000000000)) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) [ 2787.888134] Bluetooth: hci2 command 0x0401 tx timeout 14:07:14 executing program 5: sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x58, 0x140c, 0x2, 0x70bd26, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0x24040004) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x73, 0x1, {{0x40, 0x4, 0x7}, 0x5}}, 0x18) 14:07:14 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0x6, [0x5, 0x80000001], 0x1}, 0x10) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:14 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f00000000c0)={0x3, @default, 0xffffffffffffffff}) write$apparmor_current(r1, 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r1, 0x80047c05, &(0x7f0000000000)) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:14 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f00000000c0)={0x3, @default, 0xffffffffffffffff}) write$apparmor_current(r1, 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r1, 0x80047c05, &(0x7f0000000000)) 14:07:14 executing program 5: sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x58, 0x140c, 0x2, 0x70bd26, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0x24040004) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x73, 0x1, {{0x40, 0x4, 0x7}, 0x5}}, 0x18) 14:07:14 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0x6, [0x5, 0x80000001], 0x1}, 0x10) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:14 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f00000000c0)={0x3, @default, 0xffffffffffffffff}) write$apparmor_current(r1, 0x0, 0x0) 14:07:14 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000000)=0x1a4) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:14 executing program 5: sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x58, 0x140c, 0x2, 0x70bd26, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0x24040004) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) write$P9_RCREATE(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x73, 0x1, {{0x40, 0x4, 0x7}, 0x5}}, 0x18) 14:07:14 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f00000000c0)={0x3, @default, 0xffffffffffffffff}) 14:07:14 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="894f0403000000b59c15ff0385ff05cd1234c01f74a8368fb74f34594d5c58413c5fec8e697bf25db60441dd98e9f0466d833a7f75ba52211668080000c890046107085f74a5b2272b53ce61000000000085462eb5e43f43ad66340c9eb7de2e93d87f6073458d3618a162d538fad0d3a242ed994929f59f31cd9519b876d6835932405bb3d4f6d42e4f3f99295fd957005e808f8fd398009867b34c950c408775f77077ce255193f3c2c2f683f82460d63321350deb924ca95fa8935f9846f236a3000000003f13ea12ffd7223e1aa76108f3d84b7356f035cf8546a89954a32d6d97ee3fc6c2952f1e06b08c83c4f9e57383baea6ea6e1712483bd2177e0e7c11dc8b82205f517657215cdec6107ca60ed945dbee9d0684f75b85ac0a6c037b7caea810389e95cc68052a9a05771678c88fa14bd40468d894c"], 0x7) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x400448e3, 0x0) 14:07:14 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000000)=0x1a4) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:14 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="894f0403000000b59c15ff0385ff05cd1234c01f74a8368fb74f34594d5c58413c5fec8e697bf25db60441dd98e9f0466d833a7f75ba52211668080000c890046107085f74a5b2272b53ce61000000000085462eb5e43f43ad66340c9eb7de2e93d87f6073458d3618a162d538fad0d3a242ed994929f59f31cd9519b876d6835932405bb3d4f6d42e4f3f99295fd957005e808f8fd398009867b34c950c408775f77077ce255193f3c2c2f683f82460d63321350deb924ca95fa8935f9846f236a3000000003f13ea12ffd7223e1aa76108f3d84b7356f035cf8546a89954a32d6d97ee3fc6c2952f1e06b08c83c4f9e57383baea6ea6e1712483bd2177e0e7c11dc8b82205f517657215cdec6107ca60ed945dbee9d0684f75b85ac0a6c037b7caea810389e95cc68052a9a05771678c88fa14bd40468d894c"], 0x7) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x400448e3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040), 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="894f0403000000b59c15ff0385ff05cd1234c01f74a8368fb74f34594d5c58413c5fec8e697bf25db60441dd98e9f0466d833a7f75ba52211668080000c890046107085f74a5b2272b53ce61000000000085462eb5e43f43ad66340c9eb7de2e93d87f6073458d3618a162d538fad0d3a242ed994929f59f31cd9519b876d6835932405bb3d4f6d42e4f3f99295fd957005e808f8fd398009867b34c950c408775f77077ce255193f3c2c2f683f82460d63321350deb924ca95fa8935f9846f236a3000000003f13ea12ffd7223e1aa76108f3d84b7356f035cf8546a89954a32d6d97ee3fc6c2952f1e06b08c83c4f9e57383baea6ea6e1712483bd2177e0e7c11dc8b82205f517657215cdec6107ca60ed945dbee9d0684f75b85ac0a6c037b7caea810389e95cc68052a9a05771678c88fa14bd40468d894c"], 0x7) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r2, 0x400448e3, 0x0) (async) 14:07:14 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) 14:07:14 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000000)=0x1a4) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:14 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="894f0403000000b59c15ff0385ff05cd1234c01f74a8368fb74f34594d5c58413c5fec8e697bf25db60441dd98e9f0466d833a7f75ba52211668080000c890046107085f74a5b2272b53ce61000000000085462eb5e43f43ad66340c9eb7de2e93d87f6073458d3618a162d538fad0d3a242ed994929f59f31cd9519b876d6835932405bb3d4f6d42e4f3f99295fd957005e808f8fd398009867b34c950c408775f77077ce255193f3c2c2f683f82460d63321350deb924ca95fa8935f9846f236a3000000003f13ea12ffd7223e1aa76108f3d84b7356f035cf8546a89954a32d6d97ee3fc6c2952f1e06b08c83c4f9e57383baea6ea6e1712483bd2177e0e7c11dc8b82205f517657215cdec6107ca60ed945dbee9d0684f75b85ac0a6c037b7caea810389e95cc68052a9a05771678c88fa14bd40468d894c"], 0x7) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x400448e3, 0x0) 14:07:14 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) 14:07:14 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000080)={0x5, &(0x7f0000000000)=[{0x100, 0x9, 0x40, 0x4}, {0x4, 0x7, 0xd8, 0x1}, {0x2, 0x1, 0x40, 0x8000}, {0x4, 0xc3, 0x7, 0x5}, {0x7, 0x6, 0x66, 0x2d8}]}) r1 = socket$unix(0x1, 0x5, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x3, &(0x7f0000000100)=[{0x7f, 0x81, 0x8}, {0x9, 0x2, 0x9, 0x778b}, {0x3f, 0xa5, 0xce, 0x6}]}) write$apparmor_current(r2, 0x0, 0x0) write$sysctl(r2, &(0x7f00000000c0)='3\x00', 0x2) recvmsg$unix(r1, 0x0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:14 executing program 3: clock_getres(0x5, &(0x7f0000000140)) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x1}, 0x6) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x10000) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000100)=0x20000007, 0x4) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000080)=0x4) 14:07:14 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:14 executing program 3: clock_getres(0x5, &(0x7f0000000140)) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x1}, 0x6) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x10000) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000100)=0x20000007, 0x4) (async) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000080)=0x4) 14:07:14 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r2, 0x80047c05, &(0x7f0000000040)) write$bt_hci(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="01f20303000000339c4d437956c7689c248e4e970ce7450ca813340f60a919d62c0aa51935a1465cc03d94a41216132512aa80adf559d93b9bd8ba95244c06e2a713e60952a9717b1d9215b0350a0d5b211127fdcc08882b77db522dc7937d732be9992b5d95386585f01e5c829ad99cfab6275d16cb98d6f5247279f5bfb931d9bfa3b57ce94f4bd2056df5f18ec74a77e048fe3c2e2a01000000aaf57c7f59f73ba8698fde574a000040"], 0x7) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f00000001c0)={0x1, 0x3, "ca3fe9", 0x3, 0x7}) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0x3}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000180)={0x100, [0x5, 0x1], 0x400}, 0x10) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000000)=0x1) 14:07:14 executing program 4: ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e0, &(0x7f0000000000)) 14:07:14 executing program 3: clock_getres(0x5, &(0x7f0000000140)) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x1}, 0x6) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x10000) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000100)=0x20000007, 0x4) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000080)=0x4) clock_getres(0x5, &(0x7f0000000140)) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x1}, 0x6) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x10000) (async) openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000100)=0x20000007, 0x4) (async) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000080)=0x4) (async) 14:07:14 executing program 4: ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e0, &(0x7f0000000000)) 14:07:14 executing program 4: ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e0, &(0x7f0000000000)) 14:07:14 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000140)={0xfffe, 0x8000, 0x2, 0x5, 0xc, "83246a83b4c6efe5"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) syz_open_pts(r0, 0x200) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) setsockopt$MISDN_TIME_STAMP(r2, 0x0, 0x1, &(0x7f0000000200)=0x1, 0x4) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCALLUSERDATA(r3, 0x89e5, &(0x7f0000000080)={0x49, "377eceef22663e31997cc8d6d5cb0427e8dfda2d9875155713ca01bafc1eff1e0fa355b588575ba1db0e93ee9f2889276c224036d30c74797d800c4f65f44b1e3932676b4fde1bd0be142c65b99eca94b4993ef430d834ff2c935433c71dfd99c1ebcfc5acbfd25fdc6bcc4711d173474ba8f0a86a9b6baa3c389f53f77094b7"}) bind$unix(r0, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) 14:07:14 executing program 4: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e0, &(0x7f0000000000)) 14:07:14 executing program 4: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e0, &(0x7f0000000000)) 14:07:14 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000140)={0xfffe, 0x8000, 0x2, 0x5, 0xc, "83246a83b4c6efe5"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) syz_open_pts(r0, 0x200) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) setsockopt$MISDN_TIME_STAMP(r2, 0x0, 0x1, &(0x7f0000000200)=0x1, 0x4) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCALLUSERDATA(r3, 0x89e5, &(0x7f0000000080)={0x49, "377eceef22663e31997cc8d6d5cb0427e8dfda2d9875155713ca01bafc1eff1e0fa355b588575ba1db0e93ee9f2889276c224036d30c74797d800c4f65f44b1e3932676b4fde1bd0be142c65b99eca94b4993ef430d834ff2c935433c71dfd99c1ebcfc5acbfd25fdc6bcc4711d173474ba8f0a86a9b6baa3c389f53f77094b7"}) bind$unix(r0, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r0, 0x0, 0x0) (async) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000140)={0xfffe, 0x8000, 0x2, 0x5, 0xc, "83246a83b4c6efe5"}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) (async) syz_open_pts(r0, 0x200) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r2, 0x0, 0x0) (async) setsockopt$MISDN_TIME_STAMP(r2, 0x0, 0x1, &(0x7f0000000200)=0x1, 0x4) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f0000000000)) (async) ioctl$SIOCX25SCALLUSERDATA(r3, 0x89e5, &(0x7f0000000080)={0x49, "377eceef22663e31997cc8d6d5cb0427e8dfda2d9875155713ca01bafc1eff1e0fa355b588575ba1db0e93ee9f2889276c224036d30c74797d800c4f65f44b1e3932676b4fde1bd0be142c65b99eca94b4993ef430d834ff2c935433c71dfd99c1ebcfc5acbfd25fdc6bcc4711d173474ba8f0a86a9b6baa3c389f53f77094b7"}) (async) bind$unix(r0, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) (async) 14:07:14 executing program 4: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e0, &(0x7f0000000000)) 14:07:14 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x0, &(0x7f0000000000)) 14:07:14 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x0, &(0x7f0000000000)) [ 2789.167936] Bluetooth: hci1 command 0x0401 tx timeout 14:07:15 executing program 5: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000140)={0xfffe, 0x8000, 0x2, 0x5, 0xc, "83246a83b4c6efe5"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) syz_open_pts(r0, 0x200) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) setsockopt$MISDN_TIME_STAMP(r2, 0x0, 0x1, &(0x7f0000000200)=0x1, 0x4) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCALLUSERDATA(r3, 0x89e5, &(0x7f0000000080)={0x49, "377eceef22663e31997cc8d6d5cb0427e8dfda2d9875155713ca01bafc1eff1e0fa355b588575ba1db0e93ee9f2889276c224036d30c74797d800c4f65f44b1e3932676b4fde1bd0be142c65b99eca94b4993ef430d834ff2c935433c71dfd99c1ebcfc5acbfd25fdc6bcc4711d173474ba8f0a86a9b6baa3c389f53f77094b7"}) bind$unix(r0, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) 14:07:15 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000140)={0xfffe, 0x8000, 0x2, 0x5, 0xc, "83246a83b4c6efe5"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) syz_open_pts(r0, 0x200) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) setsockopt$MISDN_TIME_STAMP(r2, 0x0, 0x1, &(0x7f0000000200)=0x1, 0x4) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCALLUSERDATA(r3, 0x89e5, &(0x7f0000000080)={0x49, "377eceef22663e31997cc8d6d5cb0427e8dfda2d9875155713ca01bafc1eff1e0fa355b588575ba1db0e93ee9f2889276c224036d30c74797d800c4f65f44b1e3932676b4fde1bd0be142c65b99eca94b4993ef430d834ff2c935433c71dfd99c1ebcfc5acbfd25fdc6bcc4711d173474ba8f0a86a9b6baa3c389f53f77094b7"}) bind$unix(r0, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r0, 0x0, 0x0) (async) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000140)={0xfffe, 0x8000, 0x2, 0x5, 0xc, "83246a83b4c6efe5"}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) (async) syz_open_pts(r0, 0x200) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r2, 0x0, 0x0) (async) setsockopt$MISDN_TIME_STAMP(r2, 0x0, 0x1, &(0x7f0000000200)=0x1, 0x4) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f0000000000)) (async) ioctl$SIOCX25SCALLUSERDATA(r3, 0x89e5, &(0x7f0000000080)={0x49, "377eceef22663e31997cc8d6d5cb0427e8dfda2d9875155713ca01bafc1eff1e0fa355b588575ba1db0e93ee9f2889276c224036d30c74797d800c4f65f44b1e3932676b4fde1bd0be142c65b99eca94b4993ef430d834ff2c935433c71dfd99c1ebcfc5acbfd25fdc6bcc4711d173474ba8f0a86a9b6baa3c389f53f77094b7"}) (async) bind$unix(r0, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) (async) 14:07:15 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x0, &(0x7f0000000000)) 14:07:15 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, 0x0) 14:07:15 executing program 3: syz_init_net_socket$x25(0x9, 0x5, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(0xffffffffffffffff, 0x80045104, &(0x7f00000000c0)) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xfffe, 0x4}, 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100), 0x23) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x0, &(0x7f0000000000)) 14:07:15 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, 0x0) 14:07:15 executing program 3: syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async, rerun: 64) ioctl$SNDCTL_SEQ_GETOUTCOUNT(0xffffffffffffffff, 0x80045104, &(0x7f00000000c0)) (async, rerun: 64) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xfffe, 0x4}, 0x6) (async, rerun: 32) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100), 0x23) (rerun: 32) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @le_read_iso_tx_sync={{0x2061, 0x2}, {0xc8}}}, 0x6) ioctl$HCIINQUIRY(r2, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, 0x0) 14:07:15 executing program 3: syz_init_net_socket$x25(0x9, 0x5, 0x0) (async, rerun: 32) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(0xffffffffffffffff, 0x80045104, &(0x7f00000000c0)) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xfffe, 0x4}, 0x6) (async) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100), 0x23) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000080)=@abs={0x0, 0x0, 0x4e24}, 0x6e) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0xb0a40, 0x0) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000140)={0x5, [0xffffffff, 0xce5e], 0x2}, 0x10) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x6, &(0x7f0000000000)=[{0x7f, 0x7, 0x3c, 0xe55}, {0x2, 0x4, 0x1, 0x4}, {0x80, 0xf9, 0x5, 0x200}, {0x81, 0x0, 0x1f, 0x9}, {0x9, 0x0, 0x80, 0x4}, {0xffc0, 0x6, 0x81, 0x7b}]}) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 3: r0 = geteuid() ioctl$SIOCAX25ADDUID(0xffffffffffffffff, 0x89e1, &(0x7f0000000100)={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, r0}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)=ANY=[@ANYBLOB="0113e722b0e442"], 0x7) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x4c2000, 0x0) write$P9_RSTATFS(r3, &(0x7f0000000180)={0x43, 0x9, 0x2, {0x3, 0xb7c, 0x2, 0x2, 0xa6, 0xff, 0x9, 0x2, 0x7f}}, 0x43) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000000)={0x1001, 0xa96, "cac585", 0x6, 0x7f}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r4, 0x0, 0x0) read$sequencer(r4, &(0x7f0000000080)=""/97, 0x61) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$sock_bt_hci(r1, 0x2b, &(0x7f0000002100)="ad0158c4c01155032d9781edbbbdddb8e1136ad44461c3f1fe20fee9b04d08ef9a17ddbd0af6860bb119df5ac3b6560533a93d2d7f82d1cfa7ac59531ebc3536879f16f2c1e6db359993e7e791ee7509acb15b881cad9770240c45f9c7eae2cafedef257effea1cb8d5c83c367e95e0b6fd76132eaf14a84c50cf294fa897a2c2c955daad5eb56f59d50f82beaf83c1f4086206ec0fd52fc49695f4326d175ff9eb320cb95f3967e50f9199bc416d5e28ad29068efa2c8f0be84d8659fed83f2cba38f0c519f7227edfbe8df748612f533288c8f91dccf75b237a818f30f8060bb6ec9eaa29858ee04332b1b363d15cdfe0a8ccf9b64b8c801f4b5e08a39b2ae2b04dc926f9634f3bbc847a399b984c0fe77b59b9868f51291cfa86c3f9dd0288b21857013970f8a47267ea4a37c2de14cbf1ccc9bdee8ce1ff2a518457de641ff7edcc0b5bb18d1ec9a52402647831fb0a9f449dc12e04e37d1abaaae2005ccea3456b6348c195a1e6225b9390339afe1e3d1a837e73e549735935d50a4f682ba479941fa298e8aa810ed19cf38c39d27d1714910a620b486d4b9d0eab9fe88693ad47c21241a792abc65ed78f9d13ca0185b56b63bcdcc02108dab21736f363c16309dfb71d2a6668406e80c3d2559ee4c6ba6e0bf89a3d2df625180f54aecb4380ac922d85d01c95476a5ecb70557e5f2c476d7dd197ca0b0eda96a45968ce9334f66ff8e34fd6988fd979c9c92a2ec842d88a906c425a2466d8dd20f21f3b444987f434ec958e0b1a4f786c9d8e19f94902610a78a6180b5030fbf1174dad8d38ae5d71bd7bf5064262ad0002b7e8f6983ef9f9dcdac17bcd0c6b84d733121096db55a32160ee5b8be66688bd9e7df54089b17f77e187a1c4cd60742f2d3c7bfa0db9ebdf3f06d768f5714a6a9292bf77418c3cbf8353702640bd5046f4a3c3dc3322fecdbba486dbc4abf60c2aa3ac5c2f129b8953f866fb52dd75ac3d01b92704b5457075a2985d3f594807fdf0e9e481a8f46f697b358190072876a51ee4cf7409137b526f4cb0b4d49bc158b73d4a7cbc774d4a66a28989d7762b7a30a06bd596a6e5c6a75b94bb1bf3f28215f799b3f09c77ff28241ed9c84208e5e467c907e271c2db1208b25e113e504541c40d32a5c13c37b9089c998060629934f697e32bf68968f95acd03a4cd4de73e564a2254a8fe3d9b30544b06482ae57826bfbf285d39189755e606a7f3c0d72a9d7a4061e5045a7dd8e24fe0338b3650865c51c322781c53ff9c0ef5234233f93e38b3cba868c12e2138fd5d4fbe7a9a708b829d4dc9de4d089438a53592320f33187a045103a128bf3186a6bc42dadde917cf67d4213b3a2ab29ee30110aa5b3ec3aa83293ac9e90bce324998b023926a7df42441ed09fa7a071e83935249122609508e6b1ec3bfbad9bf60648457fc54850c8f0e2eeff62d0161096489f57bc665c7495373b5e7a03646c252f7665378f1796b1db6ee577882afadaaa797daab122713eb1bf009182dca5d75ed2b88d270af602b9148dcf062eb6500b5e0f8614e05610d8e4363f82553b7fe360c7a635cba1b47e8d4d61b19de14df6259bdbaff3a5f84af834d0e2ec337aa02fc1b64256e854e7a826588285abc7dc1953f9988bd5c3bd88027a42087f01c70ffb131ec963579145dc77083e60d5007976122bf857c7a289b4a1a14ffcd7c78a452a61e7e1d35b1e20cb4a5a80f645ab0d02e72c93eefc5a8dcfee81303023e5d16554c8d966258319152014f7ca43b42e319bc0a30d3c5407a20bac47eda98061cfe693c5f4c26c35a8b8f75b57c9f2804488397a818522746f17fdee6a5a18baea2cb1b0cb9c9264e34ef8f9eda40e84037faaa7dda872213e91899c8244fb67caa2f2b3a9f3d8b3cb9dcf2662ece9458d34f2d16ad75f7fb568a4a61807af6915446d4ac46c4259ef8b34157ba804c0414274d4693371108f4f4d2201db546b176c2e1bc125fc18bff5c300187ff54b028a6cb2fc186238af221a8cb2f16f69bc77cb4b3d594c1eaf4b7c5554e03bf55fb54313f23b6af9e2bcb9a2e38457fbe20d1e7e2a592bfe13020bcf38e439341cce6805311802fcaeef485db8a9aab372c7035fba70c19a878fded465536378b5f1908260f238662ca5f6e8f3b2ec5c37e9c4947faa212491e59500a011c974925687d8d62ed5f828c022631f8476d111c07fb7bd9438c42099062eff74ffcca725d5e443783b2321c6729285efde342be3c1eec5ad481ac2b07ac3d2a6d61ec760aad965962ed3616794d66ea76baf8dddfce3b359d7c250cb783aeeb85f6bd071b8038200cabd5d54f85944f10d3b4f58d926afd719e998ba4928cc7b59ff1d39dd6ccd81258e9b9c9b9b5eeb3782720d806f6b10a5323fded96b981000f67d9dcddc2321908ca00486fc38b5a8e22a2b57f8928089ccab7f9e0699091f33abd6b316c8238dfbe0ff35867068a6ef7672b7bdecda3e5b7e349b0f3ad2fda34cfe9cc71c43733cdc900fdf9b754e76977e54e714a6ceb06f6a05cbe86c28fe882f418c37085fc3c5e1e16dc72b56f3d67a385a34f54fa042834018a8cb9178b93d546db3182208b2a1ca3752e546642070fe3b09c791514435be3dd63a1e0fcfeb87cf2b19b4ea256ff7676c5208a5045b269e9bd1cbd78b58c2eb9f6128b037c7577d68d5cd46da4db9e39407734998822283a01564ae0c554ee5fe527511bbfa00b6ce22f8577a2257cb6cc7e324a10fed8760a535f12b6bc2fe884830c4b665dfeb46cb905b9ae384f272477a153aebe79248667b8017d51a01a43d75e9249fffc02b0390181bf8a19fe2ee74379fd9f1743cc53c4df1a4ff4e0565b4a979e325b3d64f13ee7e99c14d00a93cb91b1749da216961228758e564bfd66bae2cdb9147237fa0b06c280de8503f680b0ca6ad6be6630772c5d1b01a51005f72c23e7f6a7336f1fe908ae1f9c2537f0440bc9c0fde75b2a9979176308ab65efb55b1f35f2e422dbef63a1db1efc39655f99480077a4d3e45cfbb6f977836c79bfc8c33fccd71c9f498aebce27016333971b67e1511a19aede0e07cb95894d41b6e6d6665fcdb3885747ee8d4d5dc87a1f57de9c663163cbb07f5e6297242e6ab844ce9521d8f799658c04131a5f3f8bea2b34992441d8ee027131e73aad1b24a87f2ee6a921324d8d50f2f5ef3b178c542fec6ae9744ed29d265206d1b3cee92707d46bff66253d7ea8d3f5e393de727b6fa5291c47c8153cd5804595d019fb957e9f36dfcb1f502270e551e1967b895d983d323c7ac4b4b300a2fa7f16f7313e1bfbc768f735ee772fa572083f8f0d5e579fc6b44b2926f332b9a1bccbff7cb02dc84b85251b18e3aa77011a6d92df579a9990705fdf29c29fc06061d18c21f853a21b710d9110326b12837c2ce2a9d1534e667f21d110b77d9c765ad018fec76c624312d34a94c8faa18ce9e9ef8f58b6da9702c8d2d7cba32bbbe0ef3ec578c7c4c15df1801612afe5c527c7be8eb06abea8523e86605ef1aabe192cda42f86fa31b1681164682ee0f6b37b1d1b4bcca9768f7ff7c1302e23f42db168c334bf42b495d1909c684c2a318d35fe608fa25d04a6652b537f42ac8bc7a76a019e8d95e5995c54d71c37524a77a1d717daa53e7c3cd377310cd74110f95b8e51dd35d944ff2758c56743d2aa119566a612ecd334f93ccbc1508b71495c8538a16ab90a2cd2ba58a01108f4789bc4087912e34cb7a522b47338e7200c30e8118859d00bf1bc87a5ae5ec537e556468523cec533a6071a174cd6d5d7cc7a372241ecdc949e5a9ee31ba19658d38ab82c06cfa912d502a7dfdd41de05daa285fc994ea67eccd7b25a4c24b7d8e4ab81a449e5eb0d84c7621e5ed01d9a96d5894316e47739a8b8f6ecdcffb4abfd1bf7c60716e6040f435302ff4449aa9a4e474f388ab9320f726bb87c35ae17f7ca0a390ab8b1a90818ac0d4ba35d3253a3cf1ca9e5dc8baf2235dec2ab3f84de31bb9f28a452d62829b7eb35fe2f55c5f54954229fcc94a90e4ff750061c07a003abd45493dbfb88db44148198cc6440c54d83f9179033922b5b8fa2abdecbd082996d6057640b9bf04f3cab6e690d4ed69c64c1d0fcd7b9b35717b69a473c3e2598a1a662dda32fb868d2f0de69f4ded7c5b999058e82a9357b79febed12df74f7228f82666d800e30c31534ecd30739f49aff809ac2dcb2753586d17e94f17807cb2f113f83f86d2d5a5f67621bdde01c343c4ce1f0dc494a17321858245d159a3b3e12c185da19ad507f854d96411aa1d87b27ddc0b363c77fc4f8fee617938ed4044c3f762a33c00983537686ad505bef6909635febee831ad6f76a2b984d01fb707af90c610d30b9ce4b1c6ea6570ff60cfae9f8388903b1b5363df26094112649fee484223290611277f2a1134526c6e0814d69090596ce07dcec2fdf176c4ae139b7595d9f756af0ee5586a9377ec9b0ceded49a5f8452659e2c0b484efaeb43e670f78138d2b88248edc573599b4ea7fdb3b21a256112d3934b01406733e6ccc86d8c37be5003dca8a301a8a7d881392b13093abbb3bad435c4246cc38a7c3c2dc5563d3eddbc7915438f57f0092050cc11ee9fb0d778304bbad06132487e7128901c514dfaced4af75c4ebf097ce5a0bdc1b7b83f7ef0a98facac06c9d723565b90b10edd1b543e2d94c904ff35878eeb42c43a56964dbcec104d1557aa07dc7ca3b9c52106907d8c10398f0e13359b7ee9397f07c0e89c985dc3065d360676b6b3aec6db933b609d0e797551904bee582158b58ee18247d69622db3f8b7626b9bddfa93c66b783da0015a1c1926d94ef2725b70fd6195b4e69369b4f1615405ec415735ce37a25893886a9cd44d0530bfbb88763857b8f40957c5be06e087d5bd7c4fde76b93c60698f1d953f737845cb96beed775a3e9a855009d24ebe86bf6bccb83faf8e71bad69911c689c6993beb30f172a059262d890761b18a23868e9654da264e068616db08bded9de21eca10babfa8f58aaab1c24549e3231740b0695c19ac471d13f77c01f4b4f78d02c03895cd86235896c277cac4a81b1269a872ac9960ffb8cc3dda9ee4ed89b6ed6fb89684e6695281500d1e19232c1f462b4dc8ad3540eb93c75146e6e24e5e98452c1eaeb3dd8e3ca4fff88b26291d50fe6bbc494b52716bab0406c2899361b0d5bb77cc7dbe9d52d269485e5c078991d25b638f9c3abbacb2239cfa79bafe5c4dfe24ca6af7836de05af42c7bc31e4be9b4d1ee28d75acfbb951cacec74e761d54eb671d69c7e86188038a679d020ad3faf29263458684884112e97789c0f8d6584062c4c92151cadb61ee80ca1cdbd0a337c79c42b329213e30c610d0022114a40b08a4b3921a9c1281b6ff1c45aaa7c5648791fbcc2335db36aed22646c3253c99417dd672b42e82bd8c57f3123aac82665d4ab429c7dda51dfcaddc86bde8b97026d60e92ff4871e4bd13d6c0adf8d8c19e47fa53df1f724e91ea0e1861b1236b94ca5145b848e8211a3846483b451503cfc8079217115f190387e7e920c051abf61b2a02e403cafd56c4d3a11297b0157d9dce6b67613e5f2393f9f61417065e353fb9ab475328e63f2ddea2259b778ea92839ead9d4ed7f25935707203ce0f302adc310bc8392dc2d0a5a3e7530da3395a383214bc3619ea54bf90b96fafa20aaa2395ee2d2f278ae388e9e00579a6db4bea74346db02620bbbc59b6fe6cb5bbe2b21be436a9b619f007ed8807ceb30535e079eb6cb8bdbd3d3be0fb1bae2081d3b75be8d619713d9f4f45ca6f95f917d874f478b9f6e1b38154f15efa74e07138ab776f46df8fdc296f1f7ac4e0484bb2da0a5fefb44c7ecc41c83236847e406583b23852f08086d6ab016753ece71dc31fd90ff3e8d0b6485390e845655ee58c9f391318a4e72e7bc") 14:07:15 executing program 3: r0 = geteuid() ioctl$SIOCAX25ADDUID(0xffffffffffffffff, 0x89e1, &(0x7f0000000100)={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, r0}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)=ANY=[@ANYBLOB="0113e722b0e442"], 0x7) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x4c2000, 0x0) write$P9_RSTATFS(r3, &(0x7f0000000180)={0x43, 0x9, 0x2, {0x3, 0xb7c, 0x2, 0x2, 0xa6, 0xff, 0x9, 0x2, 0x7f}}, 0x43) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000000)={0x1001, 0xa96, "cac585", 0x6, 0x7f}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r4, 0x0, 0x0) read$sequencer(r4, &(0x7f0000000080)=""/97, 0x61) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) geteuid() (async) ioctl$SIOCAX25ADDUID(0xffffffffffffffff, 0x89e1, &(0x7f0000000100)={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, r0}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r2, &(0x7f0000000400)=ANY=[@ANYBLOB="0113e722b0e442"], 0x7) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x4c2000, 0x0) (async) write$P9_RSTATFS(r3, &(0x7f0000000180)={0x43, 0x9, 0x2, {0x3, 0xb7c, 0x2, 0x2, 0xa6, 0xff, 0x9, 0x2, 0x7f}}, 0x43) (async) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000000)={0x1001, 0xa96, "cac585", 0x6, 0x7f}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r4, 0x0, 0x0) (async) read$sequencer(r4, &(0x7f0000000080)=""/97, 0x61) (async) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="773e294d01930000000000"], 0x7) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000080)={0x3, [0x6, 0x1], 0x1}, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r4, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) write$bt_hci(r4, &(0x7f00000000c0)={0x1, @accept_sync_conn_req={{0x429, 0x15}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x13}, 0x3, 0x0, 0x80, 0xaf, 0x1f, 0xe9d8}}}, 0x19) ioctl$HCIINQUIRY(r3, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f0000000000)=0x9, 0x4) 14:07:15 executing program 3: r0 = geteuid() ioctl$SIOCAX25ADDUID(0xffffffffffffffff, 0x89e1, &(0x7f0000000100)={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, r0}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)=ANY=[@ANYBLOB="0113e722b0e442"], 0x7) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x4c2000, 0x0) write$P9_RSTATFS(r3, &(0x7f0000000180)={0x43, 0x9, 0x2, {0x3, 0xb7c, 0x2, 0x2, 0xa6, 0xff, 0x9, 0x2, 0x7f}}, 0x43) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000000)={0x1001, 0xa96, "cac585", 0x6, 0x7f}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r4, 0x0, 0x0) read$sequencer(r4, &(0x7f0000000080)=""/97, 0x61) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) geteuid() (async) ioctl$SIOCAX25ADDUID(0xffffffffffffffff, 0x89e1, &(0x7f0000000100)={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, r0}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r2, &(0x7f0000000400)=ANY=[@ANYBLOB="0113e722b0e442"], 0x7) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x4c2000, 0x0) (async) write$P9_RSTATFS(r3, &(0x7f0000000180)={0x43, 0x9, 0x2, {0x3, 0xb7c, 0x2, 0x2, 0xa6, 0xff, 0x9, 0x2, 0x7f}}, 0x43) (async) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000000)={0x1001, 0xa96, "cac585", 0x6, 0x7f}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r4, 0x0, 0x0) (async) read$sequencer(r4, &(0x7f0000000080)=""/97, 0x61) (async) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="773e294d01930000000000"], 0x7) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000080)={0x3, [0x6, 0x1], 0x1}, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r4, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) write$bt_hci(r4, &(0x7f00000000c0)={0x1, @accept_sync_conn_req={{0x429, 0x15}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x13}, 0x3, 0x0, 0x80, 0xaf, 0x1f, 0xe9d8}}}, 0x19) ioctl$HCIINQUIRY(r3, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f0000000000)=0x9, 0x4) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x80000000, 0x4) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x80000000, 0x4) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="773e294d01930000000000"], 0x7) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000080)={0x3, [0x6, 0x1], 0x1}, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r4, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) write$bt_hci(r4, &(0x7f00000000c0)={0x1, @accept_sync_conn_req={{0x429, 0x15}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x13}, 0x3, 0x0, 0x80, 0xaf, 0x1f, 0xe9d8}}}, 0x19) ioctl$HCIINQUIRY(r3, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f0000000000)=0x9, 0x4) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x80000000, 0x4) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040), 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, 0x0, 0x0) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, 0x0, 0x0) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$sock_bt_hci(r1, 0x800448cf, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={0xffffffffffffffff, 0x1ff, 0x18}, 0xc) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000), 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000040), 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:15 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:15 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) [ 2789.969235] Bluetooth: hci2 command 0x0401 tx timeout 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, 0x0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, 0x0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, 0x0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0), 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0), 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) 14:07:15 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0), 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:16 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:16 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:16 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:16 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, 0x0, 0x0) 14:07:16 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, 0x0, 0x0) 14:07:16 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, 0x0, 0x0) 14:07:16 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040), 0x6) 14:07:16 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040), 0x6) 14:07:16 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040), 0x6) [ 2791.247738] Bluetooth: hci1 command 0x0401 tx timeout [ 2792.047797] Bluetooth: hci2 command 0x0401 tx timeout [ 2793.327626] Bluetooth: hci1 command 0x0401 tx timeout [ 2794.127794] Bluetooth: hci2 command 0x0401 tx timeout [ 2795.407424] Bluetooth: hci1 command 0x0401 tx timeout [ 2797.487272] Bluetooth: hci1 command 0x0401 tx timeout [ 2799.567078] Bluetooth: hci1 command 0x0401 tx timeout [ 2801.646903] Bluetooth: hci1 command 0x0401 tx timeout [ 2803.726709] Bluetooth: hci1 command 0x0401 tx timeout 14:07:44 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) 14:07:44 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000040), 0x6) 14:07:45 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x4}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000080)={0x4, 0x0, '6<.', 0x8, 0x3}) 14:07:45 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x6, &(0x7f0000000000)=[{0x20, 0x8, 0x8, 0x1f}, {0x2d6, 0x1, 0xfb}, {0x8, 0x4, 0x6}, {0xfff9, 0x2, 0xf7}, {0xca63, 0x5, 0x1, 0x4}, {0x1, 0x9, 0x2, 0x6}]}) r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) write$sysctl(r0, &(0x7f0000000080)='4\x00', 0x2) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}}) 14:07:45 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) ioctl$SNDCTL_SEQ_SYNC(r1, 0x5101) 14:07:45 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000004c0)={0x1f, 0x4}, 0x6) bind$bt_hci(r0, &(0x7f0000000040), 0x6) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x24000, 0x0) ioctl$sock_bt_hci(r0, 0x0, &(0x7f00000000c0)="f9a59e1014f7973a") ioctl$sock_bt_hci(r0, 0x400448dc, &(0x7f0000000100)="6ce7fda4a7b6e5af532cba48067359c4ae9cc2bda89938cc3010d8b6c2c6d0e7bf6aa8aa8d2bc894bca845fb30b93c1068323949158edb3c613056f43375b3fe484d4a059f456d07dc45db874751d38549606f09c13b3d5933be6469db0f88cf1956c29fd27996d43309061616aa4f22fe890140061f20df05448bb5545070984f6fd36497fed5ee718b96e7f62e8f7dd4e55c4796122834d90e215d3b38b9514fe9bf8df204d8d47199532aab7da0dd6bcaeef0104c876013ce37d4a71e2c0971") setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0xc3, 0x4) 14:07:45 executing program 1: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x2, &(0x7f0000000000)=[{0x81}, {0x6}]}) ioctl$SIOCX25GDTEFACILITIES(0xffffffffffffffff, 0x89ea, &(0x7f0000000040)) 14:07:45 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) write$bt_hci(r1, &(0x7f0000000000)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x7, 0x6, 0x100, 0x9f1}}}, 0xb) 14:07:45 executing program 3: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000540), 0x80201, 0x0) ioctl$SNDCTL_TMR_METRONOME(r0, 0x40045407) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0xa1803) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x400000, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000500)={0x84, 0x0, &(0x7f0000000380)=[@increfs_done, @increfs, @request_death={0x400c630e, 0x1}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x60, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/32, 0x20, 0x0, 0x2f}, @fda={0x66646185, 0x4, 0x0, 0x1b}, @fd={0x66642a85, 0x0, r4}}, &(0x7f0000000340)={0x0, 0x28, 0x48}}}, @request_death={0x400c630e, 0x1}, @register_looper], 0x98, 0x0, &(0x7f0000000440)="bcf8846f41a82ecccae436c33cf027e78b8460c9c1d82790e9fbd31bf2b49447b229378a4256e528e285265c4f62a3ef5d9d5611c3516041fede80c92b418ba4fccc1d7d8e689f5de967ed649ec7e132ed9ed651f4d0dac0477a0c5d989039ec0f3ced94badf0cce9ca6e0b072581cbf69af2546398a93fa48e3c03c68f0482bd423aa86409a0e31cbb693d7febd214549c8b1ba976727f5"}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="01d0f7fffcc4"], 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f0000000080)=0xe84, 0x4) write$bt_hci(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="0113b8e1358680fd384e3c6dd40adfc888ccab0192df340100169dba8d37c06ee319643328b56e59210212c8ae547587e73ca64ea72b7ac2c1249782f7c615d698e9af6276eec1de2c66681f6127933ebd988eb3a0342ff520ba6ce36e6a93e39a0129ae97938f23bc73742c05"], 0x7) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r6, 0x0, 0x0) ioctl$SNDCTL_SEQ_RESET(r6, 0x5100) r7 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x2500) bind$bt_hci(r7, &(0x7f00000001c0)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r8, &(0x7f0000000100)=ANY=[@ANYBLOB="0819a2fb56ba10f3bfe30b2ebd6012abb961fc5109097ed4823305926e862debe4e820db09132a6520faef3670efc1b448132ead6887874631fdaff5c15407aa560cce9ecbfcd27defcaf38c2a237678e180023915b5c13b495cb362e7584de5384ebffee835e52570efcf50731ac9d9968a9c69ec8b52b21d1fe1976d3dc165190f"], 0x7) 14:07:45 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x6, &(0x7f0000000000)=[{0x20, 0x8, 0x8, 0x1f}, {0x2d6, 0x1, 0xfb}, {0x8, 0x4, 0x6}, {0xfff9, 0x2, 0xf7}, {0xca63, 0x5, 0x1, 0x4}, {0x1, 0x9, 0x2, 0x6}]}) r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) write$sysctl(r0, &(0x7f0000000080)='4\x00', 0x2) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}}) 14:07:45 executing program 4: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r0, 0x0, 0x0) ioctl$SIOCAX25DELFWD(r0, 0x89eb, &(0x7f0000000080)={@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$SNDCTL_SEQ_RESET(r2, 0x5100) bind$bt_hci(r1, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r1, 0x400448dc, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r3, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r3, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r4, r5, r6, r7, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r2, 0xc02864ca, &(0x7f0000000180)={&(0x7f0000000100)=[r6, r8], &(0x7f0000000140)=[0x100000000, 0x50, 0xffffffffffffffe1, 0xffff], 0x0, 0x2, 0x1}) 14:07:45 executing program 2: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x1, &(0x7f0000000240)=[{0x6}]}) ioctl$DRM_IOCTL_GEM_CLOSE(0xffffffffffffffff, 0x40086409, 0x0) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000340), 0x80041, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r3, 0x0, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f00000002c0), 0x401, 0x0) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000300)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x4}) r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000140)={0xffffffffffffffff, 0x81}, 0xc) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r6, 0x0, 0x0) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r7, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000001c0)=@bpf_ext={0x1c, 0x9, &(0x7f0000000000)=@raw=[@generic={0x8, 0x8, 0x7, 0x167, 0xfffff44b}, @alu={0x7, 0x0, 0x3, 0x9, 0x4, 0xffffffffffffffff}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffff8}, @call={0x85, 0x0, 0x0, 0xb}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x5}], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0xf, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000000c0)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000100)={0x0, 0x5, 0x3, 0x81}, 0x10, 0x40, 0xffffffffffffffff, 0x0, &(0x7f0000000180)=[r1, r2, r3, 0xffffffffffffffff, 0x1, r5, r6, 0x1, r7]}, 0x80) 14:07:45 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_SYS_GET(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, 0x1406, 0x200, 0x70bd26, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000010}, 0x24042050) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448dc, 0x0) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000000)={0x3, 0xff, "46e4ff", 0x6, 0x40}) 14:07:45 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (fail_nth: 1) [ 2819.253952] FAULT_INJECTION: forcing a failure. [ 2819.253952] name failslab, interval 1, probability 0, space 0, times 0 [ 2819.271387] CPU: 0 PID: 16954 Comm: syz-executor.4 Not tainted 4.14.277-syzkaller #0 [ 2819.279277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2819.288632] Call Trace: [ 2819.291226] dump_stack+0x1b2/0x281 [ 2819.294852] should_fail.cold+0x10a/0x149 [ 2819.299000] should_failslab+0xd6/0x130 [ 2819.302968] kmem_cache_alloc_node+0x263/0x410 [ 2819.307539] __alloc_skb+0x5c/0x510 [ 2819.311152] mgmt_send_event+0x42/0x330 [ 2819.315107] ? mgmt_pending_foreach+0x27/0x120 [ 2819.319705] mgmt_index_removed+0x200/0x240 [ 2819.324125] ? mgmt_index_added+0x210/0x210 [ 2819.328441] ? _raw_read_unlock+0x29/0x40 [ 2819.332581] ? hci_dev_get+0xe6/0x190 [ 2819.336370] hci_sock_bind+0xe00/0x12b0 [ 2819.340342] ? hci_sock_ioctl+0x6c0/0x6c0 [ 2819.344476] ? security_socket_bind+0x83/0xb0 [ 2819.348963] SyS_bind+0x174/0x1f0 [ 2819.352430] ? SyS_socketpair+0x480/0x480 [ 2819.356569] ? wait_for_completion_io+0x10/0x10 [ 2819.361225] ? vfs_write+0x319/0x4d0 [ 2819.364922] ? fput_many+0xe/0x140 [ 2819.368444] ? SyS_write+0x14d/0x210 [ 2819.372149] ? SyS_read+0x210/0x210 [ 2819.375762] ? __do_page_fault+0x159/0xad0 [ 2819.379982] ? do_syscall_64+0x4c/0x640 [ 2819.383940] ? SyS_socketpair+0x480/0x480 [ 2819.388075] do_syscall_64+0x1d5/0x640 [ 2819.391951] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2819.397122] RIP: 0033:0x7fd99ab050e9 [ 2819.400813] RSP: 002b:00007fd99947a168 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 2819.408503] RAX: ffffffffffffffda RBX: 00007fd99ac17f60 RCX: 00007fd99ab050e9 [ 2819.415755] RDX: 0000000000000006 RSI: 0000000020000040 RDI: 0000000000000004 [ 2819.423007] RBP: 00007fd99947a1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2819.430262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2819.437522] R13: 00007fffe364baff R14: 00007fd99947a300 R15: 0000000000022000 [ 2819.451073] audit: type=1326 audit(1651414065.291:1313): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=16947 comm="syz-executor.2" exe="/root/syz-executor.2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd0c4c590e9 code=0x0 [ 2819.472059] audit: type=1326 audit(1651414065.321:1314): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=16936 comm="syz-executor.1" exe="/root/syz-executor.1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f66aabb10e9 code=0x0 14:07:45 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (fail_nth: 1) 14:07:45 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x6, &(0x7f0000000000)=[{0x20, 0x8, 0x8, 0x1f}, {0x2d6, 0x1, 0xfb}, {0x8, 0x4, 0x6}, {0xfff9, 0x2, 0xf7}, {0xca63, 0x5, 0x1, 0x4}, {0x1, 0x9, 0x2, 0x6}]}) r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) write$sysctl(r0, &(0x7f0000000080)='4\x00', 0x2) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}}) 14:07:45 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (fail_nth: 2) 14:07:45 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (fail_nth: 1) [ 2820.005775] FAULT_INJECTION: forcing a failure. [ 2820.005775] name failslab, interval 1, probability 0, space 0, times 0 [ 2820.013605] FAULT_INJECTION: forcing a failure. [ 2820.013605] name failslab, interval 1, probability 0, space 0, times 0 [ 2820.024138] CPU: 1 PID: 16960 Comm: syz-executor.4 Not tainted 4.14.277-syzkaller #0 [ 2820.036112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2820.045458] Call Trace: [ 2820.048040] dump_stack+0x1b2/0x281 [ 2820.051660] should_fail.cold+0x10a/0x149 [ 2820.055797] should_failslab+0xd6/0x130 [ 2820.059764] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2820.064861] __kmalloc_node_track_caller+0x38/0x70 [ 2820.069787] __alloc_skb+0x96/0x510 [ 2820.073417] mgmt_send_event+0x42/0x330 [ 2820.077399] ? mgmt_pending_foreach+0x27/0x120 [ 2820.081975] mgmt_index_removed+0x200/0x240 [ 2820.086292] ? mgmt_index_added+0x210/0x210 [ 2820.090612] ? _raw_read_unlock+0x29/0x40 [ 2820.094758] ? hci_dev_get+0xe6/0x190 [ 2820.098557] hci_sock_bind+0xe00/0x12b0 [ 2820.102528] ? hci_sock_ioctl+0x6c0/0x6c0 [ 2820.106745] ? security_socket_bind+0x83/0xb0 [ 2820.111254] SyS_bind+0x174/0x1f0 [ 2820.114700] ? SyS_socketpair+0x480/0x480 [ 2820.118841] ? wait_for_completion_io+0x10/0x10 [ 2820.123505] ? vfs_write+0x319/0x4d0 [ 2820.127217] ? fput_many+0xe/0x140 [ 2820.130752] ? SyS_write+0x14d/0x210 [ 2820.134463] ? SyS_read+0x210/0x210 [ 2820.138098] ? __do_page_fault+0x159/0xad0 [ 2820.142346] ? do_syscall_64+0x4c/0x640 [ 2820.146308] ? SyS_socketpair+0x480/0x480 [ 2820.150444] do_syscall_64+0x1d5/0x640 14:07:46 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (fail_nth: 1) [ 2820.154320] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2820.159495] RIP: 0033:0x7fd99ab050e9 [ 2820.163190] RSP: 002b:00007fd99947a168 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 2820.170913] RAX: ffffffffffffffda RBX: 00007fd99ac17f60 RCX: 00007fd99ab050e9 [ 2820.178178] RDX: 0000000000000006 RSI: 0000000020000040 RDI: 0000000000000004 [ 2820.185439] RBP: 00007fd99947a1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2820.192696] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 14:07:46 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (fail_nth: 1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) [ 2820.199952] R13: 00007fffe364baff R14: 00007fd99947a300 R15: 0000000000022000 [ 2820.223395] CPU: 0 PID: 16962 Comm: syz-executor.1 Not tainted 4.14.277-syzkaller #0 [ 2820.231282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2820.240627] Call Trace: [ 2820.243214] dump_stack+0x1b2/0x281 [ 2820.246846] should_fail.cold+0x10a/0x149 [ 2820.250992] should_failslab+0xd6/0x130 [ 2820.254966] kmem_cache_alloc_node+0x54/0x410 [ 2820.259459] __alloc_skb+0x5c/0x510 [ 2820.263091] create_monitor_ctrl_open+0x130/0x630 [ 2820.267934] ? hci_sock_setsockopt+0x5b0/0x5b0 [ 2820.272513] ? security_capable+0x88/0xb0 [ 2820.276665] hci_sock_ioctl+0x549/0x6c0 [ 2820.280641] ? hci_sock_sendmsg+0x1d00/0x1d00 [ 2820.285133] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2820.290053] ? __handle_mm_fault+0x80f/0x4620 [ 2820.294554] ? SyS_write+0x1b7/0x210 [ 2820.294869] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de 14:07:46 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000040)={0x0}) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000300)) ioctl$SIOCAX25GETINFO(r1, 0x89ed, &(0x7f0000000180)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x0, &(0x7f0000000100)}) socket$unix(0x1, 0x5, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x400500, 0x0) getpeername$ax25(r2, &(0x7f0000000200)={{0x3, @netrom}, [@rose, @null, @null, @null, @default, @default, @remote, @default]}, &(0x7f0000000280)=0x48) recvmsg$unix(r2, 0x0, 0x0) connect$ax25(r1, &(0x7f00000003c0)={{0x3, @bcast, 0x1}, [@bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48) r3 = socket$unix(0x1, 0x5, 0x0) accept4$unix(r3, 0x0, &(0x7f00000002c0), 0x0) recvmsg$unix(r3, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={r0, 0x3, r3, 0x100}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000340), 0xc000, 0x0) write$P9_RCLUNK(r5, &(0x7f0000000380)={0x7, 0x79, 0x1}, 0x7) ioctl$SNDCTL_SEQ_RESETSAMPLES(r5, 0x40045109, &(0x7f0000000440)=0x3bae) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0x1, 0x2}, 0x6) 14:07:46 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000040)={0x0}) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000300)) ioctl$SIOCAX25GETINFO(r1, 0x89ed, &(0x7f0000000180)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x0, &(0x7f0000000100)}) socket$unix(0x1, 0x5, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x400500, 0x0) getpeername$ax25(r2, &(0x7f0000000200)={{0x3, @netrom}, [@rose, @null, @null, @null, @default, @default, @remote, @default]}, &(0x7f0000000280)=0x48) recvmsg$unix(r2, 0x0, 0x0) connect$ax25(r1, &(0x7f00000003c0)={{0x3, @bcast, 0x1}, [@bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48) r3 = socket$unix(0x1, 0x5, 0x0) accept4$unix(r3, 0x0, &(0x7f00000002c0), 0x0) recvmsg$unix(r3, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={r0, 0x3, r3, 0x100}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000340), 0xc000, 0x0) write$P9_RCLUNK(r5, &(0x7f0000000380)={0x7, 0x79, 0x1}, 0x7) ioctl$SNDCTL_SEQ_RESETSAMPLES(r5, 0x40045109, &(0x7f0000000440)=0x3bae) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0x1, 0x2}, 0x6) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000040)) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) getpeername$ax25(r1, 0x0, 0x0) (async) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000300)) (async) ioctl$SIOCAX25GETINFO(r1, 0x89ed, &(0x7f0000000180)) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x0, &(0x7f0000000100)}) (async) socket$unix(0x1, 0x5, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x400500, 0x0) (async) getpeername$ax25(r2, &(0x7f0000000200)={{0x3, @netrom}, [@rose, @null, @null, @null, @default, @default, @remote, @default]}, &(0x7f0000000280)=0x48) (async) recvmsg$unix(r2, 0x0, 0x0) (async) connect$ax25(r1, &(0x7f00000003c0)={{0x3, @bcast, 0x1}, [@bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48) (async) socket$unix(0x1, 0x5, 0x0) (async) accept4$unix(r3, 0x0, &(0x7f00000002c0), 0x0) (async) recvmsg$unix(r3, 0x0, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={r0, 0x3, r3, 0x100}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000340), 0xc000, 0x0) (async) write$P9_RCLUNK(r5, &(0x7f0000000380)={0x7, 0x79, 0x1}, 0x7) (async) ioctl$SNDCTL_SEQ_RESETSAMPLES(r5, 0x40045109, &(0x7f0000000440)=0x3bae) (async) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0x1, 0x2}, 0x6) (async) [ 2820.298265] sock_ioctl+0x2cc/0x4c0 [ 2820.298275] ? sock_release+0x1e0/0x1e0 [ 2820.298285] do_vfs_ioctl+0x75a/0xff0 [ 2820.298296] ? lock_acquire+0x170/0x3f0 [ 2820.298309] ? ioctl_preallocate+0x1a0/0x1a0 [ 2820.326305] ? __fget+0x265/0x3e0 [ 2820.329756] ? do_vfs_ioctl+0xff0/0xff0 [ 2820.330443] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.333725] ? security_file_ioctl+0x83/0xb0 [ 2820.333737] SyS_ioctl+0x7f/0xb0 [ 2820.333746] ? do_vfs_ioctl+0xff0/0xff0 [ 2820.353741] do_syscall_64+0x1d5/0x640 14:07:46 executing program 0: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000040)={0x0}) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) (async) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000300)) (async) ioctl$SIOCAX25GETINFO(r1, 0x89ed, &(0x7f0000000180)) (async, rerun: 32) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x0, &(0x7f0000000100)}) (async, rerun: 32) socket$unix(0x1, 0x5, 0x0) (async, rerun: 32) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x400500, 0x0) (rerun: 32) getpeername$ax25(r2, &(0x7f0000000200)={{0x3, @netrom}, [@rose, @null, @null, @null, @default, @default, @remote, @default]}, &(0x7f0000000280)=0x48) recvmsg$unix(r2, 0x0, 0x0) (async, rerun: 64) connect$ax25(r1, &(0x7f00000003c0)={{0x3, @bcast, 0x1}, [@bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48) (rerun: 64) r3 = socket$unix(0x1, 0x5, 0x0) accept4$unix(r3, 0x0, &(0x7f00000002c0), 0x0) recvmsg$unix(r3, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={r0, 0x3, r3, 0x100}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000340), 0xc000, 0x0) write$P9_RCLUNK(r5, &(0x7f0000000380)={0x7, 0x79, 0x1}, 0x7) (async) ioctl$SNDCTL_SEQ_RESETSAMPLES(r5, 0x40045109, &(0x7f0000000440)=0x3bae) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0x1, 0x2}, 0x6) [ 2820.357633] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2820.362818] RIP: 0033:0x7f66aabb10e9 [ 2820.366520] RSP: 002b:00007f66a9526168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2820.374209] RAX: ffffffffffffffda RBX: 00007f66aacc3f60 RCX: 00007f66aabb10e9 [ 2820.381456] RDX: 0000000020000000 RSI: 00000000400448e0 RDI: 0000000000000004 [ 2820.388706] RBP: 00007f66a95261d0 R08: 0000000000000000 R09: 0000000000000000 [ 2820.395953] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 14:07:46 executing program 2: ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x700, 0x7800, 0x9, 0x2, {{0x39, 0x4, 0x1, 0x15, 0xe4, 0x64, 0x0, 0x7, 0x4, 0x0, @local, @local, {[@generic={0x88, 0x3, 'w'}, @cipso={0x86, 0x44, 0xffffffffffffffff, [{0x1, 0x8, "cd854b5ce2b5"}, {0x6, 0x3, 'u'}, {0x0, 0x4, "82d9"}, {0x1, 0xe, "325155aafdda33fb371c9573"}, {0x2, 0xb, "3ca750b8f7fa4ac4fb"}, {0x6, 0xc, "67aa9d1fcc60059569c9"}, {0x5, 0x7, "64f84ca22f"}, {0x2, 0x3, '<'}]}, @end, @cipso={0x86, 0x43, 0x1, [{0x0, 0x12, "3e04f56fe8d651db8c7c6501c8ee6949"}, {0x2, 0xb, "257aadbe6b772e9d0c"}, {0x0, 0xd, "c032acf8688cc97f205023"}, {0x1, 0x3, "c9"}, {0x0, 0x10, "1bb1a19b7eda5c73f8650d1b3e84"}]}, @timestamp_prespec={0x44, 0x1c, 0xa0, 0x3, 0x3, [{@dev={0xac, 0x14, 0x14, 0x14}, 0x3}, {@private=0xa010101, 0x36c}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}]}, @lsrr={0x83, 0xf, 0x29, [@initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @private=0xa010100]}, @rr={0x7, 0x13, 0x82, [@remote, @multicast2, @multicast1, @broadcast]}, @generic={0x44, 0x5, "6f142c"}, @end]}}}}}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:46 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (fail_nth: 3) [ 2820.403200] R13: 00007ffc50ba1d5f R14: 00007f66a9526300 R15: 0000000000022000 14:07:46 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x6, &(0x7f0000000000)=[{0x20, 0x8, 0x8, 0x1f}, {0x2d6, 0x1, 0xfb}, {0x8, 0x4, 0x6}, {0xfff9, 0x2, 0xf7}, {0xca63, 0x5, 0x1, 0x4}, {0x1, 0x9, 0x2, 0x6}]}) r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) write$sysctl(r0, &(0x7f0000000080)='4\x00', 0x2) [ 2820.428280] FAULT_INJECTION: forcing a failure. [ 2820.428280] name failslab, interval 1, probability 0, space 0, times 0 [ 2820.439670] CPU: 0 PID: 16995 Comm: syz-executor.4 Not tainted 4.14.277-syzkaller #0 [ 2820.447550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2820.448674] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.456890] Call Trace: [ 2820.456906] dump_stack+0x1b2/0x281 [ 2820.456921] should_fail.cold+0x10a/0x149 14:07:46 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000340)=0x8, 0x4) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000000)={'syztnl2\x00', &(0x7f0000000080)=ANY=[@ANYBLOB='syztnl1\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="80000040000000010000000840f7008000650000072f9078e0000001ac1414bb0a0dab4392ae6c9ea3c6bf3f17891b7b000003ffac1414aaffffffefe0000001ac14140b00000000443c8e23ac1414aa00800000ac1414bb000000010a010102000000050a01010200008001ffffffff00000005ac1414bb000000040a01010200000000070706ffffffff00"]}) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x7) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000280)={"4f0ce9630d90a20f19aec88ff06e821301d51582430e8cadcc09e5073847", 0x868, 0x1, 0x0, 0x80000001, 0x6, 0xfff, 0x3, 0x0, [0x401, 0x800, 0x9, 0x9, 0x9, 0x6, 0x200, 0xeda8, 0x4, 0x5, 0x2, 0xe6, 0x81, 0x7d443b97, 0x1, 0xfd, 0xfff, 0x101, 0x7fffffff]}) r3 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r3, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r3, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r4, r5, r6, r7, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(0xffffffffffffffff, 0xc01064c5, &(0x7f00000003c0)={&(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, r7], 0x6}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xc, 0x1ff, 0x1000, 0x2, 0x100, 0x1, 0x80, '\x00', r1, 0xffffffffffffffff, 0x4}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x6, 0x1f, 0x4, 0xffffffff, 0x1200, r8, 0xfe, '\x00', r1, 0xffffffffffffffff, 0x1, 0x5, 0x3}, 0x48) bind$bt_hci(r2, &(0x7f0000000140)={0x1f, 0x2}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:46 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000340)=0x8, 0x4) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000000)={'syztnl2\x00', &(0x7f0000000080)=ANY=[@ANYBLOB='syztnl1\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="80000040000000010000000840f7008000650000072f9078e0000001ac1414bb0a0dab4392ae6c9ea3c6bf3f17891b7b000003ffac1414aaffffffefe0000001ac14140b00000000443c8e23ac1414aa00800000ac1414bb000000010a010102000000050a01010200008001ffffffff00000005ac1414bb000000040a01010200000000070706ffffffff00"]}) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x7) (async) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000280)={"4f0ce9630d90a20f19aec88ff06e821301d51582430e8cadcc09e5073847", 0x868, 0x1, 0x0, 0x80000001, 0x6, 0xfff, 0x3, 0x0, [0x401, 0x800, 0x9, 0x9, 0x9, 0x6, 0x200, 0xeda8, 0x4, 0x5, 0x2, 0xe6, 0x81, 0x7d443b97, 0x1, 0xfd, 0xfff, 0x101, 0x7fffffff]}) (async) r3 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r3, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r3, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r4, r5, r6, r7, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(0xffffffffffffffff, 0xc01064c5, &(0x7f00000003c0)={&(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, r7], 0x6}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xc, 0x1ff, 0x1000, 0x2, 0x100, 0x1, 0x80, '\x00', r1, 0xffffffffffffffff, 0x4}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x6, 0x1f, 0x4, 0xffffffff, 0x1200, r8, 0xfe, '\x00', r1, 0xffffffffffffffff, 0x1, 0x5, 0x3}, 0x48) bind$bt_hci(r2, &(0x7f0000000140)={0x1f, 0x2}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) [ 2820.456935] should_failslab+0xd6/0x130 [ 2820.456946] kmem_cache_alloc_node+0x263/0x410 [ 2820.456958] __alloc_skb+0x5c/0x510 [ 2820.486246] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.487700] mgmt_send_event+0x42/0x330 [ 2820.487719] mgmt_index_removed+0x133/0x240 [ 2820.487728] ? mgmt_index_added+0x210/0x210 [ 2820.487741] ? _raw_read_unlock+0x29/0x40 [ 2820.487753] ? hci_dev_get+0xe6/0x190 [ 2820.504709] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.508613] hci_sock_bind+0xe00/0x12b0 [ 2820.508624] ? hci_sock_ioctl+0x6c0/0x6c0 [ 2820.508635] ? security_socket_bind+0x83/0xb0 [ 2820.508647] SyS_bind+0x174/0x1f0 [ 2820.508656] ? SyS_socketpair+0x480/0x480 [ 2820.508668] ? wait_for_completion_io+0x10/0x10 [ 2820.508679] ? vfs_write+0x319/0x4d0 [ 2820.508691] ? fput_many+0xe/0x140 [ 2820.521682] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.524902] ? SyS_write+0x14d/0x210 [ 2820.524913] ? SyS_read+0x210/0x210 [ 2820.524924] ? __do_page_fault+0x159/0xad0 [ 2820.524936] ? do_syscall_64+0x4c/0x640 [ 2820.533120] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.537496] ? SyS_socketpair+0x480/0x480 [ 2820.537509] do_syscall_64+0x1d5/0x640 [ 2820.537526] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2820.537534] RIP: 0033:0x7fd99ab050e9 [ 2820.537539] RSP: 002b:00007fd99947a168 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 2820.537549] RAX: ffffffffffffffda RBX: 00007fd99ac17f60 RCX: 00007fd99ab050e9 [ 2820.537554] RDX: 0000000000000006 RSI: 0000000020000040 RDI: 0000000000000004 14:07:46 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (fail_nth: 2) 14:07:46 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x6, &(0x7f0000000000)=[{0x20, 0x8, 0x8, 0x1f}, {0x2d6, 0x1, 0xfb}, {0x8, 0x4, 0x6}, {0xfff9, 0x2, 0xf7}, {0xca63, 0x5, 0x1, 0x4}, {0x1, 0x9, 0x2, 0x6}]}) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) 14:07:46 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (fail_nth: 4) 14:07:46 executing program 2: ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x700, 0x7800, 0x9, 0x2, {{0x39, 0x4, 0x1, 0x15, 0xe4, 0x64, 0x0, 0x7, 0x4, 0x0, @local, @local, {[@generic={0x88, 0x3, 'w'}, @cipso={0x86, 0x44, 0xffffffffffffffff, [{0x1, 0x8, "cd854b5ce2b5"}, {0x6, 0x3, 'u'}, {0x0, 0x4, "82d9"}, {0x1, 0xe, "325155aafdda33fb371c9573"}, {0x2, 0xb, "3ca750b8f7fa4ac4fb"}, {0x6, 0xc, "67aa9d1fcc60059569c9"}, {0x5, 0x7, "64f84ca22f"}, {0x2, 0x3, '<'}]}, @end, @cipso={0x86, 0x43, 0x1, [{0x0, 0x12, "3e04f56fe8d651db8c7c6501c8ee6949"}, {0x2, 0xb, "257aadbe6b772e9d0c"}, {0x0, 0xd, "c032acf8688cc97f205023"}, {0x1, 0x3, "c9"}, {0x0, 0x10, "1bb1a19b7eda5c73f8650d1b3e84"}]}, @timestamp_prespec={0x44, 0x1c, 0xa0, 0x3, 0x3, [{@dev={0xac, 0x14, 0x14, 0x14}, 0x3}, {@private=0xa010101, 0x36c}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}]}, @lsrr={0x83, 0xf, 0x29, [@initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @private=0xa010100]}, @rr={0x7, 0x13, 0x82, [@remote, @multicast2, @multicast1, @broadcast]}, @generic={0x44, 0x5, "6f142c"}, @end]}}}}}) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:46 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000340)=0x8, 0x4) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000000)={'syztnl2\x00', &(0x7f0000000080)=ANY=[@ANYBLOB='syztnl1\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="80000040000000010000000840f7008000650000072f9078e0000001ac1414bb0a0dab4392ae6c9ea3c6bf3f17891b7b000003ffac1414aaffffffefe0000001ac14140b00000000443c8e23ac1414aa00800000ac1414bb000000010a010102000000050a01010200008001ffffffff00000005ac1414bb000000040a01010200000000070706ffffffff00"]}) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x7) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000280)={"4f0ce9630d90a20f19aec88ff06e821301d51582430e8cadcc09e5073847", 0x868, 0x1, 0x0, 0x80000001, 0x6, 0xfff, 0x3, 0x0, [0x401, 0x800, 0x9, 0x9, 0x9, 0x6, 0x200, 0xeda8, 0x4, 0x5, 0x2, 0xe6, 0x81, 0x7d443b97, 0x1, 0xfd, 0xfff, 0x101, 0x7fffffff]}) r3 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r3, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r3, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r4, r5, r6, r7, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(0xffffffffffffffff, 0xc01064c5, &(0x7f00000003c0)={&(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, r7], 0x6}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xc, 0x1ff, 0x1000, 0x2, 0x100, 0x1, 0x80, '\x00', r1, 0xffffffffffffffff, 0x4}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x6, 0x1f, 0x4, 0xffffffff, 0x1200, r8, 0xfe, '\x00', r1, 0xffffffffffffffff, 0x1, 0x5, 0x3}, 0x48) bind$bt_hci(r2, &(0x7f0000000140)={0x1f, 0x2}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000340)=0x8, 0x4) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000000)={'syztnl2\x00', &(0x7f0000000080)=ANY=[@ANYBLOB='syztnl1\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="80000040000000010000000840f7008000650000072f9078e0000001ac1414bb0a0dab4392ae6c9ea3c6bf3f17891b7b000003ffac1414aaffffffefe0000001ac14140b00000000443c8e23ac1414aa00800000ac1414bb000000010a010102000000050a01010200008001ffffffff00000005ac1414bb000000040a01010200000000070706ffffffff00"]}) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r2, &(0x7f0000000400)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x7) (async) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000280)={"4f0ce9630d90a20f19aec88ff06e821301d51582430e8cadcc09e5073847", 0x868, 0x1, 0x0, 0x80000001, 0x6, 0xfff, 0x3, 0x0, [0x401, 0x800, 0x9, 0x9, 0x9, 0x6, 0x200, 0xeda8, 0x4, 0x5, 0x2, 0xe6, 0x81, 0x7d443b97, 0x1, 0xfd, 0xfff, 0x101, 0x7fffffff]}) (async) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(r3, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r3, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r4, r5, r6, r7, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(0xffffffffffffffff, 0xc01064c5, &(0x7f00000003c0)={&(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, r7], 0x6}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xc, 0x1ff, 0x1000, 0x2, 0x100, 0x1, 0x80, '\x00', r1, 0xffffffffffffffff, 0x4}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x6, 0x1f, 0x4, 0xffffffff, 0x1200, r8, 0xfe, '\x00', r1, 0xffffffffffffffff, 0x1, 0x5, 0x3}, 0x48) (async) bind$bt_hci(r2, &(0x7f0000000140)={0x1f, 0x2}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) [ 2820.537558] RBP: 00007fd99947a1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2820.537563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2820.537571] R13: 00007fffe364baff R14: 00007fd99947a300 R15: 0000000000022000 [ 2820.549311] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.633295] FAULT_INJECTION: forcing a failure. [ 2820.633295] name failslab, interval 1, probability 0, space 0, times 0 [ 2820.647336] FAULT_INJECTION: forcing a failure. [ 2820.647336] name failslab, interval 1, probability 0, space 0, times 0 [ 2820.671860] CPU: 0 PID: 17016 Comm: syz-executor.1 Not tainted 4.14.277-syzkaller #0 [ 2820.689595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2820.698932] Call Trace: [ 2820.701503] dump_stack+0x1b2/0x281 [ 2820.705124] should_fail.cold+0x10a/0x149 [ 2820.709257] should_failslab+0xd6/0x130 [ 2820.713217] kmem_cache_alloc_node_trace+0x58/0x400 [ 2820.718220] __kmalloc_node_track_caller+0x38/0x70 [ 2820.723136] __alloc_skb+0x96/0x510 [ 2820.726749] create_monitor_ctrl_open+0x130/0x630 [ 2820.731574] ? hci_sock_setsockopt+0x5b0/0x5b0 [ 2820.736137] ? security_capable+0x88/0xb0 [ 2820.736329] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.740270] hci_sock_ioctl+0x549/0x6c0 [ 2820.740280] ? hci_sock_sendmsg+0x1d00/0x1d00 [ 2820.740290] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2820.740300] ? __handle_mm_fault+0x80f/0x4620 [ 2820.761873] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.761936] ? SyS_write+0x1b7/0x210 [ 2820.770878] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.774707] sock_ioctl+0x2cc/0x4c0 [ 2820.774716] ? sock_release+0x1e0/0x1e0 [ 2820.774726] do_vfs_ioctl+0x75a/0xff0 [ 2820.774737] ? lock_acquire+0x170/0x3f0 [ 2820.786131] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.786719] ? ioctl_preallocate+0x1a0/0x1a0 [ 2820.794752] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.798057] ? __fget+0x265/0x3e0 [ 2820.798068] ? do_vfs_ioctl+0xff0/0xff0 [ 2820.798079] ? security_file_ioctl+0x83/0xb0 [ 2820.798089] SyS_ioctl+0x7f/0xb0 [ 2820.798098] ? do_vfs_ioctl+0xff0/0xff0 [ 2820.798109] do_syscall_64+0x1d5/0x640 [ 2820.798124] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2820.806517] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.810398] RIP: 0033:0x7f66aabb10e9 [ 2820.810403] RSP: 002b:00007f66a9526168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2820.810414] RAX: ffffffffffffffda RBX: 00007f66aacc3f60 RCX: 00007f66aabb10e9 14:07:46 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$SNDCTL_SEQ_NRSYNTHS(0xffffffffffffffff, 0x8004510a, &(0x7f0000000000)) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) [ 2820.810419] RDX: 0000000020000000 RSI: 00000000400448e0 RDI: 0000000000000004 [ 2820.810427] RBP: 00007f66a95261d0 R08: 0000000000000000 R09: 0000000000000000 [ 2820.818140] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.823107] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2820.823112] R13: 00007ffc50ba1d5f R14: 00007f66a9526300 R15: 0000000000022000 [ 2820.901765] CPU: 0 PID: 17018 Comm: syz-executor.4 Not tainted 4.14.277-syzkaller #0 [ 2820.910225] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.916227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2820.916232] Call Trace: [ 2820.916246] dump_stack+0x1b2/0x281 [ 2820.916260] should_fail.cold+0x10a/0x149 [ 2820.916274] should_failslab+0xd6/0x130 [ 2820.924150] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.932440] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2820.932454] __kmalloc_node_track_caller+0x38/0x70 [ 2820.932464] __alloc_skb+0x96/0x510 [ 2820.932476] mgmt_send_event+0x42/0x330 [ 2820.941862] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.944384] mgmt_index_removed+0x133/0x240 [ 2820.948017] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.952115] ? mgmt_index_added+0x210/0x210 [ 2820.956101] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.964366] ? _raw_read_unlock+0x29/0x40 [ 2820.969492] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.974350] ? hci_dev_get+0xe6/0x190 [ 2820.977983] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.981903] hci_sock_bind+0xe00/0x12b0 [ 2820.990224] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2820.994491] ? hci_sock_ioctl+0x6c0/0x6c0 [ 2821.002809] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2821.007091] ? security_socket_bind+0x83/0xb0 [ 2821.007104] SyS_bind+0x174/0x1f0 [ 2821.007113] ? SyS_socketpair+0x480/0x480 [ 2821.007126] ? wait_for_completion_io+0x10/0x10 [ 2821.015479] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2821.019551] ? vfs_write+0x319/0x4d0 [ 2821.027922] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2821.031639] ? fput_many+0xe/0x140 [ 2821.039966] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2821.043881] ? SyS_write+0x14d/0x210 [ 2821.052206] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2821.056303] ? SyS_read+0x210/0x210 [ 2821.056314] ? __do_page_fault+0x159/0xad0 [ 2821.056334] ? do_syscall_64+0x4c/0x640 [ 2821.064633] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2821.069094] ? SyS_socketpair+0x480/0x480 [ 2821.069104] do_syscall_64+0x1d5/0x640 [ 2821.069120] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2821.072562] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2821.076669] RIP: 0033:0x7fd99ab050e9 [ 2821.076674] RSP: 002b:00007fd99947a168 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 14:07:47 executing program 0: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000000)={0x5, 0x4, 0x738, 0x1, 0x1, "72c62a8e53a5ff47"}) ioctl$KDDISABIO(r0, 0x4b37) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:47 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (fail_nth: 3) 14:07:47 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$SNDCTL_SEQ_NRSYNTHS(0xffffffffffffffff, 0x8004510a, &(0x7f0000000000)) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) ioctl$SNDCTL_SEQ_NRSYNTHS(0xffffffffffffffff, 0x8004510a, &(0x7f0000000000)) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:07:47 executing program 2: ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x700, 0x7800, 0x9, 0x2, {{0x39, 0x4, 0x1, 0x15, 0xe4, 0x64, 0x0, 0x7, 0x4, 0x0, @local, @local, {[@generic={0x88, 0x3, 'w'}, @cipso={0x86, 0x44, 0xffffffffffffffff, [{0x1, 0x8, "cd854b5ce2b5"}, {0x6, 0x3, 'u'}, {0x0, 0x4, "82d9"}, {0x1, 0xe, "325155aafdda33fb371c9573"}, {0x2, 0xb, "3ca750b8f7fa4ac4fb"}, {0x6, 0xc, "67aa9d1fcc60059569c9"}, {0x5, 0x7, "64f84ca22f"}, {0x2, 0x3, '<'}]}, @end, @cipso={0x86, 0x43, 0x1, [{0x0, 0x12, "3e04f56fe8d651db8c7c6501c8ee6949"}, {0x2, 0xb, "257aadbe6b772e9d0c"}, {0x0, 0xd, "c032acf8688cc97f205023"}, {0x1, 0x3, "c9"}, {0x0, 0x10, "1bb1a19b7eda5c73f8650d1b3e84"}]}, @timestamp_prespec={0x44, 0x1c, 0xa0, 0x3, 0x3, [{@dev={0xac, 0x14, 0x14, 0x14}, 0x3}, {@private=0xa010101, 0x36c}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}]}, @lsrr={0x83, 0xf, 0x29, [@initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @private=0xa010100]}, @rr={0x7, 0x13, 0x82, [@remote, @multicast2, @multicast1, @broadcast]}, @generic={0x44, 0x5, "6f142c"}, @end]}}}}}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:47 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (fail_nth: 5) 14:07:47 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x6, &(0x7f0000000000)=[{0x20, 0x8, 0x8, 0x1f}, {0x2d6, 0x1, 0xfb}, {0x8, 0x4, 0x6}, {0xfff9, 0x2, 0xf7}, {0xca63, 0x5, 0x1, 0x4}, {0x1, 0x9, 0x2, 0x6}]}) [ 2821.076683] RAX: ffffffffffffffda RBX: 00007fd99ac17f60 RCX: 00007fd99ab050e9 [ 2821.076688] RDX: 0000000000000006 RSI: 0000000020000040 RDI: 0000000000000004 [ 2821.076695] RBP: 00007fd99947a1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2821.081356] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2821.089628] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2821.089634] R13: 00007fffe364baff R14: 00007fd99947a300 R15: 0000000000022000 [ 2821.245257] Bluetooth: hci4 command 0x0401 tx timeout [ 2821.265710] FAULT_INJECTION: forcing a failure. [ 2821.265710] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2821.288087] CPU: 1 PID: 17053 Comm: syz-executor.1 Not tainted 4.14.277-syzkaller #0 [ 2821.295999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2821.305344] Call Trace: [ 2821.307931] dump_stack+0x1b2/0x281 [ 2821.311560] should_fail.cold+0x10a/0x149 14:07:47 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) bind$isdn(0xffffffffffffffff, &(0x7f0000000000)={0x22, 0x8, 0x8, 0x4, 0x2}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = syz_open_pts(0xffffffffffffffff, 0x8000) ioctl$KDGKBTYPE(r2, 0x4b33, &(0x7f0000000080)) 14:07:47 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$SNDCTL_SEQ_NRSYNTHS(0xffffffffffffffff, 0x8004510a, &(0x7f0000000000)) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) ioctl$SNDCTL_SEQ_NRSYNTHS(0xffffffffffffffff, 0x8004510a, &(0x7f0000000000)) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:07:47 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffdd}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x22000, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r2, 0x89e7, &(0x7f0000000100)={0xe}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:47 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) 14:07:47 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) bind$isdn(0xffffffffffffffff, &(0x7f0000000000)={0x22, 0x8, 0x8, 0x4, 0x2}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = syz_open_pts(0xffffffffffffffff, 0x8000) ioctl$KDGKBTYPE(r2, 0x4b33, &(0x7f0000000080)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) bind$isdn(0xffffffffffffffff, &(0x7f0000000000)={0x22, 0x8, 0x8, 0x4, 0x2}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_open_pts(0xffffffffffffffff, 0x8000) (async) ioctl$KDGKBTYPE(r2, 0x4b33, &(0x7f0000000080)) (async) 14:07:47 executing program 0: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000000)={0x5, 0x4, 0x738, 0x1, 0x1, "72c62a8e53a5ff47"}) ioctl$KDDISABIO(r0, 0x4b37) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r0, 0x0, 0x0) (async) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000000)={0x5, 0x4, 0x738, 0x1, 0x1, "72c62a8e53a5ff47"}) (async) ioctl$KDDISABIO(r0, 0x4b37) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:07:47 executing program 0: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) (async) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000000)={0x5, 0x4, 0x738, 0x1, 0x1, "72c62a8e53a5ff47"}) (async) ioctl$KDDISABIO(r0, 0x4b37) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) [ 2821.315712] __alloc_pages_nodemask+0x22c/0x2720 [ 2821.320490] ? trace_hardirqs_on+0x10/0x10 [ 2821.324723] ? deref_stack_reg+0x124/0x1a0 [ 2821.328960] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 2821.334844] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 2821.339687] ? trace_hardirqs_on+0x10/0x10 [ 2821.343923] ? deref_stack_reg+0x124/0x1a0 [ 2821.348166] ? __lock_acquire+0x5fc/0x3f20 [ 2821.352400] alloc_pages_current+0x155/0x260 [ 2821.356982] __pmd_alloc+0x37/0x3f0 [ 2821.360611] __handle_mm_fault+0x1398/0x4620 [ 2821.365020] ? __kernel_text_address+0x9/0x30 [ 2821.369516] ? vm_insert_page+0x7c0/0x7c0 [ 2821.373660] ? __save_stack_trace+0xa0/0x160 [ 2821.378077] ? mark_held_locks+0xa6/0xf0 [ 2821.382137] handle_mm_fault+0x455/0x9c0 [ 2821.386201] __do_page_fault+0x549/0xad0 [ 2821.390266] ? spurious_fault+0x640/0x640 [ 2821.394414] ? do_page_fault+0x60/0x500 [ 2821.398385] page_fault+0x25/0x50 [ 2821.401828] RIP: 0010:copy_user_generic_unrolled+0x86/0xc0 [ 2821.407429] RSP: 0018:ffff888094d47c40 EFLAGS: 00050202 [ 2821.412769] RAX: ffffed10129a8f94 RBX: 0000000000000008 RCX: 0000000000000001 [ 2821.420014] RDX: 0000000000000000 RSI: 0000000020000000 RDI: ffff888094d47c98 [ 2821.427259] RBP: 0000000020000000 R08: 0000000000000001 R09: ffffed10129a8f93 [ 2821.434505] R10: ffff888094d47c9f R11: ffff8880a15e22c0 R12: 00007ffffffff000 [ 2821.441771] R13: ffff888094d47c98 R14: 0000000020000008 R15: ffff8880aa8c1540 [ 2821.449032] _copy_from_user+0xbe/0x100 [ 2821.452990] hci_dev_cmd+0x68/0x710 [ 2821.456595] ? hci_dev_reset_stat+0x130/0x130 [ 2821.461068] ? security_capable+0x88/0xb0 [ 2821.465207] hci_sock_ioctl+0x371/0x6c0 [ 2821.469173] ? hci_sock_sendmsg+0x1d00/0x1d00 [ 2821.473646] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2821.478555] ? __handle_mm_fault+0x80f/0x4620 [ 2821.483028] ? SyS_write+0x1b7/0x210 [ 2821.485183] Bluetooth: hci3 command 0x0401 tx timeout [ 2821.486727] sock_ioctl+0x2cc/0x4c0 [ 2821.486737] ? sock_release+0x1e0/0x1e0 [ 2821.486748] do_vfs_ioctl+0x75a/0xff0 [ 2821.503306] ? lock_acquire+0x170/0x3f0 [ 2821.507278] ? ioctl_preallocate+0x1a0/0x1a0 [ 2821.511687] ? __fget+0x265/0x3e0 [ 2821.515139] ? do_vfs_ioctl+0xff0/0xff0 [ 2821.519100] ? security_file_ioctl+0x83/0xb0 [ 2821.523660] SyS_ioctl+0x7f/0xb0 [ 2821.527003] ? do_vfs_ioctl+0xff0/0xff0 [ 2821.530956] do_syscall_64+0x1d5/0x640 [ 2821.534827] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2821.539999] RIP: 0033:0x7f66aabb10e9 [ 2821.543950] RSP: 002b:00007f66a9526168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2821.551635] RAX: ffffffffffffffda RBX: 00007f66aacc3f60 RCX: 00007f66aabb10e9 [ 2821.558888] RDX: 0000000020000000 RSI: 00000000400448e0 RDI: 0000000000000004 14:07:47 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (fail_nth: 4) 14:07:47 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) bind$isdn(0xffffffffffffffff, &(0x7f0000000000)={0x22, 0x8, 0x8, 0x4, 0x2}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r2 = syz_open_pts(0xffffffffffffffff, 0x8000) ioctl$KDGKBTYPE(r2, 0x4b33, &(0x7f0000000080)) 14:07:47 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = socket$unix(0x1, 0x2, 0x0) accept4$unix(r1, &(0x7f0000000040), &(0x7f00000000c0)=0x6e, 0x80000) 14:07:47 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/79, 0x4f}], 0x1, &(0x7f0000000100)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x110}}, {{&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/242, 0xf2}, {&(0x7f00000003c0)=""/78, 0x4e}, {&(0x7f0000000440)=""/108, 0x6c}, {&(0x7f00000004c0)=""/23, 0x17}], 0x4, &(0x7f0000000540)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}}], 0x2, 0x2002, &(0x7f0000000600)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:47 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) 14:07:47 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffdd}, 0x6) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x22000, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r2, 0x89e7, &(0x7f0000000100)={0xe}) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) [ 2821.566143] RBP: 00007f66a95261d0 R08: 0000000000000000 R09: 0000000000000000 [ 2821.573400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2821.580652] R13: 00007ffc50ba1d5f R14: 00007f66a9526300 R15: 0000000000022000 14:07:47 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/79, 0x4f}], 0x1, &(0x7f0000000100)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x110}}, {{&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/242, 0xf2}, {&(0x7f00000003c0)=""/78, 0x4e}, {&(0x7f0000000440)=""/108, 0x6c}, {&(0x7f00000004c0)=""/23, 0x17}], 0x4, &(0x7f0000000540)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}}], 0x2, 0x2002, &(0x7f0000000600)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/79, 0x4f}], 0x1, &(0x7f0000000100)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x110}}, {{&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/242, 0xf2}, {&(0x7f00000003c0)=""/78, 0x4e}, {&(0x7f0000000440)=""/108, 0x6c}, {&(0x7f00000004c0)=""/23, 0x17}], 0x4, &(0x7f0000000540)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}}], 0x2, 0x2002, &(0x7f0000000600)) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:07:47 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) 14:07:47 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffdd}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x22000, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r2, 0x89e7, &(0x7f0000000100)={0xe}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffdd}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x22000, 0x0) (async) ioctl$SIOCX25SCUDMATCHLEN(r2, 0x89e7, &(0x7f0000000100)={0xe}) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) [ 2821.624879] FAULT_INJECTION: forcing a failure. [ 2821.624879] name failslab, interval 1, probability 0, space 0, times 0 [ 2821.658306] CPU: 0 PID: 17102 Comm: syz-executor.1 Not tainted 4.14.277-syzkaller #0 [ 2821.666209] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2821.675740] Call Trace: [ 2821.678330] dump_stack+0x1b2/0x281 [ 2821.681973] should_fail.cold+0x10a/0x149 [ 2821.686135] should_failslab+0xd6/0x130 [ 2821.690120] kmem_cache_alloc+0x28e/0x3c0 [ 2821.694268] __pmd_alloc+0xaf/0x3f0 [ 2821.697895] __handle_mm_fault+0x1398/0x4620 [ 2821.702303] ? __kernel_text_address+0x9/0x30 [ 2821.706969] ? vm_insert_page+0x7c0/0x7c0 [ 2821.711116] ? __save_stack_trace+0xa0/0x160 [ 2821.715530] ? mark_held_locks+0xa6/0xf0 [ 2821.719592] handle_mm_fault+0x455/0x9c0 14:07:47 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x10) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$SIOCX25GDTEFACILITIES(0xffffffffffffffff, 0x89ea, &(0x7f0000000080)) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:47 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x0, 0x0}) 14:07:47 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x0, 0x0}) [ 2821.723652] __do_page_fault+0x549/0xad0 [ 2821.727717] ? spurious_fault+0x640/0x640 [ 2821.731864] ? do_page_fault+0x60/0x500 [ 2821.735839] page_fault+0x25/0x50 [ 2821.739287] RIP: 0010:copy_user_generic_unrolled+0x86/0xc0 [ 2821.744892] RSP: 0018:ffff88807ca27c40 EFLAGS: 00050202 [ 2821.750234] RAX: ffffed100f944f94 RBX: 0000000000000008 RCX: 0000000000000001 [ 2821.757481] RDX: 0000000000000000 RSI: 0000000020000000 RDI: ffff88807ca27c98 [ 2821.764726] RBP: 0000000020000000 R08: 0000000000000001 R09: ffffed100f944f93 [ 2821.771985] R10: ffff88807ca27c9f R11: ffff88807ceb6640 R12: 00007ffffffff000 [ 2821.779241] R13: ffff88807ca27c98 R14: 0000000020000008 R15: ffff8880a182cd40 [ 2821.786506] _copy_from_user+0xbe/0x100 [ 2821.790463] hci_dev_cmd+0x68/0x710 [ 2821.794067] ? hci_dev_reset_stat+0x130/0x130 [ 2821.798656] ? security_capable+0x88/0xb0 [ 2821.802790] hci_sock_ioctl+0x371/0x6c0 [ 2821.806752] ? hci_sock_sendmsg+0x1d00/0x1d00 [ 2821.811229] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2821.816248] ? __handle_mm_fault+0x80f/0x4620 [ 2821.820733] ? SyS_write+0x1b7/0x210 [ 2821.824606] sock_ioctl+0x2cc/0x4c0 [ 2821.828214] ? sock_release+0x1e0/0x1e0 [ 2821.832185] do_vfs_ioctl+0x75a/0xff0 [ 2821.835966] ? lock_acquire+0x170/0x3f0 [ 2821.839922] ? ioctl_preallocate+0x1a0/0x1a0 [ 2821.844311] ? __fget+0x265/0x3e0 [ 2821.847750] ? do_vfs_ioctl+0xff0/0xff0 [ 2821.851706] ? security_file_ioctl+0x83/0xb0 [ 2821.856105] SyS_ioctl+0x7f/0xb0 [ 2821.859464] ? do_vfs_ioctl+0xff0/0xff0 [ 2821.863422] do_syscall_64+0x1d5/0x640 [ 2821.867293] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2821.872461] RIP: 0033:0x7f66aabb10e9 14:07:47 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (fail_nth: 5) 14:07:47 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) r1 = socket$unix(0x1, 0x2, 0x0) accept4$unix(r1, &(0x7f0000000040), &(0x7f00000000c0)=0x6e, 0x80000) 14:07:47 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x0, 0x0}) 14:07:47 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/79, 0x4f}], 0x1, &(0x7f0000000100)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x110}}, {{&(0x7f0000000240), 0x6e, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/242, 0xf2}, {&(0x7f00000003c0)=""/78, 0x4e}, {&(0x7f0000000440)=""/108, 0x6c}, {&(0x7f00000004c0)=""/23, 0x17}], 0x4, &(0x7f0000000540)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}}], 0x2, 0x2002, &(0x7f0000000600)) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:47 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x10) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) ioctl$SIOCX25GDTEFACILITIES(0xffffffffffffffff, 0x89ea, &(0x7f0000000080)) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:47 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xfffd, 0x1}, 0x6) [ 2821.876151] RSP: 002b:00007f66a9526168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2821.883837] RAX: ffffffffffffffda RBX: 00007f66aacc3f60 RCX: 00007f66aabb10e9 [ 2821.891082] RDX: 0000000020000000 RSI: 00000000400448e0 RDI: 0000000000000004 [ 2821.898339] RBP: 00007f66a95261d0 R08: 0000000000000000 R09: 0000000000000000 [ 2821.905587] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2821.912832] R13: 00007ffc50ba1d5f R14: 00007f66a9526300 R15: 0000000000022000 14:07:47 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x5, &(0x7f0000000000)=[{0x20, 0x8, 0x8, 0x1f}, {0x2d6, 0x1, 0xfb}, {0x8, 0x4, 0x6}, {0xfff9, 0x2, 0xf7}, {0xca63, 0x5, 0x1, 0x4}]}) 14:07:47 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xfffd, 0x1}, 0x6) 14:07:47 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x10) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$SIOCX25GDTEFACILITIES(0xffffffffffffffff, 0x89ea, &(0x7f0000000080)) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x10) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) ioctl$SIOCX25GDTEFACILITIES(0xffffffffffffffff, 0x89ea, &(0x7f0000000080)) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:47 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) r1 = socket$unix(0x1, 0x2, 0x0) accept4$unix(r1, &(0x7f0000000040), &(0x7f00000000c0)=0x6e, 0x80000) 14:07:47 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RSETATTR(r2, &(0x7f0000000140)={0x7, 0x1b, 0x2}, 0x7) write$apparmor_current(r1, 0x0, 0x0) ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f0000000080)={"0eba6681843469ed70d04da742198c3f076e7244418b8c958f8a2a3d42c6", 0x0, 0xfff, 0x1f, [0x6, 0x6, 0x400, 0x2, 0xffffffc0, 0x5d, 0x1f, 0xffffea66, 0x0, 0x1, 0x3, 0xac, 0x80, 0x4, 0xf8, 0x81, 0x1005, 0x3]}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2b2000, 0x0) ioctl$SNDCTL_TMR_METRONOME(r3, 0x40045407) 14:07:47 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x4, &(0x7f0000000000)=[{0x20, 0x8, 0x8, 0x1f}, {0x2d6, 0x1, 0xfb}, {0x8, 0x4, 0x6}, {0xfff9, 0x2, 0xf7}]}) [ 2821.982156] FAULT_INJECTION: forcing a failure. [ 2821.982156] name failslab, interval 1, probability 0, space 0, times 0 [ 2822.003628] CPU: 0 PID: 17146 Comm: syz-executor.1 Not tainted 4.14.277-syzkaller #0 [ 2822.011527] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2822.020992] Call Trace: [ 2822.023583] dump_stack+0x1b2/0x281 [ 2822.027222] should_fail.cold+0x10a/0x149 [ 2822.031374] should_failslab+0xd6/0x130 [ 2822.035465] kmem_cache_alloc+0x28e/0x3c0 [ 2822.039613] __anon_vma_prepare+0x5d/0x4f0 [ 2822.043853] do_huge_pmd_anonymous_page+0xd38/0x1700 [ 2822.048957] ? __lockdep_init_map+0x100/0x560 [ 2822.053455] ? prep_transhuge_page+0xa0/0xa0 [ 2822.057862] ? _raw_spin_unlock+0x29/0x40 [ 2822.062006] ? __pmd_alloc+0x27f/0x3f0 [ 2822.065885] __handle_mm_fault+0x2ac4/0x4620 [ 2822.070287] ? __kernel_text_address+0x9/0x30 [ 2822.074778] ? vm_insert_page+0x7c0/0x7c0 [ 2822.078922] ? __save_stack_trace+0xa0/0x160 [ 2822.083338] ? mark_held_locks+0xa6/0xf0 [ 2822.087400] handle_mm_fault+0x455/0x9c0 [ 2822.091472] __do_page_fault+0x549/0xad0 [ 2822.095529] ? spurious_fault+0x640/0x640 [ 2822.099668] ? do_page_fault+0x60/0x500 [ 2822.103628] page_fault+0x25/0x50 [ 2822.107062] RIP: 0010:copy_user_generic_unrolled+0x86/0xc0 [ 2822.112663] RSP: 0018:ffff88807ccafc40 EFLAGS: 00050202 [ 2822.118034] RAX: ffffed100f995f94 RBX: 0000000000000008 RCX: 0000000000000001 [ 2822.125281] RDX: 0000000000000000 RSI: 0000000020000000 RDI: ffff88807ccafc98 [ 2822.132554] RBP: 0000000020000000 R08: 0000000000000001 R09: ffffed100f995f93 [ 2822.139799] R10: ffff88807ccafc9f R11: ffff888092304140 R12: 00007ffffffff000 [ 2822.147043] R13: ffff88807ccafc98 R14: 0000000020000008 R15: ffff8880b4e80a00 [ 2822.154365] _copy_from_user+0xbe/0x100 [ 2822.158318] hci_dev_cmd+0x68/0x710 [ 2822.161924] ? hci_dev_reset_stat+0x130/0x130 [ 2822.166394] ? security_capable+0x88/0xb0 [ 2822.170519] hci_sock_ioctl+0x371/0x6c0 [ 2822.174476] ? hci_sock_sendmsg+0x1d00/0x1d00 [ 2822.178956] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2822.183873] ? __handle_mm_fault+0x80f/0x4620 [ 2822.188356] ? SyS_write+0x1b7/0x210 [ 2822.192055] sock_ioctl+0x2cc/0x4c0 [ 2822.195660] ? sock_release+0x1e0/0x1e0 [ 2822.199624] do_vfs_ioctl+0x75a/0xff0 [ 2822.203408] ? lock_acquire+0x170/0x3f0 [ 2822.207373] ? ioctl_preallocate+0x1a0/0x1a0 [ 2822.211760] ? __fget+0x265/0x3e0 [ 2822.215196] ? do_vfs_ioctl+0xff0/0xff0 [ 2822.219325] ? security_file_ioctl+0x83/0xb0 [ 2822.223711] SyS_ioctl+0x7f/0xb0 [ 2822.227055] ? do_vfs_ioctl+0xff0/0xff0 [ 2822.231035] do_syscall_64+0x1d5/0x640 [ 2822.234910] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2822.240078] RIP: 0033:0x7f66aabb10e9 [ 2822.243762] RSP: 002b:00007f66a9526168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2822.251447] RAX: ffffffffffffffda RBX: 00007f66aacc3f60 RCX: 00007f66aabb10e9 [ 2822.258695] RDX: 0000000020000000 RSI: 00000000400448e0 RDI: 0000000000000004 [ 2822.265943] RBP: 00007f66a95261d0 R08: 0000000000000000 R09: 0000000000000000 [ 2822.273190] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 14:07:48 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (fail_nth: 6) 14:07:48 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x3, &(0x7f0000000000)=[{0x20, 0x8, 0x8, 0x1f}, {0x2d6, 0x1, 0xfb}, {0x8, 0x4, 0x6}]}) 14:07:48 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) getpeername$unix(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x6e) 14:07:48 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RSETATTR(r2, &(0x7f0000000140)={0x7, 0x1b, 0x2}, 0x7) write$apparmor_current(r1, 0x0, 0x0) ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f0000000080)={"0eba6681843469ed70d04da742198c3f076e7244418b8c958f8a2a3d42c6", 0x0, 0xfff, 0x1f, [0x6, 0x6, 0x400, 0x2, 0xffffffc0, 0x5d, 0x1f, 0xffffea66, 0x0, 0x1, 0x3, 0xac, 0x80, 0x4, 0xf8, 0x81, 0x1005, 0x3]}) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2b2000, 0x0) ioctl$SNDCTL_TMR_METRONOME(r3, 0x40045407) 14:07:48 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xfffd, 0x1}, 0x6) 14:07:48 executing program 2: r0 = syz_init_net_socket$ax25(0x3, 0x5, 0xcc) ioctl$SIOCAX25NOUID(r0, 0x89e3, &(0x7f0000000280)=0x1) getresuid(&(0x7f0000000140)=0x0, &(0x7f0000000180), &(0x7f0000000080)) ioctl$SIOCAX25ADDUID(r0, 0x89e1, &(0x7f0000000200)={0x3, @default, r1}) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r2, 0x0, 0x0) getsockname$ax25(r2, &(0x7f0000000300)={{0x3, @default}, [@netrom, @default, @bcast, @rose, @null, @default, @remote, @rose]}, &(0x7f0000000000)=0x48) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getpeername$ax25(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_ax25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000480)={@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) ioctl$SIOCAX25GETUID(r0, 0x89e0, &(0x7f0000000240)={0x3, @bcast, r1}) bind$bt_hci(r4, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_ax25_SIOCDELRT(r2, 0x890c, &(0x7f0000000400)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, 0x8, [@bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) setsockopt$bt_hci_HCI_TIME_STAMP(r5, 0x0, 0x3, &(0x7f00000002c0)=0x8, 0x4) r6 = accept$ax25(r2, 0x0, &(0x7f0000000100)) bind$ax25(r6, &(0x7f0000000380)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x7}, [@default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) [ 2822.280437] R13: 00007ffc50ba1d5f R14: 00007f66a9526300 R15: 0000000000022000 14:07:48 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x2, &(0x7f0000000000)=[{0x20, 0x8, 0x8, 0x1f}, {0x2d6, 0x1, 0xfb}]}) 14:07:48 executing program 2: r0 = syz_init_net_socket$ax25(0x3, 0x5, 0xcc) ioctl$SIOCAX25NOUID(r0, 0x89e3, &(0x7f0000000280)=0x1) (async) getresuid(&(0x7f0000000140)=0x0, &(0x7f0000000180), &(0x7f0000000080)) ioctl$SIOCAX25ADDUID(r0, 0x89e1, &(0x7f0000000200)={0x3, @default, r1}) (async) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r2, 0x0, 0x0) (async) getsockname$ax25(r2, &(0x7f0000000300)={{0x3, @default}, [@netrom, @default, @bcast, @rose, @null, @default, @remote, @rose]}, &(0x7f0000000000)=0x48) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getpeername$ax25(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) ioctl$sock_ax25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000480)={@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) (async, rerun: 32) ioctl$SIOCAX25GETUID(r0, 0x89e0, &(0x7f0000000240)={0x3, @bcast, r1}) (async) bind$bt_hci(r4, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async, rerun: 32) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) ioctl$sock_ax25_SIOCDELRT(r2, 0x890c, &(0x7f0000000400)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, 0x8, [@bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r5, 0x0, 0x3, &(0x7f00000002c0)=0x8, 0x4) (async) r6 = accept$ax25(r2, 0x0, &(0x7f0000000100)) bind$ax25(r6, &(0x7f0000000380)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x7}, [@default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:48 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x1, &(0x7f0000000000)=[{0x20, 0x8, 0x8, 0x1f}]}) 14:07:48 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RSETATTR(r2, &(0x7f0000000140)={0x7, 0x1b, 0x2}, 0x7) write$apparmor_current(r1, 0x0, 0x0) ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f0000000080)={"0eba6681843469ed70d04da742198c3f076e7244418b8c958f8a2a3d42c6", 0x0, 0xfff, 0x1f, [0x6, 0x6, 0x400, 0x2, 0xffffffc0, 0x5d, 0x1f, 0xffffea66, 0x0, 0x1, 0x3, 0xac, 0x80, 0x4, 0xf8, 0x81, 0x1005, 0x3]}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2b2000, 0x0) ioctl$SNDCTL_TMR_METRONOME(r3, 0x40045407) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) pipe2$9p(&(0x7f0000000100), 0x800) (async) write$P9_RSETATTR(r2, &(0x7f0000000140)={0x7, 0x1b, 0x2}, 0x7) (async) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$SNDCTL_MIDI_INFO(r1, 0xc074510c, &(0x7f0000000080)={"0eba6681843469ed70d04da742198c3f076e7244418b8c958f8a2a3d42c6", 0x0, 0xfff, 0x1f, [0x6, 0x6, 0x400, 0x2, 0xffffffc0, 0x5d, 0x1f, 0xffffea66, 0x0, 0x1, 0x3, 0xac, 0x80, 0x4, 0xf8, 0x81, 0x1005, 0x3]}) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x2b2000, 0x0) (async) ioctl$SNDCTL_TMR_METRONOME(r3, 0x40045407) (async) 14:07:48 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) getpeername$unix(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x6e) 14:07:48 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000000)={0x2e, 0x80000001, 0x9, 0x8}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r2 = socket$nl_rdma(0x10, 0x3, 0x14) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SFACILITIES(r3, 0x89e3, &(0x7f0000000340)={0x68, 0x391f98e8, 0xb, 0x6, 0x220b7963}) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x18, 0x1411, 0x10, 0x70bd26, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x3}]}, 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x8080) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r5, 0x89e7, &(0x7f0000000300)={0x41}) write$apparmor_current(r4, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x500400}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="4800000011140100a7bd7000ffdbdf2508003e000000000008004b003b00000008004a000000000008004f0004000000080035c0e788000008004a000200"/72], 0x48}, 0x1, 0x0, 0x0, 0xc4}, 0x4000081) [ 2822.400242] FAULT_INJECTION: forcing a failure. [ 2822.400242] name failslab, interval 1, probability 0, space 0, times 0 [ 2822.418892] CPU: 0 PID: 17195 Comm: syz-executor.1 Not tainted 4.14.277-syzkaller #0 [ 2822.426795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2822.436141] Call Trace: [ 2822.438720] dump_stack+0x1b2/0x281 [ 2822.442334] should_fail.cold+0x10a/0x149 [ 2822.446466] should_failslab+0xd6/0x130 [ 2822.450428] kmem_cache_alloc+0x28e/0x3c0 [ 2822.454557] __anon_vma_prepare+0x2bc/0x4f0 [ 2822.458861] do_huge_pmd_anonymous_page+0xd38/0x1700 [ 2822.463941] ? __lockdep_init_map+0x100/0x560 [ 2822.468412] ? prep_transhuge_page+0xa0/0xa0 [ 2822.472795] ? _raw_spin_unlock+0x29/0x40 [ 2822.476922] ? __pmd_alloc+0x27f/0x3f0 [ 2822.480785] __handle_mm_fault+0x2ac4/0x4620 [ 2822.485169] ? __kernel_text_address+0x9/0x30 [ 2822.489640] ? vm_insert_page+0x7c0/0x7c0 [ 2822.493762] ? __save_stack_trace+0xa0/0x160 [ 2822.498151] ? mark_held_locks+0xa6/0xf0 [ 2822.502200] handle_mm_fault+0x455/0x9c0 [ 2822.506508] __do_page_fault+0x549/0xad0 [ 2822.510547] ? spurious_fault+0x640/0x640 [ 2822.514670] ? do_page_fault+0x60/0x500 [ 2822.518624] page_fault+0x25/0x50 [ 2822.522054] RIP: 0010:copy_user_generic_unrolled+0x86/0xc0 [ 2822.527649] RSP: 0018:ffff88807ccafc40 EFLAGS: 00050202 [ 2822.532986] RAX: ffffed100f995f94 RBX: 0000000000000008 RCX: 0000000000000001 [ 2822.540232] RDX: 0000000000000000 RSI: 0000000020000000 RDI: ffff88807ccafc98 [ 2822.547481] RBP: 0000000020000000 R08: 0000000000000001 R09: ffffed100f995f93 [ 2822.554723] R10: ffff88807ccafc9f R11: ffff88809d11a480 R12: 00007ffffffff000 [ 2822.561970] R13: ffff88807ccafc98 R14: 0000000020000008 R15: ffff8880b46510c0 [ 2822.569233] _copy_from_user+0xbe/0x100 [ 2822.573183] hci_dev_cmd+0x68/0x710 [ 2822.576784] ? hci_dev_reset_stat+0x130/0x130 [ 2822.581257] ? security_capable+0x88/0xb0 [ 2822.585381] hci_sock_ioctl+0x371/0x6c0 [ 2822.589419] ? hci_sock_sendmsg+0x1d00/0x1d00 [ 2822.593893] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2822.598804] ? __handle_mm_fault+0x80f/0x4620 [ 2822.603280] ? SyS_write+0x1b7/0x210 [ 2822.606968] sock_ioctl+0x2cc/0x4c0 [ 2822.610571] ? sock_release+0x1e0/0x1e0 [ 2822.614523] do_vfs_ioctl+0x75a/0xff0 [ 2822.618307] ? lock_acquire+0x170/0x3f0 [ 2822.622264] ? ioctl_preallocate+0x1a0/0x1a0 [ 2822.626656] ? __fget+0x265/0x3e0 [ 2822.630086] ? do_vfs_ioctl+0xff0/0xff0 [ 2822.634035] ? security_file_ioctl+0x83/0xb0 [ 2822.638418] SyS_ioctl+0x7f/0xb0 [ 2822.641757] ? do_vfs_ioctl+0xff0/0xff0 [ 2822.645708] do_syscall_64+0x1d5/0x640 [ 2822.649577] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2822.654742] RIP: 0033:0x7f66aabb10e9 [ 2822.658426] RSP: 002b:00007f66a9526168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2822.666119] RAX: ffffffffffffffda RBX: 00007f66aacc3f60 RCX: 00007f66aabb10e9 [ 2822.673364] RDX: 0000000020000000 RSI: 00000000400448e0 RDI: 0000000000000004 [ 2822.680605] RBP: 00007f66a95261d0 R08: 0000000000000000 R09: 0000000000000000 [ 2822.687851] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 14:07:48 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (fail_nth: 7) 14:07:48 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)) 14:07:48 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) write$bt_hci(r2, &(0x7f0000000100)=ANY=[@ANYRES32=r1], 0x7) write$bt_hci(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="01450446ffffffffffff29477cce4447a38498dcca7d5a7ebc788f59b7dc1803b38680a17376a9338aad1955cb4e465a543638b4e6616d343cc12d1cda7f147b4e36ba87daacbdff7a8a"], 0x4a) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0x8000, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r4, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r4, 0x0, 0x3, &(0x7f00000001c0)=0x6, 0x4) ioctl$SNDCTL_FM_4OP_ENABLE(r3, 0x4004510f, &(0x7f0000000180)=0x1000) 14:07:48 executing program 2: r0 = syz_init_net_socket$ax25(0x3, 0x5, 0xcc) ioctl$SIOCAX25NOUID(r0, 0x89e3, &(0x7f0000000280)=0x1) getresuid(&(0x7f0000000140)=0x0, &(0x7f0000000180), &(0x7f0000000080)) ioctl$SIOCAX25ADDUID(r0, 0x89e1, &(0x7f0000000200)={0x3, @default, r1}) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r2, 0x0, 0x0) getsockname$ax25(r2, &(0x7f0000000300)={{0x3, @default}, [@netrom, @default, @bcast, @rose, @null, @default, @remote, @rose]}, &(0x7f0000000000)=0x48) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getpeername$ax25(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_ax25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000480)={@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) ioctl$SIOCAX25GETUID(r0, 0x89e0, &(0x7f0000000240)={0x3, @bcast, r1}) bind$bt_hci(r4, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_ax25_SIOCDELRT(r2, 0x890c, &(0x7f0000000400)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, 0x8, [@bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) setsockopt$bt_hci_HCI_TIME_STAMP(r5, 0x0, 0x3, &(0x7f00000002c0)=0x8, 0x4) r6 = accept$ax25(r2, 0x0, &(0x7f0000000100)) bind$ax25(r6, &(0x7f0000000380)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x7}, [@default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$ax25(0x3, 0x5, 0xcc) (async) ioctl$SIOCAX25NOUID(r0, 0x89e3, &(0x7f0000000280)=0x1) (async) getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f0000000080)) (async) ioctl$SIOCAX25ADDUID(r0, 0x89e1, &(0x7f0000000200)={0x3, @default, r1}) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) getpeername$ax25(r2, 0x0, 0x0) (async) getsockname$ax25(r2, &(0x7f0000000300)={{0x3, @default}, [@netrom, @default, @bcast, @rose, @null, @default, @remote, @rose]}, &(0x7f0000000000)=0x48) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) getpeername$ax25(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$sock_ax25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000480)={@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) (async) ioctl$SIOCAX25GETUID(r0, 0x89e0, &(0x7f0000000240)={0x3, @bcast, r1}) (async) bind$bt_hci(r4, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_ax25_SIOCDELRT(r2, 0x890c, &(0x7f0000000400)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, 0x8, [@bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r5, 0x0, 0x3, &(0x7f00000002c0)=0x8, 0x4) (async) accept$ax25(r2, 0x0, &(0x7f0000000100)) (async) bind$ax25(r6, &(0x7f0000000380)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x7}, [@default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:48 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000000)={0x2e, 0x80000001, 0x9, 0x8}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r2 = socket$nl_rdma(0x10, 0x3, 0x14) (async, rerun: 64) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) (rerun: 64) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SFACILITIES(r3, 0x89e3, &(0x7f0000000340)={0x68, 0x391f98e8, 0xb, 0x6, 0x220b7963}) (async) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x18, 0x1411, 0x10, 0x70bd26, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x3}]}, 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x8080) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r5, 0x89e7, &(0x7f0000000300)={0x41}) (async) write$apparmor_current(r4, 0x0, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x500400}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="4800000011140100a7bd7000ffdbdf2508003e000000000008004b003b00000008004a000000000008004f0004000000080035c0e788000008004a000200"/72], 0x48}, 0x1, 0x0, 0x0, 0xc4}, 0x4000081) 14:07:48 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) getpeername$unix(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x6e) [ 2822.695095] R13: 00007ffc50ba1d5f R14: 00007f66a9526300 R15: 0000000000022000 14:07:48 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) (async) write$bt_hci(r2, &(0x7f0000000100)=ANY=[@ANYRES32=r1], 0x7) (async) write$bt_hci(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="01450446ffffffffffff29477cce4447a38498dcca7d5a7ebc788f59b7dc1803b38680a17376a9338aad1955cb4e465a543638b4e6616d343cc12d1cda7f147b4e36ba87daacbdff7a8a"], 0x4a) (async) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0x8000, 0x0) (async) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r4, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r4, 0x0, 0x3, &(0x7f00000001c0)=0x6, 0x4) (async) ioctl$SNDCTL_FM_4OP_ENABLE(r3, 0x4004510f, &(0x7f0000000180)=0x1000) 14:07:48 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)) 14:07:48 executing program 0: recvmmsg$unix(0xffffffffffffffff, &(0x7f00000016c0)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000001380)=[{&(0x7f0000000100)=""/69, 0x45}, {&(0x7f0000000180)=""/4096, 0x1000}, {&(0x7f0000001180)}, {&(0x7f00000011c0)=""/171, 0xab}, {&(0x7f0000001280)=""/202, 0xca}], 0x5, &(0x7f0000001400)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000001440), 0x6e, &(0x7f0000001540)=[{&(0x7f00000014c0)=""/84, 0x54}], 0x1, &(0x7f0000001780)=ANY=[@ANYBLOB="28000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000bc5d58f000000010000007bd83b40d55c74ae522a2b76327d0f5f1fe0d70ea0cc8068403cd6938ebada0437773664f2dcf44241d387b2a8a9b517c4e67710e51445bb3d6fbe79679786f048dda098e81d667d82260fb69d37247018df80e09bba407a5220a3ad1cd04c3fe56f3a4ce3c2ccf817648da659d767a7a9f784db68e56cdd046459", @ANYRES32, @ANYRES32, @ANYBLOB="1c0000000000000001f83d6ea000689f", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x130}}], 0x2, 0x0, &(0x7f0000001740)) r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000001180), 0x42a142) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000001580)={0x0}) r2 = socket$unix(0x1, 0x5, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000001a00)=ANY=[@ANYBLOB="a6a0e446edf62846552a5826bca456f998aea847cc46be93f785d03b94bba230ca"], 0x7) ioctl$sock_bt_hci(r3, 0x400448dd, &(0x7f0000001940)="5cd99aae58db6873c305ad47e8dddc465323e8dfaa9a8fa74098ca9119f8b018a49f6465997960a67f0d4a398c227f53700b58787ab421137328f1ec8611bde21c9056929e9e3f44e9522b8b7132dfc2f9bc8bc7c720ae79c4ee89dec34e31fd31dcd1bd6a84e548230008105d87e0ef9e6474b4e607911ae361409e54dd94b08819c7e6108a40bf82517dcd6407be4c6de5bea42508d81b57aeb6dae9") recvmsg$unix(r2, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000001600)={r1, 0x1, r2, 0x9, 0x80000}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000001640)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000001680)={0x0, 0x0, r4}) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000040)={0x6d, [0x897, 0x3], 0x79}, 0x10) 14:07:48 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) write$bt_hci(r2, &(0x7f0000000100)=ANY=[@ANYRES32=r1], 0x7) write$bt_hci(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="01450446ffffffffffff29477cce4447a38498dcca7d5a7ebc788f59b7dc1803b38680a17376a9338aad1955cb4e465a543638b4e6616d343cc12d1cda7f147b4e36ba87daacbdff7a8a"], 0x4a) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0x8000, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r4, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r4, 0x0, 0x3, &(0x7f00000001c0)=0x6, 0x4) ioctl$SNDCTL_FM_4OP_ENABLE(r3, 0x4004510f, &(0x7f0000000180)=0x1000) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) (async) write$bt_hci(r2, &(0x7f0000000100)=ANY=[@ANYRES32=r1], 0x7) (async) write$bt_hci(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="01450446ffffffffffff29477cce4447a38498dcca7d5a7ebc788f59b7dc1803b38680a17376a9338aad1955cb4e465a543638b4e6616d343cc12d1cda7f147b4e36ba87daacbdff7a8a"], 0x4a) (async) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140), 0x8000, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r4, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r4, 0x0, 0x3, &(0x7f00000001c0)=0x6, 0x4) (async) ioctl$SNDCTL_FM_4OP_ENABLE(r3, 0x4004510f, &(0x7f0000000180)=0x1000) (async) 14:07:48 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e7, &(0x7f0000000100)="fa32a4bc79b58799a70ebbc6e270d92a94442f1f8dffd31d6c4a2c39b8faeaa81332110cddd7353ca65ad44542d8aac77bf643755d68fc083a003b30adf9b4f625b119595ac23e5e2f4d5e662b6bcb6b900065886d12778c964b5dc131fc5dc58300426d39a5eb22b6ec12c8d781ddf72d5e2ecce1124bbc9706047649cae9056205d2a6966072be0742b9a54fa73218c64c376d2558db42e475b8add3f2438d5b8e7043fb018c96f0cb77f5b3d7f3f7f1a76696a4d55b0bd1ad9b5df30ec1550887ee76c9346608352945fec16ff612aa679567496655f4bdf355b4da8db8cb1d0a773c747596f62824728630b176a7a7725dbfa1a95ceac91337647c78ac0d9417ba7115ce6f7bfac73c1774b77fa5846681da083521fb79d5f0460593abd1c51b8d2b2359fc81522365672d44e88c8d87ac96654665ecda96e38388bc7a295affdb3e162fde00caada35fea6aa6f53cd5e77eba659e14df4047214bc98cacbe1d26c843d9468540d757dbe3fe2cf7b05baf8bcdb192ac6d73844f36ba172017e73281efc4fafaae3c9e0bafe8d2b20c85283bd7874442deb6a1d5711790bab6857d94e4a3ce6d0e4f79cdcd7345bc0e9463f3ff5a5a964a0f7dfa657a266a578fd6163c8431bef2442c82b6914490f1e926ecb091fe0525749b4b4f6523a829f909c3f4f56f4ce96953c797769a762dc86bc2611e528eb55c170d6cd0438f003a3008c3b915f894d4a15583878c1ae969983cfd008a94f86bb58aa175fdd4188d67291a73281fb6a2f15220c80244547cd69032de8935f30bd092626d89c262d8a59debc6741202ef5d3d99864107216725da8dd9bc1056b6fed647e683a028e091613342ff46229b07299224f320f1ed3cb3c716f7b3cf6c1010d5cda6402ac2678c6302ed380742b9c628e18293165a5d8feaeccc34faea6c4c0463def86426de82fe15e5738f3d1dcc403d8221bb1b0eeba65b3065b86c10aaca2b38c9bd51029c98eb7d11825dd8547c427153c8855cb8298841c8c5f7bb754ca097a696c38fbc4c23500647de19eaf3827de9f560662f1bd03853c2a21727b9da04f5059d0c66c4eeb4435a2d51cbe45fc7343666d1d5de1ec4e6a53031946444dc95a1d7e062716309bfbe3d6a76f99787a73caef5b1907067e5120c57ccdfd994204fcbb84b05c9d4b25965910144d8153135bf98474747b03d253a53dab64693d61fdbd83ba9fd54b7d893cd728dc68c0707a9bb9a97553e781b13e10cbd3df5b93b7e185f0dc4984ad635d43e54be5a34c7d658cdd3c8eec7cfeac54183a30bdc92f29974bec8ec96e19e4957b6aa591bcd4ca499e89d2ac5b4d65e6895cce9403fe1e452c5ede1703c1047f3a8f723e9246cdccf4d2a98ea8407ac0e0f9362883bfb074b7c2382ef0464026a5e1e53a42cbeff664490652fbce9b38b02843d336f73f44bd3ea3d46a33b6fe59aff96128a68910bc01e85ff53d728b6450bca1ec40c7d0d590fddb72bd1b2e826a8d5cd7ec8c391f36f692e345989b9dc1c40b1a14572eaa600bc514f66d3ee427a50c1e9ba8e1a6958588a0e7072fdd18767156c66c85b005c3f4412c690d76243607c3fb718d63c33914c228d1d6fe88a9aa5956ed3d60dbf75f51b0c6602d5c0824a35120f4b3e97f98b55a7c736abde81bc0c6c74439347daf1b72d285fc7c5aa2c43b8cc264d7bd9424de075903e394b81fc5faed8dce7e34d60bbfff08d89edda2d7c95ac68bda0b1dd4d201cc14f374dab8cf840d13b639f2d3eced5ef912779e3998af23848587dd971b006ce3d16b8ca0a41fe7b2904f46cd9b5f4c884a6f84f7e5e9ba6034ff6b2b3e53a10d3c954638c0029f73d2f085c2b2ca4f8b65f93a420c4a7959ad8a2aee647fe89bd4f6c910d8510b44376b10d4d447c3b5a06361108758dbade547ff4668d8dc84770565ff52053091e9cb2b75f3c575d99bc9d7c3d3ba779c543e474445bf41b3ed802542019893a45f34f8a8c0416076f32d6538a1f644674a5870172d846dc69e0d116ee5d1514124952f0e7a80c0ec00fb77ca4b4bb8b4385002c0b08dfa55b9bc9071cf47523a132b2d51b530356ca40532bb7f9452d1a60ff6042c8bd2e8343295946dca270010776e6b18b75db1b83fe230459cc08bf03328af27f5178fa6db96b7c0e49ba24df3a1c22c867b12758e3056fa4299ba5eeb8cacb424bc1b1c5e5da34d0248888738c06f9a78e3133bceec0405c53548f28b40f093a3c385b3f9a8eac6c41ca188add06b151a51cdd617b2a9073c9a11973329ac0d94701788d76a905534878f825f7ba644b288d5f5afabef101e0718e1df08adf15816227b881aaf94b95b7567c6eb6262c819df10c56ca18b10df9a37427a91346e0334720d31cc575c66503c6f4eed4601bc02c2bc98ba409c66d6c9d57c363e4799376d67b1d4500b418ca8897c7bce26a2205d8db801ff230a9b5ee5540f38a3b8df16fd5c2ff8e0604a20f7b0cc7459d7db1cd793b68911a39698c5d1daee837535cd8906b9748ec13e3b1ba5fb25147172227b17238a35cc594672d1a91b306a0fda9544289e13ac07ff34f73cabccfd5ae8cf3616fe039e1293951d9271669dd6880687ab9812d8eb72f55f2ddde2acd5fd52334199ea48a2395634fb6b81fe333952c866b8eeff2a50ddf0c50b5a1cba771ddf408a1f94cc7eed7aba09e5bfb56b3be87c41af81ea196791cb6840e38c1ba5ca26fa0e0308ff92b55fd25b63fec5d9d64502865516f558175ee90813a397d32db92532fa5b982ba5a7b62286330828bbfabf812e50a1e54b6ffba4213505aae66454e6d0de2ea1352b959ed79795baffddb22b1fea9fa082dfb9aa92d769c0579e2440991abc0c8c360e163d47baa2a10eee50d21075d82e368987da52c83bc7d44c6baf7f8631455341f53d33099e3ddc56791f7a3b2ec2fcd66aec6fef7473d486d940ad1e150d40c3cf8759b717e54913b87eb5318d8e5393d12513ae9a01f02659cf2856166a46cd38589ed91e9b947722f56253b19419f426259c9695db186181e6a463c179b9b2a952a95e15dd8ab4f9b7652918c4b12c52c2981c053f5d1532fcf8fb74473fee4186f884656a68356f2bc6a775c49090eb06bf8ba6dffdca6a34193a067882ed819ca7fc4a2ef424e3691fac8b027382edacb27cab13d1ea6a3ef88bd2b417cc08c69a103faa834cc801d6acbd1be4b04eea4d0f6ca662308a34eefb551d245ada8a2d1eac4af8d28253dd9cc94e589d5a8c9d8419e19e54e00ce4e32270e88715feb12c9da7fe0293f4e6dcedf319a35d36b9eb831ab99a8d2b4fd7b8e6c4fc097577cec4d8730d3a922fb41b712d39a42fd18aaed8a1bd7d9049c2091144dcb574cbbc646beceeb9cf04e5ef1d13cb4c0996d9e4c496b99ba46794ced8b79439e28ed31977843391fbe67ef915a4ee2aba6a98830d1a2671e7025de84eebbf3fe0e52bb112d1de7bd0c37101fbf2d7f11a726b79b48846180c01c3f9b9062a7b33a8e8e1ebcb695c6877529ccedf3bdc70c6f8ca4ae3ff7ef01396ca6a42fd928279316a25ddebd029f463b7bb30697b8aa0b387d165fb8dab9df2528742eece51f34c9221f6349bee23b4d53b5236e13f912266c399e1daa607656fe7077dd054d825afcf995477764fed1bde6ba808445f5311e907e9b6b539f8021988a87af4dc64db50dcd4ba67bae05a98a07f8ed0ef481662fcc3a6554e3c40518f4376fbda842bbdb6f28f8e0621f04f9accb7084cf77448a8489e2945363b326f08f87f033517b12b1fd915df9657bbaf2280a9c1f346fe0e6d743f0a0b8c49d964757461728dcc20c29537289fdc4be2ccd4439f7f2da1492b9d9436e9eb48c92b209ff381070e3bbb3b8a5fc35803bd3c5007da4ec3fa4d4d4ff0cc38cc4681889e75dedcd654ffddb6e4293c5b7b86a5c03aae7e70c73b10d8c91568aaf7a971e0640f061de006d527545313b6e3183de57dddaa1c9ffc6078b5283a3d5818d3c3892bdb416af87d4afa529267d369f52a82d1834981ba03836ff212a133aa746ea2548f0d9535cffb8d51e713f6c9d792c7f4491b4d915719a963000d7ee37af9bbef9b830f358f2773e2077a98fee9d0048ff465ca02a70f746138a2e8d6b0cb7834ea9f625b3c4d74f6332944e5bc4fa26a864fc15ba83b18ed988d2ca7a8a8086896dbc9fb38ffa3f3258cb9838d9446ff105b2f899e62eef931a1112898419ff003db0a8ff2ea928a15f70f140534c779e855adb7d75fa32f2e9c1fa7e72edeeae3b6582def39366fc54e7124bc32f91e61d9e07b61c4c932117b473ab696a5565f914295b6e1ac4a2764adcfaa9c52df78caa6361ed129184ccccd1d83619e66cf85e80948c8e007b5091c93f5549a81f626255a777d6e811d0cbad10c7793b44ba9276d8a2d87d3a9dde19d15ff1f55ec507390c37b897fa46e56d588299604966b01722d454d6e384b5fb5d4aa8ade565f1ce110352ee951fe7206cf3ea83a3fc40f1e8a1d4f618d171e80eef52acb46d3a75c11e1777d084cb1fd60a11c1745e71ca6160fe60938212dac368987407f09d88da18e4dd033770bfcfa897edb2ace0222191c7900f9814beddf909e87644c83532e1c3fd8b54856180c8437fc819970bd90ed3f4976da4b323880f0d221d1b4b5a22e4341fc0f27d59a20a47b9c3dfab31098ed590e5d6e140f0a26148400da6e334b188625702dc8e04a9fe3e686f65171a930fc70507a096d9b3bed3ab9d32559399528d40b8a95227b2367684b1603115b969aec988360913726022502d438465342e08e9177638d7a0e2563cc5748b827ce9d36977684cb06073021365771fad27d879b806433795dc6661fb1579a2c1a87c1513568673142103b83b18e12a1fa1f6202b0b182ff8159a9d8ec0977479f435e80ff16899028a56522838873bfcf72f616b7149895e27912d38e3f57a51560454adc65e5cd0f096330f4c0a9318d8db1b3e257fcb947d57926d6a7bf90930273020a3e1257beeece3c52f518f8b9cac7c6a381f3da30e997adfbdcfdb5461168cea582b579e12fb4c6cbb79925ff922f0a2f75f655af0a39ff9e90dd58d5d53e8d2484330da7b47849844eddb124c85f88800851283c762fa382e7b26e8fa95a67452046d81b89854148b687c7da8db81633c349f7469d85a367988b29e29d6a552c6121ffe04986e00a027629e1401b6a03a509e6696cc6b6093fa03adaea3810a824598803efcc8c450bcf178a9ba4ce1c0664eec5065bd4ab2f183029cdc93ff44dc7721ee7360a4c7cdce2d11ee7ccd7d4aeb3262d4bc03405a5c8fd2dab41666ce93320c0cf61f06f5f8cd40eb233cce335247539393740035ac670ef0ac8c26336f1d4131c5cce22b9a108101acfc3f79ec373d634b558f91b28eec2f2f8e44fb87d5181689176798e7bf32654efcaa28d4ee8bc5a72d8fdc0a59f009ba0460d5596f4266e7672f1bee998ae9a86e33c80c745a44611ba41dfbae06e4f39c3c230d2291ea801683889d0a1c195699f2aca778c9725b34c0bd720b5239c057447c2442d6b21867dd5cbd64278c2da82f5416c8fc4300de66b742f6addb07bd40d029522469780892e98d9cff3be3e1b4d46c4bb7b480792582d1abe25883d517ca79c14d72b5eb8d3656b731a4c6ab757db4180345b02619534f4b17e557f335c9fa4ba565e8227a5f0884674b93ba5a9e6470996e070b99a9b6a14a55fe79c34147734b0ccfab552a544d5e2f1bb8a4562c84b8dfbf8664") r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$unix(0x1, 0x1, 0x0) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x4}, 0xfffffffffffffeaf) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) sendto$unix(0xffffffffffffffff, &(0x7f0000001100)="43fb603d0a906d33a8985b834f2cbb7ac71cbb0cc93ee55fddfe21a903afc4494bb97315de17ad531c6b2d42dbb8b6aad614e575ab0275b2e91bb70f5f75ec5f2f921080db44cb42c98e7ba66407435354f0b51ea1a684b9d1", 0x59, 0x4000800, &(0x7f0000001180)=@abs={0x1, 0x0, 0x4e23}, 0x6e) 14:07:48 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)) [ 2822.768955] FAULT_INJECTION: forcing a failure. [ 2822.768955] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2822.824788] CPU: 1 PID: 17218 Comm: syz-executor.1 Not tainted 4.14.277-syzkaller #0 [ 2822.832791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2822.842145] Call Trace: [ 2822.844731] dump_stack+0x1b2/0x281 [ 2822.848358] should_fail.cold+0x10a/0x149 [ 2822.852506] __alloc_pages_nodemask+0x22c/0x2720 [ 2822.857260] ? do_vfs_ioctl+0x75a/0xff0 [ 2822.861233] ? SyS_ioctl+0x7f/0xb0 [ 2822.864769] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2822.870131] ? trace_hardirqs_on+0x10/0x10 [ 2822.874356] ? SyS_ioctl+0x7f/0xb0 [ 2822.877879] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 2822.882700] ? trace_hardirqs_on+0x10/0x10 [ 2822.886918] ? __anon_vma_prepare+0x28f/0x4f0 [ 2822.891476] ? lock_acquire+0x170/0x3f0 [ 2822.895519] ? lock_downgrade+0x740/0x740 [ 2822.899656] ? anon_vma_interval_tree_insert+0x20a/0x3c0 [ 2822.905089] alloc_pages_current+0x155/0x260 [ 2822.909486] pte_alloc_one+0x15/0x100 [ 2822.913263] do_huge_pmd_anonymous_page+0x500/0x1700 [ 2822.918341] ? __lockdep_init_map+0x100/0x560 [ 2822.922815] ? prep_transhuge_page+0xa0/0xa0 [ 2822.927200] ? _raw_spin_unlock+0x29/0x40 [ 2822.931323] ? __pmd_alloc+0x27f/0x3f0 [ 2822.935201] __handle_mm_fault+0x2ac4/0x4620 [ 2822.939592] ? __kernel_text_address+0x9/0x30 [ 2822.944065] ? vm_insert_page+0x7c0/0x7c0 [ 2822.948189] ? __save_stack_trace+0xa0/0x160 [ 2822.952576] ? mark_held_locks+0xa6/0xf0 [ 2822.956625] handle_mm_fault+0x455/0x9c0 [ 2822.960678] __do_page_fault+0x549/0xad0 [ 2822.964717] ? spurious_fault+0x640/0x640 [ 2822.968838] ? do_page_fault+0x60/0x500 [ 2822.972793] page_fault+0x25/0x50 [ 2822.976229] RIP: 0010:copy_user_generic_unrolled+0x86/0xc0 [ 2822.981851] RSP: 0018:ffff8880b4427c40 EFLAGS: 00050202 [ 2822.987199] RAX: ffffed1016884f94 RBX: 0000000000000008 RCX: 0000000000000001 [ 2822.994449] RDX: 0000000000000000 RSI: 0000000020000000 RDI: ffff8880b4427c98 [ 2823.001699] RBP: 0000000020000000 R08: 0000000000000001 R09: ffffed1016884f93 [ 2823.009080] R10: ffff8880b4427c9f R11: ffff88809b214280 R12: 00007ffffffff000 [ 2823.016332] R13: ffff8880b4427c98 R14: 0000000020000008 R15: ffff8880b2dfb780 [ 2823.023604] _copy_from_user+0xbe/0x100 [ 2823.027557] hci_dev_cmd+0x68/0x710 [ 2823.031159] ? hci_dev_reset_stat+0x130/0x130 [ 2823.035635] ? security_capable+0x88/0xb0 [ 2823.039769] hci_sock_ioctl+0x371/0x6c0 [ 2823.043719] ? hci_sock_sendmsg+0x1d00/0x1d00 [ 2823.048191] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2823.053097] ? __handle_mm_fault+0x80f/0x4620 [ 2823.057568] ? SyS_write+0x1b7/0x210 [ 2823.061259] sock_ioctl+0x2cc/0x4c0 [ 2823.064863] ? sock_release+0x1e0/0x1e0 [ 2823.068814] do_vfs_ioctl+0x75a/0xff0 [ 2823.072589] ? lock_acquire+0x170/0x3f0 [ 2823.076545] ? ioctl_preallocate+0x1a0/0x1a0 [ 2823.080936] ? __fget+0x265/0x3e0 [ 2823.084383] ? do_vfs_ioctl+0xff0/0xff0 [ 2823.088332] ? security_file_ioctl+0x83/0xb0 [ 2823.092715] SyS_ioctl+0x7f/0xb0 [ 2823.096062] ? do_vfs_ioctl+0xff0/0xff0 [ 2823.100018] do_syscall_64+0x1d5/0x640 [ 2823.103890] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2823.109142] RIP: 0033:0x7f66aabb10e9 [ 2823.112830] RSP: 002b:00007f66a9526168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 14:07:49 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (fail_nth: 8) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000001c0)={0x0}) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r3, r4, r5, r6, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={r1, 0x0, r2, 0x4}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f0000000000)={r1, 0x2, 0x80000000}) 14:07:49 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e7, &(0x7f0000000100)="fa32a4bc79b58799a70ebbc6e270d92a94442f1f8dffd31d6c4a2c39b8faeaa81332110cddd7353ca65ad44542d8aac77bf643755d68fc083a003b30adf9b4f625b119595ac23e5e2f4d5e662b6bcb6b900065886d12778c964b5dc131fc5dc58300426d39a5eb22b6ec12c8d781ddf72d5e2ecce1124bbc9706047649cae9056205d2a6966072be0742b9a54fa73218c64c376d2558db42e475b8add3f2438d5b8e7043fb018c96f0cb77f5b3d7f3f7f1a76696a4d55b0bd1ad9b5df30ec1550887ee76c9346608352945fec16ff612aa679567496655f4bdf355b4da8db8cb1d0a773c747596f62824728630b176a7a7725dbfa1a95ceac91337647c78ac0d9417ba7115ce6f7bfac73c1774b77fa5846681da083521fb79d5f0460593abd1c51b8d2b2359fc81522365672d44e88c8d87ac96654665ecda96e38388bc7a295affdb3e162fde00caada35fea6aa6f53cd5e77eba659e14df4047214bc98cacbe1d26c843d9468540d757dbe3fe2cf7b05baf8bcdb192ac6d73844f36ba172017e73281efc4fafaae3c9e0bafe8d2b20c85283bd7874442deb6a1d5711790bab6857d94e4a3ce6d0e4f79cdcd7345bc0e9463f3ff5a5a964a0f7dfa657a266a578fd6163c8431bef2442c82b6914490f1e926ecb091fe0525749b4b4f6523a829f909c3f4f56f4ce96953c797769a762dc86bc2611e528eb55c170d6cd0438f003a3008c3b915f894d4a15583878c1ae969983cfd008a94f86bb58aa175fdd4188d67291a73281fb6a2f15220c80244547cd69032de8935f30bd092626d89c262d8a59debc6741202ef5d3d99864107216725da8dd9bc1056b6fed647e683a028e091613342ff46229b07299224f320f1ed3cb3c716f7b3cf6c1010d5cda6402ac2678c6302ed380742b9c628e18293165a5d8feaeccc34faea6c4c0463def86426de82fe15e5738f3d1dcc403d8221bb1b0eeba65b3065b86c10aaca2b38c9bd51029c98eb7d11825dd8547c427153c8855cb8298841c8c5f7bb754ca097a696c38fbc4c23500647de19eaf3827de9f560662f1bd03853c2a21727b9da04f5059d0c66c4eeb4435a2d51cbe45fc7343666d1d5de1ec4e6a53031946444dc95a1d7e062716309bfbe3d6a76f99787a73caef5b1907067e5120c57ccdfd994204fcbb84b05c9d4b25965910144d8153135bf98474747b03d253a53dab64693d61fdbd83ba9fd54b7d893cd728dc68c0707a9bb9a97553e781b13e10cbd3df5b93b7e185f0dc4984ad635d43e54be5a34c7d658cdd3c8eec7cfeac54183a30bdc92f29974bec8ec96e19e4957b6aa591bcd4ca499e89d2ac5b4d65e6895cce9403fe1e452c5ede1703c1047f3a8f723e9246cdccf4d2a98ea8407ac0e0f9362883bfb074b7c2382ef0464026a5e1e53a42cbeff664490652fbce9b38b02843d336f73f44bd3ea3d46a33b6fe59aff96128a68910bc01e85ff53d728b6450bca1ec40c7d0d590fddb72bd1b2e826a8d5cd7ec8c391f36f692e345989b9dc1c40b1a14572eaa600bc514f66d3ee427a50c1e9ba8e1a6958588a0e7072fdd18767156c66c85b005c3f4412c690d76243607c3fb718d63c33914c228d1d6fe88a9aa5956ed3d60dbf75f51b0c6602d5c0824a35120f4b3e97f98b55a7c736abde81bc0c6c74439347daf1b72d285fc7c5aa2c43b8cc264d7bd9424de075903e394b81fc5faed8dce7e34d60bbfff08d89edda2d7c95ac68bda0b1dd4d201cc14f374dab8cf840d13b639f2d3eced5ef912779e3998af23848587dd971b006ce3d16b8ca0a41fe7b2904f46cd9b5f4c884a6f84f7e5e9ba6034ff6b2b3e53a10d3c954638c0029f73d2f085c2b2ca4f8b65f93a420c4a7959ad8a2aee647fe89bd4f6c910d8510b44376b10d4d447c3b5a06361108758dbade547ff4668d8dc84770565ff52053091e9cb2b75f3c575d99bc9d7c3d3ba779c543e474445bf41b3ed802542019893a45f34f8a8c0416076f32d6538a1f644674a5870172d846dc69e0d116ee5d1514124952f0e7a80c0ec00fb77ca4b4bb8b4385002c0b08dfa55b9bc9071cf47523a132b2d51b530356ca40532bb7f9452d1a60ff6042c8bd2e8343295946dca270010776e6b18b75db1b83fe230459cc08bf03328af27f5178fa6db96b7c0e49ba24df3a1c22c867b12758e3056fa4299ba5eeb8cacb424bc1b1c5e5da34d0248888738c06f9a78e3133bceec0405c53548f28b40f093a3c385b3f9a8eac6c41ca188add06b151a51cdd617b2a9073c9a11973329ac0d94701788d76a905534878f825f7ba644b288d5f5afabef101e0718e1df08adf15816227b881aaf94b95b7567c6eb6262c819df10c56ca18b10df9a37427a91346e0334720d31cc575c66503c6f4eed4601bc02c2bc98ba409c66d6c9d57c363e4799376d67b1d4500b418ca8897c7bce26a2205d8db801ff230a9b5ee5540f38a3b8df16fd5c2ff8e0604a20f7b0cc7459d7db1cd793b68911a39698c5d1daee837535cd8906b9748ec13e3b1ba5fb25147172227b17238a35cc594672d1a91b306a0fda9544289e13ac07ff34f73cabccfd5ae8cf3616fe039e1293951d9271669dd6880687ab9812d8eb72f55f2ddde2acd5fd52334199ea48a2395634fb6b81fe333952c866b8eeff2a50ddf0c50b5a1cba771ddf408a1f94cc7eed7aba09e5bfb56b3be87c41af81ea196791cb6840e38c1ba5ca26fa0e0308ff92b55fd25b63fec5d9d64502865516f558175ee90813a397d32db92532fa5b982ba5a7b62286330828bbfabf812e50a1e54b6ffba4213505aae66454e6d0de2ea1352b959ed79795baffddb22b1fea9fa082dfb9aa92d769c0579e2440991abc0c8c360e163d47baa2a10eee50d21075d82e368987da52c83bc7d44c6baf7f8631455341f53d33099e3ddc56791f7a3b2ec2fcd66aec6fef7473d486d940ad1e150d40c3cf8759b717e54913b87eb5318d8e5393d12513ae9a01f02659cf2856166a46cd38589ed91e9b947722f56253b19419f426259c9695db186181e6a463c179b9b2a952a95e15dd8ab4f9b7652918c4b12c52c2981c053f5d1532fcf8fb74473fee4186f884656a68356f2bc6a775c49090eb06bf8ba6dffdca6a34193a067882ed819ca7fc4a2ef424e3691fac8b027382edacb27cab13d1ea6a3ef88bd2b417cc08c69a103faa834cc801d6acbd1be4b04eea4d0f6ca662308a34eefb551d245ada8a2d1eac4af8d28253dd9cc94e589d5a8c9d8419e19e54e00ce4e32270e88715feb12c9da7fe0293f4e6dcedf319a35d36b9eb831ab99a8d2b4fd7b8e6c4fc097577cec4d8730d3a922fb41b712d39a42fd18aaed8a1bd7d9049c2091144dcb574cbbc646beceeb9cf04e5ef1d13cb4c0996d9e4c496b99ba46794ced8b79439e28ed31977843391fbe67ef915a4ee2aba6a98830d1a2671e7025de84eebbf3fe0e52bb112d1de7bd0c37101fbf2d7f11a726b79b48846180c01c3f9b9062a7b33a8e8e1ebcb695c6877529ccedf3bdc70c6f8ca4ae3ff7ef01396ca6a42fd928279316a25ddebd029f463b7bb30697b8aa0b387d165fb8dab9df2528742eece51f34c9221f6349bee23b4d53b5236e13f912266c399e1daa607656fe7077dd054d825afcf995477764fed1bde6ba808445f5311e907e9b6b539f8021988a87af4dc64db50dcd4ba67bae05a98a07f8ed0ef481662fcc3a6554e3c40518f4376fbda842bbdb6f28f8e0621f04f9accb7084cf77448a8489e2945363b326f08f87f033517b12b1fd915df9657bbaf2280a9c1f346fe0e6d743f0a0b8c49d964757461728dcc20c29537289fdc4be2ccd4439f7f2da1492b9d9436e9eb48c92b209ff381070e3bbb3b8a5fc35803bd3c5007da4ec3fa4d4d4ff0cc38cc4681889e75dedcd654ffddb6e4293c5b7b86a5c03aae7e70c73b10d8c91568aaf7a971e0640f061de006d527545313b6e3183de57dddaa1c9ffc6078b5283a3d5818d3c3892bdb416af87d4afa529267d369f52a82d1834981ba03836ff212a133aa746ea2548f0d9535cffb8d51e713f6c9d792c7f4491b4d915719a963000d7ee37af9bbef9b830f358f2773e2077a98fee9d0048ff465ca02a70f746138a2e8d6b0cb7834ea9f625b3c4d74f6332944e5bc4fa26a864fc15ba83b18ed988d2ca7a8a8086896dbc9fb38ffa3f3258cb9838d9446ff105b2f899e62eef931a1112898419ff003db0a8ff2ea928a15f70f140534c779e855adb7d75fa32f2e9c1fa7e72edeeae3b6582def39366fc54e7124bc32f91e61d9e07b61c4c932117b473ab696a5565f914295b6e1ac4a2764adcfaa9c52df78caa6361ed129184ccccd1d83619e66cf85e80948c8e007b5091c93f5549a81f626255a777d6e811d0cbad10c7793b44ba9276d8a2d87d3a9dde19d15ff1f55ec507390c37b897fa46e56d588299604966b01722d454d6e384b5fb5d4aa8ade565f1ce110352ee951fe7206cf3ea83a3fc40f1e8a1d4f618d171e80eef52acb46d3a75c11e1777d084cb1fd60a11c1745e71ca6160fe60938212dac368987407f09d88da18e4dd033770bfcfa897edb2ace0222191c7900f9814beddf909e87644c83532e1c3fd8b54856180c8437fc819970bd90ed3f4976da4b323880f0d221d1b4b5a22e4341fc0f27d59a20a47b9c3dfab31098ed590e5d6e140f0a26148400da6e334b188625702dc8e04a9fe3e686f65171a930fc70507a096d9b3bed3ab9d32559399528d40b8a95227b2367684b1603115b969aec988360913726022502d438465342e08e9177638d7a0e2563cc5748b827ce9d36977684cb06073021365771fad27d879b806433795dc6661fb1579a2c1a87c1513568673142103b83b18e12a1fa1f6202b0b182ff8159a9d8ec0977479f435e80ff16899028a56522838873bfcf72f616b7149895e27912d38e3f57a51560454adc65e5cd0f096330f4c0a9318d8db1b3e257fcb947d57926d6a7bf90930273020a3e1257beeece3c52f518f8b9cac7c6a381f3da30e997adfbdcfdb5461168cea582b579e12fb4c6cbb79925ff922f0a2f75f655af0a39ff9e90dd58d5d53e8d2484330da7b47849844eddb124c85f88800851283c762fa382e7b26e8fa95a67452046d81b89854148b687c7da8db81633c349f7469d85a367988b29e29d6a552c6121ffe04986e00a027629e1401b6a03a509e6696cc6b6093fa03adaea3810a824598803efcc8c450bcf178a9ba4ce1c0664eec5065bd4ab2f183029cdc93ff44dc7721ee7360a4c7cdce2d11ee7ccd7d4aeb3262d4bc03405a5c8fd2dab41666ce93320c0cf61f06f5f8cd40eb233cce335247539393740035ac670ef0ac8c26336f1d4131c5cce22b9a108101acfc3f79ec373d634b558f91b28eec2f2f8e44fb87d5181689176798e7bf32654efcaa28d4ee8bc5a72d8fdc0a59f009ba0460d5596f4266e7672f1bee998ae9a86e33c80c745a44611ba41dfbae06e4f39c3c230d2291ea801683889d0a1c195699f2aca778c9725b34c0bd720b5239c057447c2442d6b21867dd5cbd64278c2da82f5416c8fc4300de66b742f6addb07bd40d029522469780892e98d9cff3be3e1b4d46c4bb7b480792582d1abe25883d517ca79c14d72b5eb8d3656b731a4c6ab757db4180345b02619534f4b17e557f335c9fa4ba565e8227a5f0884674b93ba5a9e6470996e070b99a9b6a14a55fe79c34147734b0ccfab552a544d5e2f1bb8a4562c84b8dfbf8664") r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$unix(0x1, 0x1, 0x0) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x4}, 0xfffffffffffffeaf) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) sendto$unix(0xffffffffffffffff, &(0x7f0000001100)="43fb603d0a906d33a8985b834f2cbb7ac71cbb0cc93ee55fddfe21a903afc4494bb97315de17ad531c6b2d42dbb8b6aad614e575ab0275b2e91bb70f5f75ec5f2f921080db44cb42c98e7ba66407435354f0b51ea1a684b9d1", 0x59, 0x4000800, &(0x7f0000001180)=@abs={0x1, 0x0, 0x4e23}, 0x6e) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r0, 0x400448e7, &(0x7f0000000100)="fa32a4bc79b58799a70ebbc6e270d92a94442f1f8dffd31d6c4a2c39b8faeaa81332110cddd7353ca65ad44542d8aac77bf643755d68fc083a003b30adf9b4f625b119595ac23e5e2f4d5e662b6bcb6b900065886d12778c964b5dc131fc5dc58300426d39a5eb22b6ec12c8d781ddf72d5e2ecce1124bbc9706047649cae9056205d2a6966072be0742b9a54fa73218c64c376d2558db42e475b8add3f2438d5b8e7043fb018c96f0cb77f5b3d7f3f7f1a76696a4d55b0bd1ad9b5df30ec1550887ee76c9346608352945fec16ff612aa679567496655f4bdf355b4da8db8cb1d0a773c747596f62824728630b176a7a7725dbfa1a95ceac91337647c78ac0d9417ba7115ce6f7bfac73c1774b77fa5846681da083521fb79d5f0460593abd1c51b8d2b2359fc81522365672d44e88c8d87ac96654665ecda96e38388bc7a295affdb3e162fde00caada35fea6aa6f53cd5e77eba659e14df4047214bc98cacbe1d26c843d9468540d757dbe3fe2cf7b05baf8bcdb192ac6d73844f36ba172017e73281efc4fafaae3c9e0bafe8d2b20c85283bd7874442deb6a1d5711790bab6857d94e4a3ce6d0e4f79cdcd7345bc0e9463f3ff5a5a964a0f7dfa657a266a578fd6163c8431bef2442c82b6914490f1e926ecb091fe0525749b4b4f6523a829f909c3f4f56f4ce96953c797769a762dc86bc2611e528eb55c170d6cd0438f003a3008c3b915f894d4a15583878c1ae969983cfd008a94f86bb58aa175fdd4188d67291a73281fb6a2f15220c80244547cd69032de8935f30bd092626d89c262d8a59debc6741202ef5d3d99864107216725da8dd9bc1056b6fed647e683a028e091613342ff46229b07299224f320f1ed3cb3c716f7b3cf6c1010d5cda6402ac2678c6302ed380742b9c628e18293165a5d8feaeccc34faea6c4c0463def86426de82fe15e5738f3d1dcc403d8221bb1b0eeba65b3065b86c10aaca2b38c9bd51029c98eb7d11825dd8547c427153c8855cb8298841c8c5f7bb754ca097a696c38fbc4c23500647de19eaf3827de9f560662f1bd03853c2a21727b9da04f5059d0c66c4eeb4435a2d51cbe45fc7343666d1d5de1ec4e6a53031946444dc95a1d7e062716309bfbe3d6a76f99787a73caef5b1907067e5120c57ccdfd994204fcbb84b05c9d4b25965910144d8153135bf98474747b03d253a53dab64693d61fdbd83ba9fd54b7d893cd728dc68c0707a9bb9a97553e781b13e10cbd3df5b93b7e185f0dc4984ad635d43e54be5a34c7d658cdd3c8eec7cfeac54183a30bdc92f29974bec8ec96e19e4957b6aa591bcd4ca499e89d2ac5b4d65e6895cce9403fe1e452c5ede1703c1047f3a8f723e9246cdccf4d2a98ea8407ac0e0f9362883bfb074b7c2382ef0464026a5e1e53a42cbeff664490652fbce9b38b02843d336f73f44bd3ea3d46a33b6fe59aff96128a68910bc01e85ff53d728b6450bca1ec40c7d0d590fddb72bd1b2e826a8d5cd7ec8c391f36f692e345989b9dc1c40b1a14572eaa600bc514f66d3ee427a50c1e9ba8e1a6958588a0e7072fdd18767156c66c85b005c3f4412c690d76243607c3fb718d63c33914c228d1d6fe88a9aa5956ed3d60dbf75f51b0c6602d5c0824a35120f4b3e97f98b55a7c736abde81bc0c6c74439347daf1b72d285fc7c5aa2c43b8cc264d7bd9424de075903e394b81fc5faed8dce7e34d60bbfff08d89edda2d7c95ac68bda0b1dd4d201cc14f374dab8cf840d13b639f2d3eced5ef912779e3998af23848587dd971b006ce3d16b8ca0a41fe7b2904f46cd9b5f4c884a6f84f7e5e9ba6034ff6b2b3e53a10d3c954638c0029f73d2f085c2b2ca4f8b65f93a420c4a7959ad8a2aee647fe89bd4f6c910d8510b44376b10d4d447c3b5a06361108758dbade547ff4668d8dc84770565ff52053091e9cb2b75f3c575d99bc9d7c3d3ba779c543e474445bf41b3ed802542019893a45f34f8a8c0416076f32d6538a1f644674a5870172d846dc69e0d116ee5d1514124952f0e7a80c0ec00fb77ca4b4bb8b4385002c0b08dfa55b9bc9071cf47523a132b2d51b530356ca40532bb7f9452d1a60ff6042c8bd2e8343295946dca270010776e6b18b75db1b83fe230459cc08bf03328af27f5178fa6db96b7c0e49ba24df3a1c22c867b12758e3056fa4299ba5eeb8cacb424bc1b1c5e5da34d0248888738c06f9a78e3133bceec0405c53548f28b40f093a3c385b3f9a8eac6c41ca188add06b151a51cdd617b2a9073c9a11973329ac0d94701788d76a905534878f825f7ba644b288d5f5afabef101e0718e1df08adf15816227b881aaf94b95b7567c6eb6262c819df10c56ca18b10df9a37427a91346e0334720d31cc575c66503c6f4eed4601bc02c2bc98ba409c66d6c9d57c363e4799376d67b1d4500b418ca8897c7bce26a2205d8db801ff230a9b5ee5540f38a3b8df16fd5c2ff8e0604a20f7b0cc7459d7db1cd793b68911a39698c5d1daee837535cd8906b9748ec13e3b1ba5fb25147172227b17238a35cc594672d1a91b306a0fda9544289e13ac07ff34f73cabccfd5ae8cf3616fe039e1293951d9271669dd6880687ab9812d8eb72f55f2ddde2acd5fd52334199ea48a2395634fb6b81fe333952c866b8eeff2a50ddf0c50b5a1cba771ddf408a1f94cc7eed7aba09e5bfb56b3be87c41af81ea196791cb6840e38c1ba5ca26fa0e0308ff92b55fd25b63fec5d9d64502865516f558175ee90813a397d32db92532fa5b982ba5a7b62286330828bbfabf812e50a1e54b6ffba4213505aae66454e6d0de2ea1352b959ed79795baffddb22b1fea9fa082dfb9aa92d769c0579e2440991abc0c8c360e163d47baa2a10eee50d21075d82e368987da52c83bc7d44c6baf7f8631455341f53d33099e3ddc56791f7a3b2ec2fcd66aec6fef7473d486d940ad1e150d40c3cf8759b717e54913b87eb5318d8e5393d12513ae9a01f02659cf2856166a46cd38589ed91e9b947722f56253b19419f426259c9695db186181e6a463c179b9b2a952a95e15dd8ab4f9b7652918c4b12c52c2981c053f5d1532fcf8fb74473fee4186f884656a68356f2bc6a775c49090eb06bf8ba6dffdca6a34193a067882ed819ca7fc4a2ef424e3691fac8b027382edacb27cab13d1ea6a3ef88bd2b417cc08c69a103faa834cc801d6acbd1be4b04eea4d0f6ca662308a34eefb551d245ada8a2d1eac4af8d28253dd9cc94e589d5a8c9d8419e19e54e00ce4e32270e88715feb12c9da7fe0293f4e6dcedf319a35d36b9eb831ab99a8d2b4fd7b8e6c4fc097577cec4d8730d3a922fb41b712d39a42fd18aaed8a1bd7d9049c2091144dcb574cbbc646beceeb9cf04e5ef1d13cb4c0996d9e4c496b99ba46794ced8b79439e28ed31977843391fbe67ef915a4ee2aba6a98830d1a2671e7025de84eebbf3fe0e52bb112d1de7bd0c37101fbf2d7f11a726b79b48846180c01c3f9b9062a7b33a8e8e1ebcb695c6877529ccedf3bdc70c6f8ca4ae3ff7ef01396ca6a42fd928279316a25ddebd029f463b7bb30697b8aa0b387d165fb8dab9df2528742eece51f34c9221f6349bee23b4d53b5236e13f912266c399e1daa607656fe7077dd054d825afcf995477764fed1bde6ba808445f5311e907e9b6b539f8021988a87af4dc64db50dcd4ba67bae05a98a07f8ed0ef481662fcc3a6554e3c40518f4376fbda842bbdb6f28f8e0621f04f9accb7084cf77448a8489e2945363b326f08f87f033517b12b1fd915df9657bbaf2280a9c1f346fe0e6d743f0a0b8c49d964757461728dcc20c29537289fdc4be2ccd4439f7f2da1492b9d9436e9eb48c92b209ff381070e3bbb3b8a5fc35803bd3c5007da4ec3fa4d4d4ff0cc38cc4681889e75dedcd654ffddb6e4293c5b7b86a5c03aae7e70c73b10d8c91568aaf7a971e0640f061de006d527545313b6e3183de57dddaa1c9ffc6078b5283a3d5818d3c3892bdb416af87d4afa529267d369f52a82d1834981ba03836ff212a133aa746ea2548f0d9535cffb8d51e713f6c9d792c7f4491b4d915719a963000d7ee37af9bbef9b830f358f2773e2077a98fee9d0048ff465ca02a70f746138a2e8d6b0cb7834ea9f625b3c4d74f6332944e5bc4fa26a864fc15ba83b18ed988d2ca7a8a8086896dbc9fb38ffa3f3258cb9838d9446ff105b2f899e62eef931a1112898419ff003db0a8ff2ea928a15f70f140534c779e855adb7d75fa32f2e9c1fa7e72edeeae3b6582def39366fc54e7124bc32f91e61d9e07b61c4c932117b473ab696a5565f914295b6e1ac4a2764adcfaa9c52df78caa6361ed129184ccccd1d83619e66cf85e80948c8e007b5091c93f5549a81f626255a777d6e811d0cbad10c7793b44ba9276d8a2d87d3a9dde19d15ff1f55ec507390c37b897fa46e56d588299604966b01722d454d6e384b5fb5d4aa8ade565f1ce110352ee951fe7206cf3ea83a3fc40f1e8a1d4f618d171e80eef52acb46d3a75c11e1777d084cb1fd60a11c1745e71ca6160fe60938212dac368987407f09d88da18e4dd033770bfcfa897edb2ace0222191c7900f9814beddf909e87644c83532e1c3fd8b54856180c8437fc819970bd90ed3f4976da4b323880f0d221d1b4b5a22e4341fc0f27d59a20a47b9c3dfab31098ed590e5d6e140f0a26148400da6e334b188625702dc8e04a9fe3e686f65171a930fc70507a096d9b3bed3ab9d32559399528d40b8a95227b2367684b1603115b969aec988360913726022502d438465342e08e9177638d7a0e2563cc5748b827ce9d36977684cb06073021365771fad27d879b806433795dc6661fb1579a2c1a87c1513568673142103b83b18e12a1fa1f6202b0b182ff8159a9d8ec0977479f435e80ff16899028a56522838873bfcf72f616b7149895e27912d38e3f57a51560454adc65e5cd0f096330f4c0a9318d8db1b3e257fcb947d57926d6a7bf90930273020a3e1257beeece3c52f518f8b9cac7c6a381f3da30e997adfbdcfdb5461168cea582b579e12fb4c6cbb79925ff922f0a2f75f655af0a39ff9e90dd58d5d53e8d2484330da7b47849844eddb124c85f88800851283c762fa382e7b26e8fa95a67452046d81b89854148b687c7da8db81633c349f7469d85a367988b29e29d6a552c6121ffe04986e00a027629e1401b6a03a509e6696cc6b6093fa03adaea3810a824598803efcc8c450bcf178a9ba4ce1c0664eec5065bd4ab2f183029cdc93ff44dc7721ee7360a4c7cdce2d11ee7ccd7d4aeb3262d4bc03405a5c8fd2dab41666ce93320c0cf61f06f5f8cd40eb233cce335247539393740035ac670ef0ac8c26336f1d4131c5cce22b9a108101acfc3f79ec373d634b558f91b28eec2f2f8e44fb87d5181689176798e7bf32654efcaa28d4ee8bc5a72d8fdc0a59f009ba0460d5596f4266e7672f1bee998ae9a86e33c80c745a44611ba41dfbae06e4f39c3c230d2291ea801683889d0a1c195699f2aca778c9725b34c0bd720b5239c057447c2442d6b21867dd5cbd64278c2da82f5416c8fc4300de66b742f6addb07bd40d029522469780892e98d9cff3be3e1b4d46c4bb7b480792582d1abe25883d517ca79c14d72b5eb8d3656b731a4c6ab757db4180345b02619534f4b17e557f335c9fa4ba565e8227a5f0884674b93ba5a9e6470996e070b99a9b6a14a55fe79c34147734b0ccfab552a544d5e2f1bb8a4562c84b8dfbf8664") (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) socket$unix(0x1, 0x1, 0x0) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x4}, 0xfffffffffffffeaf) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) sendto$unix(0xffffffffffffffff, &(0x7f0000001100)="43fb603d0a906d33a8985b834f2cbb7ac71cbb0cc93ee55fddfe21a903afc4494bb97315de17ad531c6b2d42dbb8b6aad614e575ab0275b2e91bb70f5f75ec5f2f921080db44cb42c98e7ba66407435354f0b51ea1a684b9d1", 0x59, 0x4000800, &(0x7f0000001180)=@abs={0x1, 0x0, 0x4e23}, 0x6e) (async) 14:07:49 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x1, &(0x7f0000000000)=[{0x0, 0x8, 0x8, 0x1f}]}) 14:07:49 executing program 0: recvmmsg$unix(0xffffffffffffffff, &(0x7f00000016c0)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000001380)=[{&(0x7f0000000100)=""/69, 0x45}, {&(0x7f0000000180)=""/4096, 0x1000}, {&(0x7f0000001180)}, {&(0x7f00000011c0)=""/171, 0xab}, {&(0x7f0000001280)=""/202, 0xca}], 0x5, &(0x7f0000001400)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000001440), 0x6e, &(0x7f0000001540)=[{&(0x7f00000014c0)=""/84, 0x54}], 0x1, &(0x7f0000001780)=ANY=[@ANYBLOB="28000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000bc5d58f000000010000007bd83b40d55c74ae522a2b76327d0f5f1fe0d70ea0cc8068403cd6938ebada0437773664f2dcf44241d387b2a8a9b517c4e67710e51445bb3d6fbe79679786f048dda098e81d667d82260fb69d37247018df80e09bba407a5220a3ad1cd04c3fe56f3a4ce3c2ccf817648da659d767a7a9f784db68e56cdd046459", @ANYRES32, @ANYRES32, @ANYBLOB="1c0000000000000001f83d6ea000689f", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x130}}], 0x2, 0x0, &(0x7f0000001740)) (async) r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000001180), 0x42a142) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000001580)={0x0}) (async) r2 = socket$unix(0x1, 0x5, 0x0) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000001a00)=ANY=[@ANYBLOB="a6a0e446edf62846552a5826bca456f998aea847cc46be93f785d03b94bba230ca"], 0x7) (async) ioctl$sock_bt_hci(r3, 0x400448dd, &(0x7f0000001940)="5cd99aae58db6873c305ad47e8dddc465323e8dfaa9a8fa74098ca9119f8b018a49f6465997960a67f0d4a398c227f53700b58787ab421137328f1ec8611bde21c9056929e9e3f44e9522b8b7132dfc2f9bc8bc7c720ae79c4ee89dec34e31fd31dcd1bd6a84e548230008105d87e0ef9e6474b4e607911ae361409e54dd94b08819c7e6108a40bf82517dcd6407be4c6de5bea42508d81b57aeb6dae9") recvmsg$unix(r2, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000001600)={r1, 0x1, r2, 0x9, 0x80000}) (async) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000001640)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000001680)={0x0, 0x0, r4}) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000040)={0x6d, [0x897, 0x3], 0x79}, 0x10) 14:07:49 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000000)={0x2e, 0x80000001, 0x9, 0x8}) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) r2 = socket$nl_rdma(0x10, 0x3, 0x14) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SFACILITIES(r3, 0x89e3, &(0x7f0000000340)={0x68, 0x391f98e8, 0xb, 0x6, 0x220b7963}) (async) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x18, 0x1411, 0x10, 0x70bd26, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x3}]}, 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x8080) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r5, 0x89e7, &(0x7f0000000300)={0x41}) write$apparmor_current(r4, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r4, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x500400}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="4800000011140100a7bd7000ffdbdf2508003e000000000008004b003b00000008004a000000000008004f0004000000080035c0e788000008004a000200"/72], 0x48}, 0x1, 0x0, 0x0, 0xc4}, 0x4000081) [ 2823.120522] RAX: ffffffffffffffda RBX: 00007f66aacc3f60 RCX: 00007f66aabb10e9 [ 2823.127772] RDX: 0000000020000000 RSI: 00000000400448e0 RDI: 0000000000000004 [ 2823.135025] RBP: 00007f66a95261d0 R08: 0000000000000000 R09: 0000000000000000 [ 2823.142281] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2823.149531] R13: 00007ffc50ba1d5f R14: 00007f66a9526300 R15: 0000000000022000 [ 2823.220411] FAULT_INJECTION: forcing a failure. [ 2823.220411] name failslab, interval 1, probability 0, space 0, times 0 [ 2823.242365] CPU: 1 PID: 17282 Comm: syz-executor.1 Not tainted 4.14.277-syzkaller #0 [ 2823.250262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2823.259614] Call Trace: [ 2823.262203] dump_stack+0x1b2/0x281 [ 2823.265840] should_fail.cold+0x10a/0x149 14:07:49 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x1, &(0x7f0000000000)=[{0x0, 0x8, 0x8, 0x1f}]}) 14:07:49 executing program 4: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0}) r3 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r3, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r3, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r4, r5, r6, r7, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(0xffffffffffffffff, 0xc02064c3, &(0x7f0000000480)={&(0x7f0000000440)=[r4], 0x2, 0x1, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r0, 0xc02864ca, &(0x7f0000000180)={&(0x7f0000000100)=[r1, r2, 0x0, r4], &(0x7f0000000140)=[0x8001, 0x4, 0x7], 0x9, 0x4, 0x6}) r8 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r8, &(0x7f00000004c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000400)={&(0x7f0000000200)={0x30, 0x1404, 0x10, 0x70bd28, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x8040}, 0x2000c001) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r10, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r9, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000001c0)={0x0}) (async) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r3, r4, r5, r6, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={r1, 0x0, r2, 0x4}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f0000000000)={r1, 0x2, 0x80000000}) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000001c0)={0x0}) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r3, r4, r5, r6, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={r1, 0x0, r2, 0x4}) (async) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f0000000000)={r1, 0x2, 0x80000000}) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x4}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x1}, 0x6) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x46002, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) accept$ax25(r1, 0x0, &(0x7f0000000100)) [ 2823.269996] should_failslab+0xd6/0x130 [ 2823.273980] kmem_cache_alloc+0x28e/0x3c0 [ 2823.278125] ptlock_alloc+0x1d/0x70 [ 2823.281747] pte_alloc_one+0x57/0x100 [ 2823.285546] do_huge_pmd_anonymous_page+0x500/0x1700 [ 2823.290648] ? __lockdep_init_map+0x100/0x560 [ 2823.295140] ? prep_transhuge_page+0xa0/0xa0 [ 2823.299551] ? _raw_spin_unlock+0x29/0x40 [ 2823.303699] ? __pmd_alloc+0x27f/0x3f0 [ 2823.307585] __handle_mm_fault+0x2ac4/0x4620 [ 2823.311993] ? __kernel_text_address+0x9/0x30 [ 2823.316485] ? vm_insert_page+0x7c0/0x7c0 14:07:49 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x1, &(0x7f0000000000)=[{0x0, 0x8, 0x8, 0x1f}]}) [ 2823.320632] ? __save_stack_trace+0xa0/0x160 [ 2823.325045] ? mark_held_locks+0xa6/0xf0 [ 2823.329109] handle_mm_fault+0x455/0x9c0 [ 2823.333171] __do_page_fault+0x549/0xad0 [ 2823.337234] ? spurious_fault+0x640/0x640 [ 2823.341381] ? do_page_fault+0x60/0x500 [ 2823.345356] page_fault+0x25/0x50 [ 2823.348807] RIP: 0010:copy_user_generic_unrolled+0x86/0xc0 [ 2823.354419] RSP: 0018:ffff8880b199fc40 EFLAGS: 00050202 [ 2823.359780] RAX: ffffed1016333f94 RBX: 0000000000000008 RCX: 0000000000000001 [ 2823.367041] RDX: 0000000000000000 RSI: 0000000020000000 RDI: ffff8880b199fc98 [ 2823.374301] RBP: 0000000020000000 R08: 0000000000000001 R09: ffffed1016333f93 [ 2823.381551] R10: ffff8880b199fc9f R11: ffff888096c0c340 R12: 00007ffffffff000 [ 2823.388799] R13: ffff8880b199fc98 R14: 0000000020000008 R15: ffff888098355a00 [ 2823.396188] _copy_from_user+0xbe/0x100 [ 2823.400151] hci_dev_cmd+0x68/0x710 [ 2823.403754] ? hci_dev_reset_stat+0x130/0x130 [ 2823.408227] ? security_capable+0x88/0xb0 [ 2823.412351] hci_sock_ioctl+0x371/0x6c0 [ 2823.416308] ? hci_sock_sendmsg+0x1d00/0x1d00 [ 2823.420789] ? proc_tgid_io_accounting+0x7a0/0x7a0 [ 2823.425700] ? __handle_mm_fault+0x80f/0x4620 [ 2823.430179] ? SyS_write+0x1b7/0x210 [ 2823.433897] sock_ioctl+0x2cc/0x4c0 [ 2823.437525] ? sock_release+0x1e0/0x1e0 [ 2823.441483] do_vfs_ioctl+0x75a/0xff0 [ 2823.445269] ? lock_acquire+0x170/0x3f0 [ 2823.449227] ? ioctl_preallocate+0x1a0/0x1a0 [ 2823.453613] ? __fget+0x265/0x3e0 [ 2823.457044] ? do_vfs_ioctl+0xff0/0xff0 [ 2823.462062] ? security_file_ioctl+0x83/0xb0 [ 2823.466457] SyS_ioctl+0x7f/0xb0 [ 2823.469813] ? do_vfs_ioctl+0xff0/0xff0 [ 2823.473765] do_syscall_64+0x1d5/0x640 [ 2823.477634] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2823.482799] RIP: 0033:0x7f66aabb10e9 [ 2823.486581] RSP: 002b:00007f66a9526168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2823.494276] RAX: ffffffffffffffda RBX: 00007f66aacc3f60 RCX: 00007f66aabb10e9 [ 2823.501527] RDX: 0000000020000000 RSI: 00000000400448e0 RDI: 0000000000000004 [ 2823.508776] RBP: 00007f66a95261d0 R08: 0000000000000000 R09: 0000000000000000 14:07:49 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (fail_nth: 9) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x4}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x1}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x46002, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) accept$ax25(r1, 0x0, &(0x7f0000000100)) 14:07:49 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x1, &(0x7f0000000000)=[{0x20, 0x0, 0x8, 0x1f}]}) 14:07:49 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e7, &(0x7f0000000100)="fa32a4bc79b58799a70ebbc6e270d92a94442f1f8dffd31d6c4a2c39b8faeaa81332110cddd7353ca65ad44542d8aac77bf643755d68fc083a003b30adf9b4f625b119595ac23e5e2f4d5e662b6bcb6b900065886d12778c964b5dc131fc5dc58300426d39a5eb22b6ec12c8d781ddf72d5e2ecce1124bbc9706047649cae9056205d2a6966072be0742b9a54fa73218c64c376d2558db42e475b8add3f2438d5b8e7043fb018c96f0cb77f5b3d7f3f7f1a76696a4d55b0bd1ad9b5df30ec1550887ee76c9346608352945fec16ff612aa679567496655f4bdf355b4da8db8cb1d0a773c747596f62824728630b176a7a7725dbfa1a95ceac91337647c78ac0d9417ba7115ce6f7bfac73c1774b77fa5846681da083521fb79d5f0460593abd1c51b8d2b2359fc81522365672d44e88c8d87ac96654665ecda96e38388bc7a295affdb3e162fde00caada35fea6aa6f53cd5e77eba659e14df4047214bc98cacbe1d26c843d9468540d757dbe3fe2cf7b05baf8bcdb192ac6d73844f36ba172017e73281efc4fafaae3c9e0bafe8d2b20c85283bd7874442deb6a1d5711790bab6857d94e4a3ce6d0e4f79cdcd7345bc0e9463f3ff5a5a964a0f7dfa657a266a578fd6163c8431bef2442c82b6914490f1e926ecb091fe0525749b4b4f6523a829f909c3f4f56f4ce96953c797769a762dc86bc2611e528eb55c170d6cd0438f003a3008c3b915f894d4a15583878c1ae969983cfd008a94f86bb58aa175fdd4188d67291a73281fb6a2f15220c80244547cd69032de8935f30bd092626d89c262d8a59debc6741202ef5d3d99864107216725da8dd9bc1056b6fed647e683a028e091613342ff46229b07299224f320f1ed3cb3c716f7b3cf6c1010d5cda6402ac2678c6302ed380742b9c628e18293165a5d8feaeccc34faea6c4c0463def86426de82fe15e5738f3d1dcc403d8221bb1b0eeba65b3065b86c10aaca2b38c9bd51029c98eb7d11825dd8547c427153c8855cb8298841c8c5f7bb754ca097a696c38fbc4c23500647de19eaf3827de9f560662f1bd03853c2a21727b9da04f5059d0c66c4eeb4435a2d51cbe45fc7343666d1d5de1ec4e6a53031946444dc95a1d7e062716309bfbe3d6a76f99787a73caef5b1907067e5120c57ccdfd994204fcbb84b05c9d4b25965910144d8153135bf98474747b03d253a53dab64693d61fdbd83ba9fd54b7d893cd728dc68c0707a9bb9a97553e781b13e10cbd3df5b93b7e185f0dc4984ad635d43e54be5a34c7d658cdd3c8eec7cfeac54183a30bdc92f29974bec8ec96e19e4957b6aa591bcd4ca499e89d2ac5b4d65e6895cce9403fe1e452c5ede1703c1047f3a8f723e9246cdccf4d2a98ea8407ac0e0f9362883bfb074b7c2382ef0464026a5e1e53a42cbeff664490652fbce9b38b02843d336f73f44bd3ea3d46a33b6fe59aff96128a68910bc01e85ff53d728b6450bca1ec40c7d0d590fddb72bd1b2e826a8d5cd7ec8c391f36f692e345989b9dc1c40b1a14572eaa600bc514f66d3ee427a50c1e9ba8e1a6958588a0e7072fdd18767156c66c85b005c3f4412c690d76243607c3fb718d63c33914c228d1d6fe88a9aa5956ed3d60dbf75f51b0c6602d5c0824a35120f4b3e97f98b55a7c736abde81bc0c6c74439347daf1b72d285fc7c5aa2c43b8cc264d7bd9424de075903e394b81fc5faed8dce7e34d60bbfff08d89edda2d7c95ac68bda0b1dd4d201cc14f374dab8cf840d13b639f2d3eced5ef912779e3998af23848587dd971b006ce3d16b8ca0a41fe7b2904f46cd9b5f4c884a6f84f7e5e9ba6034ff6b2b3e53a10d3c954638c0029f73d2f085c2b2ca4f8b65f93a420c4a7959ad8a2aee647fe89bd4f6c910d8510b44376b10d4d447c3b5a06361108758dbade547ff4668d8dc84770565ff52053091e9cb2b75f3c575d99bc9d7c3d3ba779c543e474445bf41b3ed802542019893a45f34f8a8c0416076f32d6538a1f644674a5870172d846dc69e0d116ee5d1514124952f0e7a80c0ec00fb77ca4b4bb8b4385002c0b08dfa55b9bc9071cf47523a132b2d51b530356ca40532bb7f9452d1a60ff6042c8bd2e8343295946dca270010776e6b18b75db1b83fe230459cc08bf03328af27f5178fa6db96b7c0e49ba24df3a1c22c867b12758e3056fa4299ba5eeb8cacb424bc1b1c5e5da34d0248888738c06f9a78e3133bceec0405c53548f28b40f093a3c385b3f9a8eac6c41ca188add06b151a51cdd617b2a9073c9a11973329ac0d94701788d76a905534878f825f7ba644b288d5f5afabef101e0718e1df08adf15816227b881aaf94b95b7567c6eb6262c819df10c56ca18b10df9a37427a91346e0334720d31cc575c66503c6f4eed4601bc02c2bc98ba409c66d6c9d57c363e4799376d67b1d4500b418ca8897c7bce26a2205d8db801ff230a9b5ee5540f38a3b8df16fd5c2ff8e0604a20f7b0cc7459d7db1cd793b68911a39698c5d1daee837535cd8906b9748ec13e3b1ba5fb25147172227b17238a35cc594672d1a91b306a0fda9544289e13ac07ff34f73cabccfd5ae8cf3616fe039e1293951d9271669dd6880687ab9812d8eb72f55f2ddde2acd5fd52334199ea48a2395634fb6b81fe333952c866b8eeff2a50ddf0c50b5a1cba771ddf408a1f94cc7eed7aba09e5bfb56b3be87c41af81ea196791cb6840e38c1ba5ca26fa0e0308ff92b55fd25b63fec5d9d64502865516f558175ee90813a397d32db92532fa5b982ba5a7b62286330828bbfabf812e50a1e54b6ffba4213505aae66454e6d0de2ea1352b959ed79795baffddb22b1fea9fa082dfb9aa92d769c0579e2440991abc0c8c360e163d47baa2a10eee50d21075d82e368987da52c83bc7d44c6baf7f8631455341f53d33099e3ddc56791f7a3b2ec2fcd66aec6fef7473d486d940ad1e150d40c3cf8759b717e54913b87eb5318d8e5393d12513ae9a01f02659cf2856166a46cd38589ed91e9b947722f56253b19419f426259c9695db186181e6a463c179b9b2a952a95e15dd8ab4f9b7652918c4b12c52c2981c053f5d1532fcf8fb74473fee4186f884656a68356f2bc6a775c49090eb06bf8ba6dffdca6a34193a067882ed819ca7fc4a2ef424e3691fac8b027382edacb27cab13d1ea6a3ef88bd2b417cc08c69a103faa834cc801d6acbd1be4b04eea4d0f6ca662308a34eefb551d245ada8a2d1eac4af8d28253dd9cc94e589d5a8c9d8419e19e54e00ce4e32270e88715feb12c9da7fe0293f4e6dcedf319a35d36b9eb831ab99a8d2b4fd7b8e6c4fc097577cec4d8730d3a922fb41b712d39a42fd18aaed8a1bd7d9049c2091144dcb574cbbc646beceeb9cf04e5ef1d13cb4c0996d9e4c496b99ba46794ced8b79439e28ed31977843391fbe67ef915a4ee2aba6a98830d1a2671e7025de84eebbf3fe0e52bb112d1de7bd0c37101fbf2d7f11a726b79b48846180c01c3f9b9062a7b33a8e8e1ebcb695c6877529ccedf3bdc70c6f8ca4ae3ff7ef01396ca6a42fd928279316a25ddebd029f463b7bb30697b8aa0b387d165fb8dab9df2528742eece51f34c9221f6349bee23b4d53b5236e13f912266c399e1daa607656fe7077dd054d825afcf995477764fed1bde6ba808445f5311e907e9b6b539f8021988a87af4dc64db50dcd4ba67bae05a98a07f8ed0ef481662fcc3a6554e3c40518f4376fbda842bbdb6f28f8e0621f04f9accb7084cf77448a8489e2945363b326f08f87f033517b12b1fd915df9657bbaf2280a9c1f346fe0e6d743f0a0b8c49d964757461728dcc20c29537289fdc4be2ccd4439f7f2da1492b9d9436e9eb48c92b209ff381070e3bbb3b8a5fc35803bd3c5007da4ec3fa4d4d4ff0cc38cc4681889e75dedcd654ffddb6e4293c5b7b86a5c03aae7e70c73b10d8c91568aaf7a971e0640f061de006d527545313b6e3183de57dddaa1c9ffc6078b5283a3d5818d3c3892bdb416af87d4afa529267d369f52a82d1834981ba03836ff212a133aa746ea2548f0d9535cffb8d51e713f6c9d792c7f4491b4d915719a963000d7ee37af9bbef9b830f358f2773e2077a98fee9d0048ff465ca02a70f746138a2e8d6b0cb7834ea9f625b3c4d74f6332944e5bc4fa26a864fc15ba83b18ed988d2ca7a8a8086896dbc9fb38ffa3f3258cb9838d9446ff105b2f899e62eef931a1112898419ff003db0a8ff2ea928a15f70f140534c779e855adb7d75fa32f2e9c1fa7e72edeeae3b6582def39366fc54e7124bc32f91e61d9e07b61c4c932117b473ab696a5565f914295b6e1ac4a2764adcfaa9c52df78caa6361ed129184ccccd1d83619e66cf85e80948c8e007b5091c93f5549a81f626255a777d6e811d0cbad10c7793b44ba9276d8a2d87d3a9dde19d15ff1f55ec507390c37b897fa46e56d588299604966b01722d454d6e384b5fb5d4aa8ade565f1ce110352ee951fe7206cf3ea83a3fc40f1e8a1d4f618d171e80eef52acb46d3a75c11e1777d084cb1fd60a11c1745e71ca6160fe60938212dac368987407f09d88da18e4dd033770bfcfa897edb2ace0222191c7900f9814beddf909e87644c83532e1c3fd8b54856180c8437fc819970bd90ed3f4976da4b323880f0d221d1b4b5a22e4341fc0f27d59a20a47b9c3dfab31098ed590e5d6e140f0a26148400da6e334b188625702dc8e04a9fe3e686f65171a930fc70507a096d9b3bed3ab9d32559399528d40b8a95227b2367684b1603115b969aec988360913726022502d438465342e08e9177638d7a0e2563cc5748b827ce9d36977684cb06073021365771fad27d879b806433795dc6661fb1579a2c1a87c1513568673142103b83b18e12a1fa1f6202b0b182ff8159a9d8ec0977479f435e80ff16899028a56522838873bfcf72f616b7149895e27912d38e3f57a51560454adc65e5cd0f096330f4c0a9318d8db1b3e257fcb947d57926d6a7bf90930273020a3e1257beeece3c52f518f8b9cac7c6a381f3da30e997adfbdcfdb5461168cea582b579e12fb4c6cbb79925ff922f0a2f75f655af0a39ff9e90dd58d5d53e8d2484330da7b47849844eddb124c85f88800851283c762fa382e7b26e8fa95a67452046d81b89854148b687c7da8db81633c349f7469d85a367988b29e29d6a552c6121ffe04986e00a027629e1401b6a03a509e6696cc6b6093fa03adaea3810a824598803efcc8c450bcf178a9ba4ce1c0664eec5065bd4ab2f183029cdc93ff44dc7721ee7360a4c7cdce2d11ee7ccd7d4aeb3262d4bc03405a5c8fd2dab41666ce93320c0cf61f06f5f8cd40eb233cce335247539393740035ac670ef0ac8c26336f1d4131c5cce22b9a108101acfc3f79ec373d634b558f91b28eec2f2f8e44fb87d5181689176798e7bf32654efcaa28d4ee8bc5a72d8fdc0a59f009ba0460d5596f4266e7672f1bee998ae9a86e33c80c745a44611ba41dfbae06e4f39c3c230d2291ea801683889d0a1c195699f2aca778c9725b34c0bd720b5239c057447c2442d6b21867dd5cbd64278c2da82f5416c8fc4300de66b742f6addb07bd40d029522469780892e98d9cff3be3e1b4d46c4bb7b480792582d1abe25883d517ca79c14d72b5eb8d3656b731a4c6ab757db4180345b02619534f4b17e557f335c9fa4ba565e8227a5f0884674b93ba5a9e6470996e070b99a9b6a14a55fe79c34147734b0ccfab552a544d5e2f1bb8a4562c84b8dfbf8664") r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$unix(0x1, 0x1, 0x0) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x4}, 0xfffffffffffffeaf) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) sendto$unix(0xffffffffffffffff, &(0x7f0000001100)="43fb603d0a906d33a8985b834f2cbb7ac71cbb0cc93ee55fddfe21a903afc4494bb97315de17ad531c6b2d42dbb8b6aad614e575ab0275b2e91bb70f5f75ec5f2f921080db44cb42c98e7ba66407435354f0b51ea1a684b9d1", 0x59, 0x4000800, &(0x7f0000001180)=@abs={0x1, 0x0, 0x4e23}, 0x6e) 14:07:49 executing program 4: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)={0x0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0}) (async) r3 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r3, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async, rerun: 32) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async, rerun: 32) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r3, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r4, r5, r6, r7, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) (async, rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(0xffffffffffffffff, 0xc02064c3, &(0x7f0000000480)={&(0x7f0000000440)=[r4], 0x2, 0x1, 0x1}) (async, rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r0, 0xc02864ca, &(0x7f0000000180)={&(0x7f0000000100)=[r1, r2, 0x0, r4], &(0x7f0000000140)=[0x8001, 0x4, 0x7], 0x9, 0x4, 0x6}) (async) r8 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r8, &(0x7f00000004c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000400)={&(0x7f0000000200)={0x30, 0x1404, 0x10, 0x70bd28, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x8040}, 0x2000c001) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r10, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r9, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:49 executing program 0: recvmmsg$unix(0xffffffffffffffff, &(0x7f00000016c0)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000001380)=[{&(0x7f0000000100)=""/69, 0x45}, {&(0x7f0000000180)=""/4096, 0x1000}, {&(0x7f0000001180)}, {&(0x7f00000011c0)=""/171, 0xab}, {&(0x7f0000001280)=""/202, 0xca}], 0x5, &(0x7f0000001400)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000001440), 0x6e, &(0x7f0000001540)=[{&(0x7f00000014c0)=""/84, 0x54}], 0x1, &(0x7f0000001780)=ANY=[@ANYBLOB="28000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000bc5d58f000000010000007bd83b40d55c74ae522a2b76327d0f5f1fe0d70ea0cc8068403cd6938ebada0437773664f2dcf44241d387b2a8a9b517c4e67710e51445bb3d6fbe79679786f048dda098e81d667d82260fb69d37247018df80e09bba407a5220a3ad1cd04c3fe56f3a4ce3c2ccf817648da659d767a7a9f784db68e56cdd046459", @ANYRES32, @ANYRES32, @ANYBLOB="1c0000000000000001f83d6ea000689f", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x130}}], 0x2, 0x0, &(0x7f0000001740)) r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000001180), 0x42a142) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000001580)={0x0}) r2 = socket$unix(0x1, 0x5, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000001a00)=ANY=[@ANYBLOB="a6a0e446edf62846552a5826bca456f998aea847cc46be93f785d03b94bba230ca"], 0x7) ioctl$sock_bt_hci(r3, 0x400448dd, &(0x7f0000001940)="5cd99aae58db6873c305ad47e8dddc465323e8dfaa9a8fa74098ca9119f8b018a49f6465997960a67f0d4a398c227f53700b58787ab421137328f1ec8611bde21c9056929e9e3f44e9522b8b7132dfc2f9bc8bc7c720ae79c4ee89dec34e31fd31dcd1bd6a84e548230008105d87e0ef9e6474b4e607911ae361409e54dd94b08819c7e6108a40bf82517dcd6407be4c6de5bea42508d81b57aeb6dae9") recvmsg$unix(r2, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000001600)={r1, 0x1, r2, 0x9, 0x80000}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000001640)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000001680)={0x0, 0x0, r4}) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000040)={0x6d, [0x897, 0x3], 0x79}, 0x10) recvmmsg$unix(0xffffffffffffffff, &(0x7f00000016c0)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000001380)=[{&(0x7f0000000100)=""/69, 0x45}, {&(0x7f0000000180)=""/4096, 0x1000}, {&(0x7f0000001180)}, {&(0x7f00000011c0)=""/171, 0xab}, {&(0x7f0000001280)=""/202, 0xca}], 0x5, &(0x7f0000001400)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000001440), 0x6e, &(0x7f0000001540)=[{&(0x7f00000014c0)=""/84, 0x54}], 0x1, &(0x7f0000001780)=ANY=[@ANYBLOB="28000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000bc5d58f000000010000007bd83b40d55c74ae522a2b76327d0f5f1fe0d70ea0cc8068403cd6938ebada0437773664f2dcf44241d387b2a8a9b517c4e67710e51445bb3d6fbe79679786f048dda098e81d667d82260fb69d37247018df80e09bba407a5220a3ad1cd04c3fe56f3a4ce3c2ccf817648da659d767a7a9f784db68e56cdd046459", @ANYRES32, @ANYRES32, @ANYBLOB="1c0000000000000001f83d6ea000689f", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x130}}], 0x2, 0x0, &(0x7f0000001740)) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000001180), 0x42a142) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000001580)) (async) socket$unix(0x1, 0x5, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r3, &(0x7f0000001a00)=ANY=[@ANYBLOB="a6a0e446edf62846552a5826bca456f998aea847cc46be93f785d03b94bba230ca"], 0x7) (async) ioctl$sock_bt_hci(r3, 0x400448dd, &(0x7f0000001940)="5cd99aae58db6873c305ad47e8dddc465323e8dfaa9a8fa74098ca9119f8b018a49f6465997960a67f0d4a398c227f53700b58787ab421137328f1ec8611bde21c9056929e9e3f44e9522b8b7132dfc2f9bc8bc7c720ae79c4ee89dec34e31fd31dcd1bd6a84e548230008105d87e0ef9e6474b4e607911ae361409e54dd94b08819c7e6108a40bf82517dcd6407be4c6de5bea42508d81b57aeb6dae9") (async) recvmsg$unix(r2, 0x0, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000001600)={r1, 0x1, r2, 0x9, 0x80000}) (async) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000001640)={0x0, 0x80000}) (async) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000001680)={0x0, 0x0, r4}) (async) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000040)={0x6d, [0x897, 0x3], 0x79}, 0x10) (async) [ 2823.516026] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2823.523279] R13: 00007ffc50ba1d5f R14: 00007f66a9526300 R15: 0000000000022000 14:07:49 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x1, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0x1f}]}) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x4}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x1}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x46002, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) (async) accept$ax25(r1, 0x0, &(0x7f0000000100)) 14:07:49 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x1, &(0x7f0000000000)=[{0x20}]}) 14:07:49 executing program 0: ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'ip_vti0\x00', &(0x7f0000000140)={'tunl0\x00', 0x0, 0x7, 0x1, 0x8, 0x10001, {{0x7, 0x4, 0x3, 0x3f, 0x1c, 0x65, 0x0, 0x3, 0x4, 0x0, @empty, @local, {[@generic={0x86, 0x5, "f0a3be"}]}}}}}) r1 = openat$mice(0xffffffffffffff9c, &(0x7f00000001c0), 0x1d3602) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000280), 0x341402) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x5, 0xc7b, 0x8, 0x4, 0x620, 0x1, 0xab5, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2, 0x4}, 0x48) syz_open_dev$dri(&(0x7f0000000440), 0x8000000000000000, 0x140) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20080, 0x0) write$apparmor_current(r4, 0x0, 0x0) r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000340)={0x0, 0x1}, 0xc) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x24000, 0x0) write$apparmor_current(r6, 0x0, 0x0) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r7, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f0000000000)=@raw=[@jmp={0x5, 0x1, 0x9, 0x5, 0x1, 0x50, 0x10}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', r0, 0x0, r1, 0x8, &(0x7f0000000200)={0xa, 0x2}, 0x8, 0x10, &(0x7f0000000240)={0x4, 0x3, 0x5, 0x3}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000380)=[r2, r3, 0x1, r4, r5, r6, r7]}, 0x80) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r8, 0x400448de, &(0x7f0000000080)="9eb7001edebf6a5904b8950182d067743e262c9cd932eef387e422a91547c878522d0dc8fb8a5a77c2e1ca296917087f891faff3c3c068b9e70a5b209036bf43451afa26e7ae3089c2") bind$bt_hci(r8, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:49 executing program 1: ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x27, 0x10000, 0xa, 0xa, 0x0, 0x183}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)="4ef11a820f0ee7ec2196ffff58a263d1d12227d6dbc9b84a765d251ac6d3da568e6f2b63aa4118dcdd9e31944af10000c6ea6fa15e35b70d000000006a6b3ba484c5bc47d128836a") 14:07:49 executing program 2: openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r0, 0x0, 0x0) getsockname$unix(r0, &(0x7f0000000100)=@abs, &(0x7f0000000080)=0x6e) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x3}, 0x6) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000000)=0x2) 14:07:49 executing program 4: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0}) (async) r3 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r3, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r3, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r4, r5, r6, r7, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(0xffffffffffffffff, 0xc02064c3, &(0x7f0000000480)={&(0x7f0000000440)=[r4], 0x2, 0x1, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r0, 0xc02864ca, &(0x7f0000000180)={&(0x7f0000000100)=[r1, r2, 0x0, r4], &(0x7f0000000140)=[0x8001, 0x4, 0x7], 0x9, 0x4, 0x6}) (async) r8 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r8, &(0x7f00000004c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000400)={&(0x7f0000000200)={0x30, 0x1404, 0x10, 0x70bd28, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x8040}, 0x2000c001) (async) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r10, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r9, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000000)=0x2) 14:07:49 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_ROPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x71, 0x1, {{0x2, 0x2}, 0x8}}, 0x18) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x2, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000000)=0x2) 14:07:49 executing program 2: openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r0, 0x0, 0x0) getsockname$unix(r0, &(0x7f0000000100)=@abs, &(0x7f0000000080)=0x6e) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x3}, 0x6) openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(r0, 0x0, 0x0) (async) getsockname$unix(r0, &(0x7f0000000100)=@abs, &(0x7f0000000080)=0x6e) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x3}, 0x6) (async) 14:07:49 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_ROPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x71, 0x1, {{0x2, 0x2}, 0x8}}, 0x18) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$P9_ROPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x71, 0x1, {{0x2, 0x2}, 0x8}}, 0x18) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:49 executing program 0: ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'ip_vti0\x00', &(0x7f0000000140)={'tunl0\x00', 0x0, 0x7, 0x1, 0x8, 0x10001, {{0x7, 0x4, 0x3, 0x3f, 0x1c, 0x65, 0x0, 0x3, 0x4, 0x0, @empty, @local, {[@generic={0x86, 0x5, "f0a3be"}]}}}}}) r1 = openat$mice(0xffffffffffffff9c, &(0x7f00000001c0), 0x1d3602) (async) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000280), 0x341402) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x5, 0xc7b, 0x8, 0x4, 0x620, 0x1, 0xab5, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2, 0x4}, 0x48) syz_open_dev$dri(&(0x7f0000000440), 0x8000000000000000, 0x140) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20080, 0x0) write$apparmor_current(r4, 0x0, 0x0) (async) r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000340)={0x0, 0x1}, 0xc) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x24000, 0x0) write$apparmor_current(r6, 0x0, 0x0) (async) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r7, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f0000000000)=@raw=[@jmp={0x5, 0x1, 0x9, 0x5, 0x1, 0x50, 0x10}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', r0, 0x0, r1, 0x8, &(0x7f0000000200)={0xa, 0x2}, 0x8, 0x10, &(0x7f0000000240)={0x4, 0x3, 0x5, 0x3}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000380)=[r2, r3, 0x1, r4, r5, r6, r7]}, 0x80) (async) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r8, 0x400448de, &(0x7f0000000080)="9eb7001edebf6a5904b8950182d067743e262c9cd932eef387e422a91547c878522d0dc8fb8a5a77c2e1ca296917087f891faff3c3c068b9e70a5b209036bf43451afa26e7ae3089c2") (async) bind$bt_hci(r8, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) getpeername$ax25(0xffffffffffffffff, &(0x7f00000000c0)={{0x3, @rose}, [@netrom, @rose, @netrom, @rose, @default, @rose, @rose, @bcast]}, &(0x7f0000000140)=0x48) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080)=0x7fff, 0x4) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) sendto$isdn(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="06000000000000804e9f8ced9d7e16997b12f17cbf56d57af705000000000000002ebae1c5ab0c56e1de68cc7abe1879f7cff7db9d91ed3343d321bc770e774b60bb114f1c0dbe37b4b30c8d22e736f812696f874397a8d175910b7d484c81f62b15199bf80e088ca822c05060bbdaf83658483815aa05ab24a5b47600723a0424fc78d6e0b7bcb96e5cb33503a8e86d93e6eb45515ede8de160ee90009f5cb77563b27c2dc2d627ab40ed39699aa919d2d9693f8f4b688e471ca0343bf7"], 0xbe, 0x4000, &(0x7f0000000300)={0x22, 0x74, 0x8, 0x2, 0x93}, 0x6) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r2, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCALLUSERDATA(r2, 0x89e5, &(0x7f0000000180)={0x65, "fb1a16052260f1529b622fe60493a3fcea70c345a23aaaa2a1b06b6c1975044bdeb74335d1908d687b485b7aa4ae2322d40b1c8976282fffba9eacdbd02a58814d97e170de022f2d5244d6016ee6fb3fb4fc51cf7b372087fe4e6741d9754618e52455142efb0af872f732d1fe578364a08e658772cc0b945a0f91a12c6c9fc2"}) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x38e2b9b, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:49 executing program 1: ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x27, 0x10000, 0xa, 0xa, 0x0, 0x183}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)="4ef11a820f0ee7ec2196ffff58a263d1d12227d6dbc9b84a765d251ac6d3da568e6f2b63aa4118dcdd9e31944af10000c6ea6fa15e35b70d000000006a6b3ba484c5bc47d128836a") ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x27, 0x10000, 0xa, 0xa, 0x0, 0x183}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)="4ef11a820f0ee7ec2196ffff58a263d1d12227d6dbc9b84a765d251ac6d3da568e6f2b63aa4118dcdd9e31944af10000c6ea6fa15e35b70d000000006a6b3ba484c5bc47d128836a") (async) 14:07:49 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$P9_ROPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x71, 0x1, {{0x2, 0x2}, 0x8}}, 0x18) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) getpeername$ax25(0xffffffffffffffff, &(0x7f00000000c0)={{0x3, @rose}, [@netrom, @rose, @netrom, @rose, @default, @rose, @rose, @bcast]}, &(0x7f0000000140)=0x48) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080)=0x7fff, 0x4) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) sendto$isdn(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="06000000000000804e9f8ced9d7e16997b12f17cbf56d57af705000000000000002ebae1c5ab0c56e1de68cc7abe1879f7cff7db9d91ed3343d321bc770e774b60bb114f1c0dbe37b4b30c8d22e736f812696f874397a8d175910b7d484c81f62b15199bf80e088ca822c05060bbdaf83658483815aa05ab24a5b47600723a0424fc78d6e0b7bcb96e5cb33503a8e86d93e6eb45515ede8de160ee90009f5cb77563b27c2dc2d627ab40ed39699aa919d2d9693f8f4b688e471ca0343bf7"], 0xbe, 0x4000, &(0x7f0000000300)={0x22, 0x74, 0x8, 0x2, 0x93}, 0x6) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r2, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCALLUSERDATA(r2, 0x89e5, &(0x7f0000000180)={0x65, "fb1a16052260f1529b622fe60493a3fcea70c345a23aaaa2a1b06b6c1975044bdeb74335d1908d687b485b7aa4ae2322d40b1c8976282fffba9eacdbd02a58814d97e170de022f2d5244d6016ee6fb3fb4fc51cf7b372087fe4e6741d9754618e52455142efb0af872f732d1fe578364a08e658772cc0b945a0f91a12c6c9fc2"}) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x38e2b9b, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) getpeername$ax25(0xffffffffffffffff, &(0x7f00000000c0)={{0x3, @rose}, [@netrom, @rose, @netrom, @rose, @default, @rose, @rose, @bcast]}, &(0x7f0000000140)=0x48) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080)=0x7fff, 0x4) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) sendto$isdn(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="06000000000000804e9f8ced9d7e16997b12f17cbf56d57af705000000000000002ebae1c5ab0c56e1de68cc7abe1879f7cff7db9d91ed3343d321bc770e774b60bb114f1c0dbe37b4b30c8d22e736f812696f874397a8d175910b7d484c81f62b15199bf80e088ca822c05060bbdaf83658483815aa05ab24a5b47600723a0424fc78d6e0b7bcb96e5cb33503a8e86d93e6eb45515ede8de160ee90009f5cb77563b27c2dc2d627ab40ed39699aa919d2d9693f8f4b688e471ca0343bf7"], 0xbe, 0x4000, &(0x7f0000000300)={0x22, 0x74, 0x8, 0x2, 0x93}, 0x6) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) ioctl$SIOCX25GDTEFACILITIES(r2, 0x89ea, &(0x7f0000000000)) (async) ioctl$SIOCX25SCALLUSERDATA(r2, 0x89e5, &(0x7f0000000180)={0x65, "fb1a16052260f1529b622fe60493a3fcea70c345a23aaaa2a1b06b6c1975044bdeb74335d1908d687b485b7aa4ae2322d40b1c8976282fffba9eacdbd02a58814d97e170de022f2d5244d6016ee6fb3fb4fc51cf7b372087fe4e6741d9754618e52455142efb0af872f732d1fe578364a08e658772cc0b945a0f91a12c6c9fc2"}) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x38e2b9b, 0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:07:49 executing program 2: openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r0 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r0, 0x0, 0x0) getsockname$unix(r0, &(0x7f0000000100)=@abs, &(0x7f0000000080)=0x6e) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x3}, 0x6) 14:07:49 executing program 0: ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'ip_vti0\x00', &(0x7f0000000140)={'tunl0\x00', 0x0, 0x7, 0x1, 0x8, 0x10001, {{0x7, 0x4, 0x3, 0x3f, 0x1c, 0x65, 0x0, 0x3, 0x4, 0x0, @empty, @local, {[@generic={0x86, 0x5, "f0a3be"}]}}}}}) r1 = openat$mice(0xffffffffffffff9c, &(0x7f00000001c0), 0x1d3602) (async) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000280), 0x341402) (async, rerun: 32) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x5, 0xc7b, 0x8, 0x4, 0x620, 0x1, 0xab5, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2, 0x4}, 0x48) (async, rerun: 32) syz_open_dev$dri(&(0x7f0000000440), 0x8000000000000000, 0x140) (async, rerun: 64) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20080, 0x0) (rerun: 64) write$apparmor_current(r4, 0x0, 0x0) (async) r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000340)={0x0, 0x1}, 0xc) (async) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x24000, 0x0) write$apparmor_current(r6, 0x0, 0x0) (async) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r7, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f0000000000)=@raw=[@jmp={0x5, 0x1, 0x9, 0x5, 0x1, 0x50, 0x10}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', r0, 0x0, r1, 0x8, &(0x7f0000000200)={0xa, 0x2}, 0x8, 0x10, &(0x7f0000000240)={0x4, 0x3, 0x5, 0x3}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000380)=[r2, r3, 0x1, r4, r5, r6, r7]}, 0x80) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r8, 0x400448de, &(0x7f0000000080)="9eb7001edebf6a5904b8950182d067743e262c9cd932eef387e422a91547c878522d0dc8fb8a5a77c2e1ca296917087f891faff3c3c068b9e70a5b209036bf43451afa26e7ae3089c2") (async, rerun: 64) bind$bt_hci(r8, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (rerun: 64) 14:07:49 executing program 1: ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x27, 0x10000, 0xa, 0xa, 0x0, 0x183}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)="4ef11a820f0ee7ec2196ffff58a263d1d12227d6dbc9b84a765d251ac6d3da568e6f2b63aa4118dcdd9e31944af10000c6ea6fa15e35b70d000000006a6b3ba484c5bc47d128836a") 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) getpeername$ax25(0xffffffffffffffff, &(0x7f00000000c0)={{0x3, @rose}, [@netrom, @rose, @netrom, @rose, @default, @rose, @rose, @bcast]}, &(0x7f0000000140)=0x48) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080)=0x7fff, 0x4) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) sendto$isdn(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="06000000000000804e9f8ced9d7e16997b12f17cbf56d57af705000000000000002ebae1c5ab0c56e1de68cc7abe1879f7cff7db9d91ed3343d321bc770e774b60bb114f1c0dbe37b4b30c8d22e736f812696f874397a8d175910b7d484c81f62b15199bf80e088ca822c05060bbdaf83658483815aa05ab24a5b47600723a0424fc78d6e0b7bcb96e5cb33503a8e86d93e6eb45515ede8de160ee90009f5cb77563b27c2dc2d627ab40ed39699aa919d2d9693f8f4b688e471ca0343bf7"], 0xbe, 0x4000, &(0x7f0000000300)={0x22, 0x74, 0x8, 0x2, 0x93}, 0x6) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r2, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCALLUSERDATA(r2, 0x89e5, &(0x7f0000000180)={0x65, "fb1a16052260f1529b622fe60493a3fcea70c345a23aaaa2a1b06b6c1975044bdeb74335d1908d687b485b7aa4ae2322d40b1c8976282fffba9eacdbd02a58814d97e170de022f2d5244d6016ee6fb3fb4fc51cf7b372087fe4e6741d9754618e52455142efb0af872f732d1fe578364a08e658772cc0b945a0f91a12c6c9fc2"}) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x38e2b9b, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) getpeername$ax25(0xffffffffffffffff, &(0x7f00000000c0)={{0x3, @rose}, [@netrom, @rose, @netrom, @rose, @default, @rose, @rose, @bcast]}, &(0x7f0000000140)=0x48) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080)=0x7fff, 0x4) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) sendto$isdn(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="06000000000000804e9f8ced9d7e16997b12f17cbf56d57af705000000000000002ebae1c5ab0c56e1de68cc7abe1879f7cff7db9d91ed3343d321bc770e774b60bb114f1c0dbe37b4b30c8d22e736f812696f874397a8d175910b7d484c81f62b15199bf80e088ca822c05060bbdaf83658483815aa05ab24a5b47600723a0424fc78d6e0b7bcb96e5cb33503a8e86d93e6eb45515ede8de160ee90009f5cb77563b27c2dc2d627ab40ed39699aa919d2d9693f8f4b688e471ca0343bf7"], 0xbe, 0x4000, &(0x7f0000000300)={0x22, 0x74, 0x8, 0x2, 0x93}, 0x6) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) ioctl$SIOCX25GDTEFACILITIES(r2, 0x89ea, &(0x7f0000000000)) (async) ioctl$SIOCX25SCALLUSERDATA(r2, 0x89e5, &(0x7f0000000180)={0x65, "fb1a16052260f1529b622fe60493a3fcea70c345a23aaaa2a1b06b6c1975044bdeb74335d1908d687b485b7aa4ae2322d40b1c8976282fffba9eacdbd02a58814d97e170de022f2d5244d6016ee6fb3fb4fc51cf7b372087fe4e6741d9754618e52455142efb0af872f732d1fe578364a08e658772cc0b945a0f91a12c6c9fc2"}) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x38e2b9b, 0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:07:49 executing program 4: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:49 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000080)={0x9}) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x84d5, [0x0, 0xffffffff], 0x8}, 0x10) 14:07:49 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000005600)) recvmmsg$unix(r1, &(0x7f00000085c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)=""/32, 0x20}, {&(0x7f0000000040)=""/188, 0xbc}], 0x2, &(0x7f0000000140)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x100}}, {{&(0x7f0000000240)=@abs, 0x6e, &(0x7f00000003c0)=[{&(0x7f00000002c0)=""/221, 0xdd}], 0x1, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa8}}, {{&(0x7f00000004c0)=@abs, 0x6e, &(0x7f00000018c0)=[{&(0x7f0000000540)=""/148, 0x94}, {&(0x7f0000000600)=""/16, 0x10}, {&(0x7f0000000640)=""/178, 0xb2}, {&(0x7f0000000700)=""/61, 0x3d}, {&(0x7f0000000740)=""/148, 0x94}, {&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/146, 0x92}], 0x7, &(0x7f0000001940)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xd8}}, {{&(0x7f0000001a40)=@abs, 0x6e, &(0x7f0000004000)=[{&(0x7f0000001ac0)=""/5, 0x5}, {&(0x7f0000001b00)=""/6, 0x6}, {&(0x7f0000001b40)=""/252, 0xfc}, {&(0x7f0000001c40)=""/4096, 0x1000}, {&(0x7f0000002c40)=""/157, 0x9d}, {&(0x7f0000002d00)=""/4096, 0x1000}, {&(0x7f0000003d00)=""/81, 0x51}, {&(0x7f0000003d80)=""/207, 0xcf}, {&(0x7f0000003e80)=""/199, 0xc7}, {&(0x7f0000003f80)=""/74, 0x4a}], 0xa}}, {{&(0x7f00000040c0), 0x6e, &(0x7f0000004140), 0x0, &(0x7f0000004180)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x128}}, {{&(0x7f00000042c0), 0x6e, &(0x7f00000055c0)=[{&(0x7f0000004340)=""/4096, 0x1000}, {&(0x7f0000005340)=""/188, 0xbc}, {&(0x7f0000005400)=""/225, 0xe1}, {&(0x7f0000005500)=""/174, 0xae}], 0x4, &(0x7f0000005600)}}, {{&(0x7f0000005640)=@abs, 0x6e, &(0x7f0000006a80)}}, {{&(0x7f0000006b40)=@abs, 0x6e, &(0x7f0000006e80)=[{&(0x7f0000006bc0)=""/222, 0xde}, {&(0x7f0000006cc0)=""/194, 0xc2}, {&(0x7f0000006dc0)=""/139, 0x8b}], 0x3, &(0x7f0000006ec0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x120}}, {{0x0, 0x0, &(0x7f00000084c0)=[{&(0x7f0000007000)=""/70, 0x46}, {&(0x7f0000007080)=""/156, 0x9c}, {&(0x7f0000007140)=""/4096, 0x1000}, {&(0x7f0000008140)=""/165, 0xa5}, {&(0x7f0000008200)=""/129, 0x81}, {&(0x7f00000082c0)=""/249, 0xf9}, {&(0x7f00000083c0)=""/241, 0xf1}], 0x7, &(0x7f0000008540)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x60}}], 0x9, 0x40, &(0x7f0000008800)={0x77359400}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000008840)={0x0}) r4 = openat$mice(0xffffffffffffff9c, &(0x7f00000056c0), 0x210000) write$bt_hci(r4, &(0x7f0000005700)={0x1, @delete_stored_link_key={{0xc12, 0x7}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7e}}}, 0xb) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000004140)={r3, 0x1, r0, 0x0, 0x80000}) 14:07:49 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000000)=0xffffffbf, 0x4) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$HCIINQUIRY(r2, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:49 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) (async) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f0000000000)) (async, rerun: 64) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000080)={0x9}) (async, rerun: 64) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x84d5, [0x0, 0xffffffff], 0x8}, 0x10) 14:07:49 executing program 4: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x2, 0x6, "b594bf", 0x0, 0x2}) 14:07:49 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000005600)) recvmmsg$unix(r1, &(0x7f00000085c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)=""/32, 0x20}, {&(0x7f0000000040)=""/188, 0xbc}], 0x2, &(0x7f0000000140)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x100}}, {{&(0x7f0000000240)=@abs, 0x6e, &(0x7f00000003c0)=[{&(0x7f00000002c0)=""/221, 0xdd}], 0x1, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa8}}, {{&(0x7f00000004c0)=@abs, 0x6e, &(0x7f00000018c0)=[{&(0x7f0000000540)=""/148, 0x94}, {&(0x7f0000000600)=""/16, 0x10}, {&(0x7f0000000640)=""/178, 0xb2}, {&(0x7f0000000700)=""/61, 0x3d}, {&(0x7f0000000740)=""/148, 0x94}, {&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/146, 0x92}], 0x7, &(0x7f0000001940)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xd8}}, {{&(0x7f0000001a40)=@abs, 0x6e, &(0x7f0000004000)=[{&(0x7f0000001ac0)=""/5, 0x5}, {&(0x7f0000001b00)=""/6, 0x6}, {&(0x7f0000001b40)=""/252, 0xfc}, {&(0x7f0000001c40)=""/4096, 0x1000}, {&(0x7f0000002c40)=""/157, 0x9d}, {&(0x7f0000002d00)=""/4096, 0x1000}, {&(0x7f0000003d00)=""/81, 0x51}, {&(0x7f0000003d80)=""/207, 0xcf}, {&(0x7f0000003e80)=""/199, 0xc7}, {&(0x7f0000003f80)=""/74, 0x4a}], 0xa}}, {{&(0x7f00000040c0), 0x6e, &(0x7f0000004140), 0x0, &(0x7f0000004180)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x128}}, {{&(0x7f00000042c0), 0x6e, &(0x7f00000055c0)=[{&(0x7f0000004340)=""/4096, 0x1000}, {&(0x7f0000005340)=""/188, 0xbc}, {&(0x7f0000005400)=""/225, 0xe1}, {&(0x7f0000005500)=""/174, 0xae}], 0x4, &(0x7f0000005600)}}, {{&(0x7f0000005640)=@abs, 0x6e, &(0x7f0000006a80)}}, {{&(0x7f0000006b40)=@abs, 0x6e, &(0x7f0000006e80)=[{&(0x7f0000006bc0)=""/222, 0xde}, {&(0x7f0000006cc0)=""/194, 0xc2}, {&(0x7f0000006dc0)=""/139, 0x8b}], 0x3, &(0x7f0000006ec0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x120}}, {{0x0, 0x0, &(0x7f00000084c0)=[{&(0x7f0000007000)=""/70, 0x46}, {&(0x7f0000007080)=""/156, 0x9c}, {&(0x7f0000007140)=""/4096, 0x1000}, {&(0x7f0000008140)=""/165, 0xa5}, {&(0x7f0000008200)=""/129, 0x81}, {&(0x7f00000082c0)=""/249, 0xf9}, {&(0x7f00000083c0)=""/241, 0xf1}], 0x7, &(0x7f0000008540)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x60}}], 0x9, 0x40, &(0x7f0000008800)={0x77359400}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000008840)={0x0}) r4 = openat$mice(0xffffffffffffff9c, &(0x7f00000056c0), 0x210000) write$bt_hci(r4, &(0x7f0000005700)={0x1, @delete_stored_link_key={{0xc12, 0x7}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7e}}}, 0xb) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000004140)={r3, 0x1, r0, 0x0, 0x80000}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) socket$unix(0x1, 0x2, 0x0) (async) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000005600)) (async) recvmmsg$unix(r1, &(0x7f00000085c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)=""/32, 0x20}, {&(0x7f0000000040)=""/188, 0xbc}], 0x2, &(0x7f0000000140)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x100}}, {{&(0x7f0000000240)=@abs, 0x6e, &(0x7f00000003c0)=[{&(0x7f00000002c0)=""/221, 0xdd}], 0x1, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa8}}, {{&(0x7f00000004c0)=@abs, 0x6e, &(0x7f00000018c0)=[{&(0x7f0000000540)=""/148, 0x94}, {&(0x7f0000000600)=""/16, 0x10}, {&(0x7f0000000640)=""/178, 0xb2}, {&(0x7f0000000700)=""/61, 0x3d}, {&(0x7f0000000740)=""/148, 0x94}, {&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/146, 0x92}], 0x7, &(0x7f0000001940)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xd8}}, {{&(0x7f0000001a40)=@abs, 0x6e, &(0x7f0000004000)=[{&(0x7f0000001ac0)=""/5, 0x5}, {&(0x7f0000001b00)=""/6, 0x6}, {&(0x7f0000001b40)=""/252, 0xfc}, {&(0x7f0000001c40)=""/4096, 0x1000}, {&(0x7f0000002c40)=""/157, 0x9d}, {&(0x7f0000002d00)=""/4096, 0x1000}, {&(0x7f0000003d00)=""/81, 0x51}, {&(0x7f0000003d80)=""/207, 0xcf}, {&(0x7f0000003e80)=""/199, 0xc7}, {&(0x7f0000003f80)=""/74, 0x4a}], 0xa}}, {{&(0x7f00000040c0), 0x6e, &(0x7f0000004140), 0x0, &(0x7f0000004180)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x128}}, {{&(0x7f00000042c0), 0x6e, &(0x7f00000055c0)=[{&(0x7f0000004340)=""/4096, 0x1000}, {&(0x7f0000005340)=""/188, 0xbc}, {&(0x7f0000005400)=""/225, 0xe1}, {&(0x7f0000005500)=""/174, 0xae}], 0x4, &(0x7f0000005600)}}, {{&(0x7f0000005640)=@abs, 0x6e, &(0x7f0000006a80)}}, {{&(0x7f0000006b40)=@abs, 0x6e, &(0x7f0000006e80)=[{&(0x7f0000006bc0)=""/222, 0xde}, {&(0x7f0000006cc0)=""/194, 0xc2}, {&(0x7f0000006dc0)=""/139, 0x8b}], 0x3, &(0x7f0000006ec0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x120}}, {{0x0, 0x0, &(0x7f00000084c0)=[{&(0x7f0000007000)=""/70, 0x46}, {&(0x7f0000007080)=""/156, 0x9c}, {&(0x7f0000007140)=""/4096, 0x1000}, {&(0x7f0000008140)=""/165, 0xa5}, {&(0x7f0000008200)=""/129, 0x81}, {&(0x7f00000082c0)=""/249, 0xf9}, {&(0x7f00000083c0)=""/241, 0xf1}], 0x7, &(0x7f0000008540)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x60}}], 0x9, 0x40, &(0x7f0000008800)={0x77359400}) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000008840)) (async) openat$mice(0xffffffffffffff9c, &(0x7f00000056c0), 0x210000) (async) write$bt_hci(r4, &(0x7f0000005700)={0x1, @delete_stored_link_key={{0xc12, 0x7}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7e}}}, 0xb) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000004140)={r3, 0x1, r0, 0x0, 0x80000}) (async) 14:07:49 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000080)={0x9}) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x84d5, [0x0, 0xffffffff], 0x8}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f0000000000)) (async) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000080)={0x9}) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x84d5, [0x0, 0xffffffff], 0x8}, 0x10) (async) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x2, 0x6, "b594bf", 0x0, 0x2}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x2, 0x6, "b594bf", 0x0, 0x2}) (async) 14:07:49 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000000)=0xffffffbf, 0x4) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$HCIINQUIRY(r2, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000000)=0xffffffbf, 0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r3, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) ioctl$HCIINQUIRY(r2, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:49 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000005600)) recvmmsg$unix(r1, &(0x7f00000085c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)=""/32, 0x20}, {&(0x7f0000000040)=""/188, 0xbc}], 0x2, &(0x7f0000000140)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x100}}, {{&(0x7f0000000240)=@abs, 0x6e, &(0x7f00000003c0)=[{&(0x7f00000002c0)=""/221, 0xdd}], 0x1, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa8}}, {{&(0x7f00000004c0)=@abs, 0x6e, &(0x7f00000018c0)=[{&(0x7f0000000540)=""/148, 0x94}, {&(0x7f0000000600)=""/16, 0x10}, {&(0x7f0000000640)=""/178, 0xb2}, {&(0x7f0000000700)=""/61, 0x3d}, {&(0x7f0000000740)=""/148, 0x94}, {&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/146, 0x92}], 0x7, &(0x7f0000001940)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xd8}}, {{&(0x7f0000001a40)=@abs, 0x6e, &(0x7f0000004000)=[{&(0x7f0000001ac0)=""/5, 0x5}, {&(0x7f0000001b00)=""/6, 0x6}, {&(0x7f0000001b40)=""/252, 0xfc}, {&(0x7f0000001c40)=""/4096, 0x1000}, {&(0x7f0000002c40)=""/157, 0x9d}, {&(0x7f0000002d00)=""/4096, 0x1000}, {&(0x7f0000003d00)=""/81, 0x51}, {&(0x7f0000003d80)=""/207, 0xcf}, {&(0x7f0000003e80)=""/199, 0xc7}, {&(0x7f0000003f80)=""/74, 0x4a}], 0xa}}, {{&(0x7f00000040c0), 0x6e, &(0x7f0000004140), 0x0, &(0x7f0000004180)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x128}}, {{&(0x7f00000042c0), 0x6e, &(0x7f00000055c0)=[{&(0x7f0000004340)=""/4096, 0x1000}, {&(0x7f0000005340)=""/188, 0xbc}, {&(0x7f0000005400)=""/225, 0xe1}, {&(0x7f0000005500)=""/174, 0xae}], 0x4, &(0x7f0000005600)}}, {{&(0x7f0000005640)=@abs, 0x6e, &(0x7f0000006a80)}}, {{&(0x7f0000006b40)=@abs, 0x6e, &(0x7f0000006e80)=[{&(0x7f0000006bc0)=""/222, 0xde}, {&(0x7f0000006cc0)=""/194, 0xc2}, {&(0x7f0000006dc0)=""/139, 0x8b}], 0x3, &(0x7f0000006ec0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x120}}, {{0x0, 0x0, &(0x7f00000084c0)=[{&(0x7f0000007000)=""/70, 0x46}, {&(0x7f0000007080)=""/156, 0x9c}, {&(0x7f0000007140)=""/4096, 0x1000}, {&(0x7f0000008140)=""/165, 0xa5}, {&(0x7f0000008200)=""/129, 0x81}, {&(0x7f00000082c0)=""/249, 0xf9}, {&(0x7f00000083c0)=""/241, 0xf1}], 0x7, &(0x7f0000008540)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x60}}], 0x9, 0x40, &(0x7f0000008800)={0x77359400}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000008840)={0x0}) r4 = openat$mice(0xffffffffffffff9c, &(0x7f00000056c0), 0x210000) write$bt_hci(r4, &(0x7f0000005700)={0x1, @delete_stored_link_key={{0xc12, 0x7}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7e}}}, 0xb) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000004140)={r3, 0x1, r0, 0x0, 0x80000}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) socket$unix(0x1, 0x2, 0x0) (async) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000005600)) (async) recvmmsg$unix(r1, &(0x7f00000085c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)=""/32, 0x20}, {&(0x7f0000000040)=""/188, 0xbc}], 0x2, &(0x7f0000000140)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x100}}, {{&(0x7f0000000240)=@abs, 0x6e, &(0x7f00000003c0)=[{&(0x7f00000002c0)=""/221, 0xdd}], 0x1, &(0x7f0000000400)=[@cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa8}}, {{&(0x7f00000004c0)=@abs, 0x6e, &(0x7f00000018c0)=[{&(0x7f0000000540)=""/148, 0x94}, {&(0x7f0000000600)=""/16, 0x10}, {&(0x7f0000000640)=""/178, 0xb2}, {&(0x7f0000000700)=""/61, 0x3d}, {&(0x7f0000000740)=""/148, 0x94}, {&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/146, 0x92}], 0x7, &(0x7f0000001940)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xd8}}, {{&(0x7f0000001a40)=@abs, 0x6e, &(0x7f0000004000)=[{&(0x7f0000001ac0)=""/5, 0x5}, {&(0x7f0000001b00)=""/6, 0x6}, {&(0x7f0000001b40)=""/252, 0xfc}, {&(0x7f0000001c40)=""/4096, 0x1000}, {&(0x7f0000002c40)=""/157, 0x9d}, {&(0x7f0000002d00)=""/4096, 0x1000}, {&(0x7f0000003d00)=""/81, 0x51}, {&(0x7f0000003d80)=""/207, 0xcf}, {&(0x7f0000003e80)=""/199, 0xc7}, {&(0x7f0000003f80)=""/74, 0x4a}], 0xa}}, {{&(0x7f00000040c0), 0x6e, &(0x7f0000004140), 0x0, &(0x7f0000004180)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x128}}, {{&(0x7f00000042c0), 0x6e, &(0x7f00000055c0)=[{&(0x7f0000004340)=""/4096, 0x1000}, {&(0x7f0000005340)=""/188, 0xbc}, {&(0x7f0000005400)=""/225, 0xe1}, {&(0x7f0000005500)=""/174, 0xae}], 0x4, &(0x7f0000005600)}}, {{&(0x7f0000005640)=@abs, 0x6e, &(0x7f0000006a80)}}, {{&(0x7f0000006b40)=@abs, 0x6e, &(0x7f0000006e80)=[{&(0x7f0000006bc0)=""/222, 0xde}, {&(0x7f0000006cc0)=""/194, 0xc2}, {&(0x7f0000006dc0)=""/139, 0x8b}], 0x3, &(0x7f0000006ec0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x120}}, {{0x0, 0x0, &(0x7f00000084c0)=[{&(0x7f0000007000)=""/70, 0x46}, {&(0x7f0000007080)=""/156, 0x9c}, {&(0x7f0000007140)=""/4096, 0x1000}, {&(0x7f0000008140)=""/165, 0xa5}, {&(0x7f0000008200)=""/129, 0x81}, {&(0x7f00000082c0)=""/249, 0xf9}, {&(0x7f00000083c0)=""/241, 0xf1}], 0x7, &(0x7f0000008540)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x60}}], 0x9, 0x40, &(0x7f0000008800)={0x77359400}) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000008840)) (async) openat$mice(0xffffffffffffff9c, &(0x7f00000056c0), 0x210000) (async) write$bt_hci(r4, &(0x7f0000005700)={0x1, @delete_stored_link_key={{0xc12, 0x7}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7e}}}, 0xb) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000004140)={r3, 0x1, r0, 0x0, 0x80000}) (async) 14:07:49 executing program 4: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:49 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xfffe, 0x4}, 0x6) 14:07:49 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000000)=0xffffffbf, 0x4) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$HCIINQUIRY(r2, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:49 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xfffe, 0x4}, 0x6) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x2, 0x6, "b594bf", 0x0, 0x2}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x2, 0x6, "b594bf", 0x0, 0x2}) (async) 14:07:49 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)={0x1, @write_sc_support={{0xc7a, 0x1}, {0x7}}}, 0x5) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:49 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0x0, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) write$P9_RSTATFS(r2, &(0x7f0000000100)={0x43, 0x9, 0x1, {0x2bbe, 0xffffffff, 0xc1f, 0x5, 0x800, 0x9, 0xe7, 0x8, 0xd5ea}}, 0x43) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xfffe, 0x4}, 0x4) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e21}, 0x6e) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x3}, 0x6) 14:07:49 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) write$bt_hci(r1, &(0x7f0000000000)={0x1, @role_discovery={{0x809, 0x2}, {0xc9}}}, 0x6) 14:07:49 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xfffe, 0x4}, 0x6) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f0000000080)={"a560f50ca3823e429ce8f9ff13b3d24c8d0f0c3a328d89c016dc85997b25", 0xf9, 0x0, 0x1, 0x4, 0x6, 0xd107, 0x5, 0x4, [0x9, 0x0, 0x8, 0x7fff, 0x7, 0x7ff, 0x0, 0x9, 0x1, 0x80, 0x20, 0xaa, 0xfffffff9, 0x3, 0x1ff, 0xff, 0x7, 0x10001, 0x800]}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$ax25(0xffffffffffffffff, &(0x7f0000000140)={{0x3, @null, 0x8}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x48) 14:07:49 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0x0, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) write$P9_RSTATFS(r2, &(0x7f0000000100)={0x43, 0x9, 0x1, {0x2bbe, 0xffffffff, 0xc1f, 0x5, 0x800, 0x9, 0xe7, 0x8, 0xd5ea}}, 0x43) (async) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xfffe, 0x4}, 0x4) (async) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e21}, 0x6e) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x3}, 0x6) 14:07:49 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)={0x1, @write_sc_support={{0xc7a, 0x1}, {0x7}}}, 0x5) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:49 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async, rerun: 64) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async, rerun: 64) write$bt_hci(r1, &(0x7f0000000000)={0x1, @role_discovery={{0x809, 0x2}, {0xc9}}}, 0x6) 14:07:49 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) 14:07:49 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f0000000080)={"a560f50ca3823e429ce8f9ff13b3d24c8d0f0c3a328d89c016dc85997b25", 0xf9, 0x0, 0x1, 0x4, 0x6, 0xd107, 0x5, 0x4, [0x9, 0x0, 0x8, 0x7fff, 0x7, 0x7ff, 0x0, 0x9, 0x1, 0x80, 0x20, 0xaa, 0xfffffff9, 0x3, 0x1ff, 0xff, 0x7, 0x10001, 0x800]}) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async, rerun: 64) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (rerun: 64) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$ax25(0xffffffffffffffff, &(0x7f0000000140)={{0x3, @null, 0x8}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x48) 14:07:49 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0x0, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) write$P9_RSTATFS(r2, &(0x7f0000000100)={0x43, 0x9, 0x1, {0x2bbe, 0xffffffff, 0xc1f, 0x5, 0x800, 0x9, 0xe7, 0x8, 0xd5ea}}, 0x43) (async) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xfffe, 0x4}, 0x4) (async) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e21}, 0x6e) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x3}, 0x6) 14:07:49 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)={0x1, @write_sc_support={{0xc7a, 0x1}, {0x7}}}, 0x5) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:49 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) (async) 14:07:49 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = syz_open_pts(0xffffffffffffffff, 0x40) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000000)={0x8, 0x7, 0xfffa, 0x4}) 14:07:49 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) write$bt_hci(r1, &(0x7f0000000000)={0x1, @role_discovery={{0x809, 0x2}, {0xc9}}}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) write$bt_hci(r1, &(0x7f0000000000)={0x1, @role_discovery={{0x809, 0x2}, {0xc9}}}, 0x6) (async) 14:07:50 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x2, 0x4}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x1, 0x1}, 0x6) 14:07:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f0000000080)={"a560f50ca3823e429ce8f9ff13b3d24c8d0f0c3a328d89c016dc85997b25", 0xf9, 0x0, 0x1, 0x4, 0x6, 0xd107, 0x5, 0x4, [0x9, 0x0, 0x8, 0x7fff, 0x7, 0x7ff, 0x0, 0x9, 0x1, 0x80, 0x20, 0xaa, 0xfffffff9, 0x3, 0x1ff, 0xff, 0x7, 0x10001, 0x800]}) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$ax25(0xffffffffffffffff, &(0x7f0000000140)={{0x3, @null, 0x8}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x48) 14:07:50 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) 14:07:50 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = syz_open_pts(0xffffffffffffffff, 0x40) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000000)={0x8, 0x7, 0xfffa, 0x4}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) syz_open_pts(0xffffffffffffffff, 0x40) (async) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000000)={0x8, 0x7, 0xfffa, 0x4}) (async) 14:07:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_x25_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={@null, 0x7, 'veth1_macvtap\x00'}) 14:07:50 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x2, 0x4}, 0x6) (async, rerun: 32) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (rerun: 32) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x1, 0x1}, 0x6) 14:07:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) ioctl$sock_x25_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={@null, 0x7, 'veth1_macvtap\x00'}) (rerun: 64) 14:07:50 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$SIOCAX25DELUID(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0x3, @bcast, 0xee00}) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000080)=0x9, 0x4) 14:07:50 executing program 0: ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f0000000040)=@l={0x92, 0x0, 0xd0, 0x13, 0x4, 0x20, 0x5}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) 14:07:50 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x2, 0x4}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x1, 0x1}, 0x6) 14:07:50 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) r1 = syz_open_pts(0xffffffffffffffff, 0x40) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000000)={0x8, 0x7, 0xfffa, 0x4}) 14:07:50 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$SIOCAX25DELUID(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0x3, @bcast, 0xee00}) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000080)=0x9, 0x4) 14:07:50 executing program 0: ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f0000000040)=@l={0x92, 0x0, 0xd0, 0x13, 0x4, 0x20, 0x5}) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) (async, rerun: 64) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) (rerun: 64) 14:07:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_x25_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={@null, 0x7, 'veth1_macvtap\x00'}) 14:07:50 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x2a8080, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000000)=0x7, 0x4) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:50 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) write$P9_RWALK(r1, &(0x7f0000000040)={0x23, 0x6f, 0x2, {0x2, [{0x40, 0x2, 0x8}, {0x40, 0x2, 0x6}]}}, 0x23) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000080)=0x1, 0x4) 14:07:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x141080, 0x0) write$P9_RSETATTR(r1, &(0x7f0000000100)={0x7, 0x1b, 0x2}, 0x7) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$IMCLEAR_L2(0xffffffffffffffff, 0x80044946, &(0x7f0000000080)=0x8) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}, 0x5}) 14:07:50 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) ioctl$SIOCAX25DELUID(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0x3, @bcast, 0xee00}) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000080)=0x9, 0x4) 14:07:50 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x2a8080, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000000)=0x7, 0x4) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x2a8080, 0x0) (async) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000000)=0x7, 0x4) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:50 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x8000) write$P9_RCREATE(r2, &(0x7f0000000080)={0x18, 0x73, 0x1, {{0x2, 0xfffffffe, 0x5}, 0x2}}, 0x18) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:50 executing program 0: ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f0000000040)=@l={0x92, 0x0, 0xd0, 0x13, 0x4, 0x20, 0x5}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f0000000040)=@l={0x92, 0x0, 0xd0, 0x13, 0x4, 0x20, 0x5}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) (async) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) (async) 14:07:50 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) write$P9_RWALK(r1, &(0x7f0000000040)={0x23, 0x6f, 0x2, {0x2, [{0x40, 0x2, 0x8}, {0x40, 0x2, 0x6}]}}, 0x23) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000080)=0x1, 0x4) 14:07:50 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x8000) write$P9_RCREATE(r2, &(0x7f0000000080)={0x18, 0x73, 0x1, {{0x2, 0xfffffffe, 0x5}, 0x2}}, 0x18) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x141080, 0x0) write$P9_RSETATTR(r1, &(0x7f0000000100)={0x7, 0x1b, 0x2}, 0x7) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$IMCLEAR_L2(0xffffffffffffffff, 0x80044946, &(0x7f0000000080)=0x8) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) (async) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}, 0x5}) 14:07:50 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = accept4$unix(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x6e, 0xc00) clock_gettime(0x0, &(0x7f00000007c0)={0x0, 0x0}) recvmmsg$unix(r1, &(0x7f0000000740)=[{{&(0x7f0000000100), 0x6e, &(0x7f00000004c0)=[{&(0x7f0000000180)=""/244, 0xf4}, {&(0x7f0000000280)=""/74, 0x4a}, {&(0x7f0000000300)=""/221, 0xdd}, {&(0x7f0000000400)=""/140, 0x8c}], 0x4, &(0x7f0000000500)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x150}}, {{&(0x7f0000000680), 0x6e, &(0x7f0000000700)}}], 0x2, 0x2, &(0x7f0000000800)={r2, r3+10000000}) 14:07:50 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) write$P9_RWALK(r1, &(0x7f0000000040)={0x23, 0x6f, 0x2, {0x2, [{0x40, 0x2, 0x8}, {0x40, 0x2, 0x6}]}}, 0x23) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000080)=0x1, 0x4) 14:07:50 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x8000) write$P9_RCREATE(r2, &(0x7f0000000080)={0x18, 0x73, 0x1, {{0x2, 0xfffffffe, 0x5}, 0x2}}, 0x18) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:50 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x40, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x1}, @increfs={0x40046304, 0x3}, @release={0x40046306, 0x3}, @enter_looper, @increfs_done, @request_death], 0x20, 0x0, &(0x7f0000000080)="7be75e96a0b23b6661761d6a37d99df1c19f445e639b56c6fe81e3616683145c"}) ioctl$sock_bt_hci(r0, 0x800448d5, &(0x7f0000000000)) 14:07:50 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x2a8080, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000000)=0x7, 0x4) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x2a8080, 0x0) (async) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000000)=0x7, 0x4) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:50 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x2}, 0x6) 14:07:50 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) r1 = accept4$unix(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x6e, 0xc00) clock_gettime(0x0, &(0x7f00000007c0)={0x0, 0x0}) recvmmsg$unix(r1, &(0x7f0000000740)=[{{&(0x7f0000000100), 0x6e, &(0x7f00000004c0)=[{&(0x7f0000000180)=""/244, 0xf4}, {&(0x7f0000000280)=""/74, 0x4a}, {&(0x7f0000000300)=""/221, 0xdd}, {&(0x7f0000000400)=""/140, 0x8c}], 0x4, &(0x7f0000000500)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x150}}, {{&(0x7f0000000680), 0x6e, &(0x7f0000000700)}}], 0x2, 0x2, &(0x7f0000000800)={r2, r3+10000000}) 14:07:50 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) (async, rerun: 32) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x2, 0x0) (rerun: 32) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x40, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x1}, @increfs={0x40046304, 0x3}, @release={0x40046306, 0x3}, @enter_looper, @increfs_done, @request_death], 0x20, 0x0, &(0x7f0000000080)="7be75e96a0b23b6661761d6a37d99df1c19f445e639b56c6fe81e3616683145c"}) ioctl$sock_bt_hci(r0, 0x800448d5, &(0x7f0000000000)) 14:07:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x141080, 0x0) write$P9_RSETATTR(r1, &(0x7f0000000100)={0x7, 0x1b, 0x2}, 0x7) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$IMCLEAR_L2(0xffffffffffffffff, 0x80044946, &(0x7f0000000080)=0x8) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) (async) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}, 0x5}) 14:07:50 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) ioctl$sock_ax25_SIOCDELRT(r2, 0x890c, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, 0x0, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @default, @default, @bcast, @bcast]}) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:50 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async, rerun: 64) r1 = accept4$unix(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x6e, 0xc00) (async, rerun: 64) clock_gettime(0x0, &(0x7f00000007c0)={0x0, 0x0}) recvmmsg$unix(r1, &(0x7f0000000740)=[{{&(0x7f0000000100), 0x6e, &(0x7f00000004c0)=[{&(0x7f0000000180)=""/244, 0xf4}, {&(0x7f0000000280)=""/74, 0x4a}, {&(0x7f0000000300)=""/221, 0xdd}, {&(0x7f0000000400)=""/140, 0x8c}], 0x4, &(0x7f0000000500)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x150}}, {{&(0x7f0000000680), 0x6e, &(0x7f0000000700)}}], 0x2, 0x2, &(0x7f0000000800)={r2, r3+10000000}) 14:07:50 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x2}, 0x6) 14:07:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x800448f0, &(0x7f0000000100)="47f762016507fe0339050c30f8527ec75128b229c2694d258f59700fb0b6ca4730010ea01fa3762481292414f207d7375b5ec4689058e4bb57a77af0bd27dd7766b0258a5f8cfee8db6c284cdd04b774589686373a8262d02ee3fbdeb887b84f5ab4477217e07136ad4ea0911ef2b67af12195a3961b5e3c57f01748c3b682ef5d53e9b8b73df61fdf3fcd3eba6690d3f9c7ca3d29680753068d091e771db624fa3383a2271bea7b69a98f02222063658e46258c6cc3fc4f4c7e7f496e58d6") bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000200)={0x5d, [0xa90, 0xfffeffff], 0x6}, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x2a00, 0x0) bind$bt_hci(r2, &(0x7f0000000280)={0x1f, 0x1}, 0x6) write$apparmor_current(r1, 0x0, 0x0) write$P9_RSTATFS(r1, &(0x7f0000000080)={0x43, 0x9, 0x1, {0x3, 0x0, 0x2, 0x7cbf, 0x6, 0xf39, 0x7, 0x1, 0xc}}, 0x43) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f00000002c0)=0x5, 0x4) ioctl$SIOCX25GDTEFACILITIES(r5, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f00000001c0)) ioctl$SIOCX25SFACILITIES(r4, 0x89e3, &(0x7f0000000000)={0x2e, 0x120000, 0xb, 0x9, 0x9}) 14:07:50 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) ioctl$sock_ax25_SIOCDELRT(r2, 0x890c, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, 0x0, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @default, @default, @bcast, @bcast]}) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async, rerun: 32) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async, rerun: 32) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:50 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x40, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x1}, @increfs={0x40046304, 0x3}, @release={0x40046306, 0x3}, @enter_looper, @increfs_done, @request_death], 0x20, 0x0, &(0x7f0000000080)="7be75e96a0b23b6661761d6a37d99df1c19f445e639b56c6fe81e3616683145c"}) ioctl$sock_bt_hci(r0, 0x800448d5, &(0x7f0000000000)) 14:07:50 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async, rerun: 64) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x2}, 0x6) (rerun: 64) 14:07:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x800448f0, &(0x7f0000000100)="47f762016507fe0339050c30f8527ec75128b229c2694d258f59700fb0b6ca4730010ea01fa3762481292414f207d7375b5ec4689058e4bb57a77af0bd27dd7766b0258a5f8cfee8db6c284cdd04b774589686373a8262d02ee3fbdeb887b84f5ab4477217e07136ad4ea0911ef2b67af12195a3961b5e3c57f01748c3b682ef5d53e9b8b73df61fdf3fcd3eba6690d3f9c7ca3d29680753068d091e771db624fa3383a2271bea7b69a98f02222063658e46258c6cc3fc4f4c7e7f496e58d6") bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000200)={0x5d, [0xa90, 0xfffeffff], 0x6}, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x2a00, 0x0) bind$bt_hci(r2, &(0x7f0000000280)={0x1f, 0x1}, 0x6) write$apparmor_current(r1, 0x0, 0x0) write$P9_RSTATFS(r1, &(0x7f0000000080)={0x43, 0x9, 0x1, {0x3, 0x0, 0x2, 0x7cbf, 0x6, 0xf39, 0x7, 0x1, 0xc}}, 0x43) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f00000002c0)=0x5, 0x4) ioctl$SIOCX25GDTEFACILITIES(r5, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f00000001c0)) ioctl$SIOCX25SFACILITIES(r4, 0x89e3, &(0x7f0000000000)={0x2e, 0x120000, 0xb, 0x9, 0x9}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r0, 0x800448f0, &(0x7f0000000100)="47f762016507fe0339050c30f8527ec75128b229c2694d258f59700fb0b6ca4730010ea01fa3762481292414f207d7375b5ec4689058e4bb57a77af0bd27dd7766b0258a5f8cfee8db6c284cdd04b774589686373a8262d02ee3fbdeb887b84f5ab4477217e07136ad4ea0911ef2b67af12195a3961b5e3c57f01748c3b682ef5d53e9b8b73df61fdf3fcd3eba6690d3f9c7ca3d29680753068d091e771db624fa3383a2271bea7b69a98f02222063658e46258c6cc3fc4f4c7e7f496e58d6") (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000200)={0x5d, [0xa90, 0xfffeffff], 0x6}, 0x10) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x2a00, 0x0) (async) bind$bt_hci(r2, &(0x7f0000000280)={0x1f, 0x1}, 0x6) (async) write$apparmor_current(r1, 0x0, 0x0) (async) write$P9_RSTATFS(r1, &(0x7f0000000080)={0x43, 0x9, 0x1, {0x3, 0x0, 0x2, 0x7cbf, 0x6, 0xf39, 0x7, 0x1, 0xc}}, 0x43) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f00000002c0)=0x5, 0x4) (async) ioctl$SIOCX25GDTEFACILITIES(r5, 0x89ea, &(0x7f0000000000)) (async) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f00000001c0)) (async) ioctl$SIOCX25SFACILITIES(r4, 0x89e3, &(0x7f0000000000)={0x2e, 0x120000, 0xb, 0x9, 0x9}) (async) 14:07:50 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x2000) read$sequencer(r1, &(0x7f0000000080)=""/10, 0xa) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x200480, 0x0) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa07, &(0x7f0000000100)={{&(0x7f0000ffa000/0x4000)=nil, 0x4000}, 0x1}) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:50 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SIOCAX25GETUID(0xffffffffffffffff, 0x89e0, &(0x7f0000000000)={0x3, @null, 0xee01}) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) getpeername$ax25(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @netrom}, [@bcast, @default, @null, @rose, @null, @rose, @netrom, @rose]}, &(0x7f00000000c0)=0x48) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)) 14:07:50 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000040)={0x2, [0x6f, 0x1], 0x6}, 0x10) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0x0, 0x1}, 0x6) 14:07:50 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) ioctl$sock_ax25_SIOCDELRT(r2, 0x890c, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, 0x0, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @default, @default, @bcast, @bcast]}) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) ioctl$sock_ax25_SIOCDELRT(r2, 0x890c, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, 0x0, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @default, @default, @bcast, @bcast]}) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:50 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SIOCAX25GETUID(0xffffffffffffffff, 0x89e0, &(0x7f0000000000)={0x3, @null, 0xee01}) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) getpeername$ax25(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @netrom}, [@bcast, @default, @null, @rose, @null, @rose, @netrom, @rose]}, &(0x7f00000000c0)=0x48) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)) 14:07:50 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000040)={0x2, [0x6f, 0x1], 0x6}, 0x10) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0x0, 0x1}, 0x6) 14:07:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x800448f0, &(0x7f0000000100)="47f762016507fe0339050c30f8527ec75128b229c2694d258f59700fb0b6ca4730010ea01fa3762481292414f207d7375b5ec4689058e4bb57a77af0bd27dd7766b0258a5f8cfee8db6c284cdd04b774589686373a8262d02ee3fbdeb887b84f5ab4477217e07136ad4ea0911ef2b67af12195a3961b5e3c57f01748c3b682ef5d53e9b8b73df61fdf3fcd3eba6690d3f9c7ca3d29680753068d091e771db624fa3383a2271bea7b69a98f02222063658e46258c6cc3fc4f4c7e7f496e58d6") bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000200)={0x5d, [0xa90, 0xfffeffff], 0x6}, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x2a00, 0x0) bind$bt_hci(r2, &(0x7f0000000280)={0x1f, 0x1}, 0x6) write$apparmor_current(r1, 0x0, 0x0) write$P9_RSTATFS(r1, &(0x7f0000000080)={0x43, 0x9, 0x1, {0x3, 0x0, 0x2, 0x7cbf, 0x6, 0xf39, 0x7, 0x1, 0xc}}, 0x43) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f00000002c0)=0x5, 0x4) ioctl$SIOCX25GDTEFACILITIES(r5, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f00000001c0)) ioctl$SIOCX25SFACILITIES(r4, 0x89e3, &(0x7f0000000000)={0x2e, 0x120000, 0xb, 0x9, 0x9}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r0, 0x800448f0, &(0x7f0000000100)="47f762016507fe0339050c30f8527ec75128b229c2694d258f59700fb0b6ca4730010ea01fa3762481292414f207d7375b5ec4689058e4bb57a77af0bd27dd7766b0258a5f8cfee8db6c284cdd04b774589686373a8262d02ee3fbdeb887b84f5ab4477217e07136ad4ea0911ef2b67af12195a3961b5e3c57f01748c3b682ef5d53e9b8b73df61fdf3fcd3eba6690d3f9c7ca3d29680753068d091e771db624fa3383a2271bea7b69a98f02222063658e46258c6cc3fc4f4c7e7f496e58d6") (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000200)={0x5d, [0xa90, 0xfffeffff], 0x6}, 0x10) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000240), 0x2a00, 0x0) (async) bind$bt_hci(r2, &(0x7f0000000280)={0x1f, 0x1}, 0x6) (async) write$apparmor_current(r1, 0x0, 0x0) (async) write$P9_RSTATFS(r1, &(0x7f0000000080)={0x43, 0x9, 0x1, {0x3, 0x0, 0x2, 0x7cbf, 0x6, 0xf39, 0x7, 0x1, 0xc}}, 0x43) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f00000002c0)=0x5, 0x4) (async) ioctl$SIOCX25GDTEFACILITIES(r5, 0x89ea, &(0x7f0000000000)) (async) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f00000001c0)) (async) ioctl$SIOCX25SFACILITIES(r4, 0x89e3, &(0x7f0000000000)={0x2e, 0x120000, 0xb, 0x9, 0x9}) (async) 14:07:50 executing program 2: r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x200080) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0xfff, 0x5, 0x0, 0x8, 0x9, "e678247670ebcc03"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, &(0x7f0000000100)) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x1, 0x1}, 0x30) 14:07:50 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SIOCAX25GETUID(0xffffffffffffffff, 0x89e0, &(0x7f0000000000)={0x3, @null, 0xee01}) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) getpeername$ax25(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @netrom}, [@bcast, @default, @null, @rose, @null, @rose, @netrom, @rose]}, &(0x7f00000000c0)=0x48) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SIOCAX25GETUID(0xffffffffffffffff, 0x89e0, &(0x7f0000000000)={0x3, @null, 0xee01}) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) getpeername$ax25(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @netrom}, [@bcast, @default, @null, @rose, @null, @rose, @netrom, @rose]}, &(0x7f00000000c0)=0x48) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)) (async) 14:07:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000080)={0x9, [0xff, 0x1], 0x9}, 0x10) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x3, 0x4) 14:07:50 executing program 2: r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x200080) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0xfff, 0x5, 0x0, 0x8, 0x9, "e678247670ebcc03"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, &(0x7f0000000100)) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x1, 0x1}, 0x30) 14:07:50 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000080)={0x9, [0xff, 0x1], 0x9}, 0x10) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x3, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000080)={0x9, [0xff, 0x1], 0x9}, 0x10) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x3, 0x4) (async) 14:07:51 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x2000) read$sequencer(r1, &(0x7f0000000080)=""/10, 0xa) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x200480, 0x0) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa07, &(0x7f0000000100)={{&(0x7f0000ffa000/0x4000)=nil, 0x4000}, 0x1}) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:51 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='ext4_allocate_inode\x00'}, 0x10) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:51 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000040)={0x2, [0x6f, 0x1], 0x6}, 0x10) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0x0, 0x1}, 0x6) 14:07:51 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000080)={0x9, [0xff, 0x1], 0x9}, 0x10) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x3, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000080)={0x9, [0xff, 0x1], 0x9}, 0x10) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x3, 0x4) (async) 14:07:51 executing program 2: r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x200080) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0xfff, 0x5, 0x0, 0x8, 0x9, "e678247670ebcc03"}) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, &(0x7f0000000100)) (async) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x1, 0x1}, 0x30) 14:07:51 executing program 4: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) write$9p(r0, &(0x7f0000000100)="5a569a152d4d8521e871e8edc30983d93d9650b46356181ef3db73e9b214c0798963efbc11b64bfc24691763654f4d31e4c7281ec6ef5316af1f31e2d485b355560e5afde725449b04af", 0x4a) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = accept4$unix(r1, &(0x7f0000000180)=@abs, &(0x7f0000000200)=0x6e, 0x80000) getsockname$unix(r2, &(0x7f0000000240), &(0x7f0000000080)=0x6e) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:51 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x4, 0x1}, 0x6) 14:07:51 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f0000000000)) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) bind$unix(r2, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000080)=""/180, 0xb4, 0x10000, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) 14:07:51 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='ext4_allocate_inode\x00'}, 0x10) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:51 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f0000000000)) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) bind$unix(r2, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000080)=""/180, 0xb4, 0x10000, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) 14:07:51 executing program 4: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) write$9p(r0, &(0x7f0000000100)="5a569a152d4d8521e871e8edc30983d93d9650b46356181ef3db73e9b214c0798963efbc11b64bfc24691763654f4d31e4c7281ec6ef5316af1f31e2d485b355560e5afde725449b04af", 0x4a) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = accept4$unix(r1, &(0x7f0000000180)=@abs, &(0x7f0000000200)=0x6e, 0x80000) getsockname$unix(r2, &(0x7f0000000240), &(0x7f0000000080)=0x6e) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r0, 0x0, 0x0) (async) write$9p(r0, &(0x7f0000000100)="5a569a152d4d8521e871e8edc30983d93d9650b46356181ef3db73e9b214c0798963efbc11b64bfc24691763654f4d31e4c7281ec6ef5316af1f31e2d485b355560e5afde725449b04af", 0x4a) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) (async) accept4$unix(r1, &(0x7f0000000180)=@abs, &(0x7f0000000200)=0x6e, 0x80000) (async) getsockname$unix(r2, &(0x7f0000000240), &(0x7f0000000080)=0x6e) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r4, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:51 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x4, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x4, 0x1}, 0x6) (async) [ 2825.964871] Bluetooth: hci2 command 0x0401 tx timeout 14:07:52 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x2000) read$sequencer(r1, &(0x7f0000000080)=""/10, 0xa) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x200480, 0x0) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa07, &(0x7f0000000100)={{&(0x7f0000ffa000/0x4000)=nil, 0x4000}, 0x1}) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:52 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='ext4_allocate_inode\x00'}, 0x10) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:52 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x4, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x4, 0x1}, 0x6) (async) 14:07:52 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f0000000000)) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) (async) bind$unix(r2, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000080)=""/180, 0xb4, 0x10000, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) 14:07:52 executing program 4: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) write$9p(r0, &(0x7f0000000100)="5a569a152d4d8521e871e8edc30983d93d9650b46356181ef3db73e9b214c0798963efbc11b64bfc24691763654f4d31e4c7281ec6ef5316af1f31e2d485b355560e5afde725449b04af", 0x4a) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = accept4$unix(r1, &(0x7f0000000180)=@abs, &(0x7f0000000200)=0x6e, 0x80000) getsockname$unix(r2, &(0x7f0000000240), &(0x7f0000000080)=0x6e) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r0, 0x0, 0x0) (async) write$9p(r0, &(0x7f0000000100)="5a569a152d4d8521e871e8edc30983d93d9650b46356181ef3db73e9b214c0798963efbc11b64bfc24691763654f4d31e4c7281ec6ef5316af1f31e2d485b355560e5afde725449b04af", 0x4a) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) (async) accept4$unix(r1, &(0x7f0000000180)=@abs, &(0x7f0000000200)=0x6e, 0x80000) (async) getsockname$unix(r2, &(0x7f0000000240), &(0x7f0000000080)=0x6e) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r4, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:52 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) 14:07:52 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x420000, 0x0) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000040)={0x8001, [0xffffffff, 0x870], 0x7fff}, 0x10) ioctl$sock_bt_hci(r0, 0x800448d3, &(0x7f0000000180)="78e28e93784736b858a2cfeeb3b4545e46b66e1096743b9611a080fde5fb7d79ccf0be118fe98001a6a1ce9748b1542c64756ace007af630e2de32337fa04b4a1c815e01129cd410e42fd42fe25c1fc5484bdfe0110900000000000000004c6623789c194656ca7cc2840b2ff2b7097feaa0ee011058857e3b8bebca5581a4a15c807576a2bfdccde042a5b0171fe94af972653dab74bcb6e4cd9f975fd9c6cd18e444d056550532fe0a39e82eee2b5ff068b7180000000000") 14:07:52 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x480600, 0x0) ioctl$SNDCTL_SEQ_NRSYNTHS(r0, 0x8004510a, &(0x7f0000000080)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:52 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SIOCAX25GETINFO(0xffffffffffffffff, 0x89ed, &(0x7f0000000100)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x4, 0x4}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:52 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x420000, 0x0) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000040)={0x8001, [0xffffffff, 0x870], 0x7fff}, 0x10) (async) ioctl$sock_bt_hci(r0, 0x800448d3, &(0x7f0000000180)="78e28e93784736b858a2cfeeb3b4545e46b66e1096743b9611a080fde5fb7d79ccf0be118fe98001a6a1ce9748b1542c64756ace007af630e2de32337fa04b4a1c815e01129cd410e42fd42fe25c1fc5484bdfe0110900000000000000004c6623789c194656ca7cc2840b2ff2b7097feaa0ee011058857e3b8bebca5581a4a15c807576a2bfdccde042a5b0171fe94af972653dab74bcb6e4cd9f975fd9c6cd18e444d056550532fe0a39e82eee2b5ff068b7180000000000") 14:07:52 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x480600, 0x0) ioctl$SNDCTL_SEQ_NRSYNTHS(r0, 0x8004510a, &(0x7f0000000080)) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:52 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) (async) 14:07:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:53 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SIOCAX25GETINFO(0xffffffffffffffff, 0x89ed, &(0x7f0000000100)) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x4, 0x4}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:53 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x420000, 0x0) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000040)={0x8001, [0xffffffff, 0x870], 0x7fff}, 0x10) ioctl$sock_bt_hci(r0, 0x800448d3, &(0x7f0000000180)="78e28e93784736b858a2cfeeb3b4545e46b66e1096743b9611a080fde5fb7d79ccf0be118fe98001a6a1ce9748b1542c64756ace007af630e2de32337fa04b4a1c815e01129cd410e42fd42fe25c1fc5484bdfe0110900000000000000004c6623789c194656ca7cc2840b2ff2b7097feaa0ee011058857e3b8bebca5581a4a15c807576a2bfdccde042a5b0171fe94af972653dab74bcb6e4cd9f975fd9c6cd18e444d056550532fe0a39e82eee2b5ff068b7180000000000") syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x420000, 0x0) (async) setsockopt$bt_hci_HCI_FILTER(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000040)={0x8001, [0xffffffff, 0x870], 0x7fff}, 0x10) (async) ioctl$sock_bt_hci(r0, 0x800448d3, &(0x7f0000000180)="78e28e93784736b858a2cfeeb3b4545e46b66e1096743b9611a080fde5fb7d79ccf0be118fe98001a6a1ce9748b1542c64756ace007af630e2de32337fa04b4a1c815e01129cd410e42fd42fe25c1fc5484bdfe0110900000000000000004c6623789c194656ca7cc2840b2ff2b7097feaa0ee011058857e3b8bebca5581a4a15c807576a2bfdccde042a5b0171fe94af972653dab74bcb6e4cd9f975fd9c6cd18e444d056550532fe0a39e82eee2b5ff068b7180000000000") (async) 14:07:53 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x480600, 0x0) ioctl$SNDCTL_SEQ_NRSYNTHS(r0, 0x8004510a, &(0x7f0000000080)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x480600, 0x0) (async) ioctl$SNDCTL_SEQ_NRSYNTHS(r0, 0x8004510a, &(0x7f0000000080)) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:07:53 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) (async) 14:07:53 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)="ab6eebfa4f71965ac8337929c9b17cdfb6d41c40c80d7c66846850006930edbee440dacbd02fd6850d13966f4850fcd0ef24d1250fd08f7eb69063027e6e7ba19573b7bddfe9e6e00872e0fe33a6ce24d9b8b153c6a9e562d7f1") 14:07:53 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SIOCAX25GETINFO(0xffffffffffffffff, 0x89ed, &(0x7f0000000100)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x4, 0x4}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SIOCAX25GETINFO(0xffffffffffffffff, 0x89ed, &(0x7f0000000100)) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x4, 0x4}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:53 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x800448d4, &(0x7f0000000100)="d69c5a580995f9bb332181952033ca344c2a89a86179adb26cddf15239f1b38e143da5ff77b3a162c9022ab6f719977773017f4c4f6017721ae510283ce461e5e4734a26413eb55ff1c43401d4cf86be1c8f47cf0ec222cbefd5de88c256eb05093dd04b9727a800d236e75547bb70c0888f932e3e0782628217f13247f0c60839f8d93188023c6d556d596158e0ba34f096ea7593b56c28f844e9d0de7fc569b651d28517f8ffffffd352d8b62a41919b09431c1b6742c1c55e618dbdef5558e093d187aabdf069cbc11f245f62e23e0ad251ad56e5d69e0ed21f0985146522f71b162e31d06fb8cc366542fcd26f1b0ad58a565341d871f15b71b412f4e90cd2f32c3221bc228fde0990fb6419a6b0800daaa328ad77cd298797fd576e08448e11f625231166e74285f3f3ad39152aa0ce852ba693930008f69f6ee7b2d1d7d60ed6a14d0deb6de5dd258e639f") syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:53 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x43) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xfffd, 0x1}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000140)={0x4, 0x7fff, "8c9fce", 0x82, 0x3f}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x200040, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x5, 0x1}, 0x3b) 14:07:53 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)="ab6eebfa4f71965ac8337929c9b17cdfb6d41c40c80d7c66846850006930edbee440dacbd02fd6850d13966f4850fcd0ef24d1250fd08f7eb69063027e6e7ba19573b7bddfe9e6e00872e0fe33a6ce24d9b8b153c6a9e562d7f1") 14:07:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:53 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x43) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xfffd, 0x1}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000140)={0x4, 0x7fff, "8c9fce", 0x82, 0x3f}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x200040, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x5, 0x1}, 0x3b) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) (async) openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x43) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xfffd, 0x1}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000140)={0x4, 0x7fff, "8c9fce", 0x82, 0x3f}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x200040, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x5, 0x1}, 0x3b) (async) 14:07:53 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x800448d4, &(0x7f0000000100)="d69c5a580995f9bb332181952033ca344c2a89a86179adb26cddf15239f1b38e143da5ff77b3a162c9022ab6f719977773017f4c4f6017721ae510283ce461e5e4734a26413eb55ff1c43401d4cf86be1c8f47cf0ec222cbefd5de88c256eb05093dd04b9727a800d236e75547bb70c0888f932e3e0782628217f13247f0c60839f8d93188023c6d556d596158e0ba34f096ea7593b56c28f844e9d0de7fc569b651d28517f8ffffffd352d8b62a41919b09431c1b6742c1c55e618dbdef5558e093d187aabdf069cbc11f245f62e23e0ad251ad56e5d69e0ed21f0985146522f71b162e31d06fb8cc366542fcd26f1b0ad58a565341d871f15b71b412f4e90cd2f32c3221bc228fde0990fb6419a6b0800daaa328ad77cd298797fd576e08448e11f625231166e74285f3f3ad39152aa0ce852ba693930008f69f6ee7b2d1d7d60ed6a14d0deb6de5dd258e639f") (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:53 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:53 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)="ab6eebfa4f71965ac8337929c9b17cdfb6d41c40c80d7c66846850006930edbee440dacbd02fd6850d13966f4850fcd0ef24d1250fd08f7eb69063027e6e7ba19573b7bddfe9e6e00872e0fe33a6ce24d9b8b153c6a9e562d7f1") syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)="ab6eebfa4f71965ac8337929c9b17cdfb6d41c40c80d7c66846850006930edbee440dacbd02fd6850d13966f4850fcd0ef24d1250fd08f7eb69063027e6e7ba19573b7bddfe9e6e00872e0fe33a6ce24d9b8b153c6a9e562d7f1") (async) 14:07:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x9e, 0x4) 14:07:53 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async, rerun: 32) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) ioctl$sock_bt_hci(r1, 0x800448d4, &(0x7f0000000100)="d69c5a580995f9bb332181952033ca344c2a89a86179adb26cddf15239f1b38e143da5ff77b3a162c9022ab6f719977773017f4c4f6017721ae510283ce461e5e4734a26413eb55ff1c43401d4cf86be1c8f47cf0ec222cbefd5de88c256eb05093dd04b9727a800d236e75547bb70c0888f932e3e0782628217f13247f0c60839f8d93188023c6d556d596158e0ba34f096ea7593b56c28f844e9d0de7fc569b651d28517f8ffffffd352d8b62a41919b09431c1b6742c1c55e618dbdef5558e093d187aabdf069cbc11f245f62e23e0ad251ad56e5d69e0ed21f0985146522f71b162e31d06fb8cc366542fcd26f1b0ad58a565341d871f15b71b412f4e90cd2f32c3221bc228fde0990fb6419a6b0800daaa328ad77cd298797fd576e08448e11f625231166e74285f3f3ad39152aa0ce852ba693930008f69f6ee7b2d1d7d60ed6a14d0deb6de5dd258e639f") (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:53 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:53 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x43) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xfffd, 0x1}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000140)={0x4, 0x7fff, "8c9fce", 0x82, 0x3f}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x200040, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x5, 0x1}, 0x3b) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) (async) openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x43) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xfffd, 0x1}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000140)={0x4, 0x7fff, "8c9fce", 0x82, 0x3f}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x200040, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x5, 0x1}, 0x3b) (async) 14:07:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x9e, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x9e, 0x4) (async) 14:07:53 executing program 1: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="180000000414e1fb00010000000000000000000000200000ed7baa850e73ebc5f2763c0a152e3445024b1a7df4248e4a75952a52ef4b2aa6595de84943e97a08356e974d0866004726693c"], 0x18}, 0x1, 0x0, 0x0, 0x20004801}, 0x20008800) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffe000/0x1000)=nil, 0x1000}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448e0, &(0x7f0000000000)) ioctl$SNDCTL_TMR_SOURCE(r0, 0xc0045406) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x2002, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x10000, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$SNDCTL_MIDI_PRETIME(r3, 0xc0046d00, &(0x7f0000000200)) r4 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r4, 0x0, 0x0) ioctl$SIOCAX25GETUID(r4, 0x89e0, &(0x7f0000000080)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xee01}) ioctl$SNDCTL_SEQ_NRMIDIS(r2, 0x8004510b, &(0x7f0000000180)) 14:07:53 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x9e, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x4}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x9e, 0x4) (async) 14:07:53 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x1d, 0x9, &(0x7f0000000100)=@raw=[@jmp={0x5, 0x1, 0xd, 0x9, 0x5, 0x80, 0x10}, @generic={0x1, 0x8, 0x7, 0x2, 0x73}, @call={0x85, 0x0, 0x0, 0x3d}, @call={0x85, 0x0, 0x0, 0x1e}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0xb, 0x1, 0x0, 0x1}, @generic={0x6, 0xd, 0x1, 0x1000, 0x6385}, @jmp={0x5, 0x0, 0x2, 0xd, 0x2, 0xfffffffffffffff8}], &(0x7f0000000000)='GPL\x00', 0x1f, 0x58, &(0x7f0000000180)=""/88, 0x41000, 0x3, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x8, 0x2, 0x2}, 0x10, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000240)=[0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000300)={0x0, 0x1, r3, 0x200}) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:53 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x1406, 0x10, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4804}, 0x24004880) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x4}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:53 executing program 1: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="180000000414e1fb00010000000000000000000000200000ed7baa850e73ebc5f2763c0a152e3445024b1a7df4248e4a75952a52ef4b2aa6595de84943e97a08356e974d0866004726693c"], 0x18}, 0x1, 0x0, 0x0, 0x20004801}, 0x20008800) (async) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffe000/0x1000)=nil, 0x1000}) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448e0, &(0x7f0000000000)) (async, rerun: 32) ioctl$SNDCTL_TMR_SOURCE(r0, 0xc0045406) (async, rerun: 32) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x2002, 0x0) (async) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x10000, 0x0) (async) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$SNDCTL_MIDI_PRETIME(r3, 0xc0046d00, &(0x7f0000000200)) (async, rerun: 64) r4 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) (rerun: 64) getpeername$ax25(r4, 0x0, 0x0) (async, rerun: 32) ioctl$SIOCAX25GETUID(r4, 0x89e0, &(0x7f0000000080)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xee01}) (async, rerun: 32) ioctl$SNDCTL_SEQ_NRMIDIS(r2, 0x8004510b, &(0x7f0000000180)) 14:07:53 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x684840, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffffffffffffffff}, 0x6) r4 = accept$unix(r2, &(0x7f0000000100)=@abs, &(0x7f0000000180)=0x6e) recvmmsg$unix(r4, &(0x7f0000000ec0)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000001c0)=""/185, 0xb9}, {&(0x7f0000000280)=""/82, 0x52}, {&(0x7f0000000300)=""/131, 0x83}], 0x3, &(0x7f0000000400)=[@cred={{0x1c}}], 0x20}}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000440)=""/141, 0x8d}, {&(0x7f0000000500)=""/83, 0x53}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb8}}, {{&(0x7f0000000680), 0x6e, &(0x7f0000000780)=[{&(0x7f0000000700)=""/99, 0x63}], 0x1, &(0x7f00000007c0)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x140}}, {{&(0x7f0000000900), 0x6e, &(0x7f0000000980), 0x0, &(0x7f00000009c0)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x80}}, {{&(0x7f0000000a40)=@abs, 0x6e, &(0x7f0000000dc0)=[{&(0x7f0000000ac0)=""/212, 0xd4}, {&(0x7f0000000bc0)=""/31, 0x1f}, {&(0x7f0000000c00)=""/155, 0x9b}, {&(0x7f0000000cc0)=""/196, 0xc4}], 0x4, &(0x7f0000000e00)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa0}}], 0x5, 0x0, &(0x7f0000001000)={0x77359400}) 14:07:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) write$bt_hci(r1, &(0x7f0000000040)={0x1, @write_auth_payload_to={{0xc7c, 0x4}, {0xc8, 0x2}}}, 0x8) 14:07:53 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x1406, 0x10, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4804}, 0x24004880) (rerun: 32) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x4}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async, rerun: 64) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 64) 14:07:53 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) (async) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x1d, 0x9, &(0x7f0000000100)=@raw=[@jmp={0x5, 0x1, 0xd, 0x9, 0x5, 0x80, 0x10}, @generic={0x1, 0x8, 0x7, 0x2, 0x73}, @call={0x85, 0x0, 0x0, 0x3d}, @call={0x85, 0x0, 0x0, 0x1e}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0xb, 0x1, 0x0, 0x1}, @generic={0x6, 0xd, 0x1, 0x1000, 0x6385}, @jmp={0x5, 0x0, 0x2, 0xd, 0x2, 0xfffffffffffffff8}], &(0x7f0000000000)='GPL\x00', 0x1f, 0x58, &(0x7f0000000180)=""/88, 0x41000, 0x3, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x8, 0x2, 0x2}, 0x10, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000240)=[0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000300)={0x0, 0x1, r3, 0x200}) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:53 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x684840, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffffffffffffffff}, 0x6) (async) r4 = accept$unix(r2, &(0x7f0000000100)=@abs, &(0x7f0000000180)=0x6e) recvmmsg$unix(r4, &(0x7f0000000ec0)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000001c0)=""/185, 0xb9}, {&(0x7f0000000280)=""/82, 0x52}, {&(0x7f0000000300)=""/131, 0x83}], 0x3, &(0x7f0000000400)=[@cred={{0x1c}}], 0x20}}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000440)=""/141, 0x8d}, {&(0x7f0000000500)=""/83, 0x53}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb8}}, {{&(0x7f0000000680), 0x6e, &(0x7f0000000780)=[{&(0x7f0000000700)=""/99, 0x63}], 0x1, &(0x7f00000007c0)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x140}}, {{&(0x7f0000000900), 0x6e, &(0x7f0000000980), 0x0, &(0x7f00000009c0)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x80}}, {{&(0x7f0000000a40)=@abs, 0x6e, &(0x7f0000000dc0)=[{&(0x7f0000000ac0)=""/212, 0xd4}, {&(0x7f0000000bc0)=""/31, 0x1f}, {&(0x7f0000000c00)=""/155, 0x9b}, {&(0x7f0000000cc0)=""/196, 0xc4}], 0x4, &(0x7f0000000e00)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa0}}], 0x5, 0x0, &(0x7f0000001000)={0x77359400}) 14:07:53 executing program 1: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="180000000414e1fb00010000000000000000000000200000ed7baa850e73ebc5f2763c0a152e3445024b1a7df4248e4a75952a52ef4b2aa6595de84943e97a08356e974d0866004726693c"], 0x18}, 0x1, 0x0, 0x0, 0x20004801}, 0x20008800) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffe000/0x1000)=nil, 0x1000}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448e0, &(0x7f0000000000)) ioctl$SNDCTL_TMR_SOURCE(r0, 0xc0045406) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x2002, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x10000, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$SNDCTL_MIDI_PRETIME(r3, 0xc0046d00, &(0x7f0000000200)) r4 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r4, 0x0, 0x0) ioctl$SIOCAX25GETUID(r4, 0x89e0, &(0x7f0000000080)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xee01}) ioctl$SNDCTL_SEQ_NRMIDIS(r2, 0x8004510b, &(0x7f0000000180)) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r0, 0x0, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="180000000414e1fb00010000000000000000000000200000ed7baa850e73ebc5f2763c0a152e3445024b1a7df4248e4a75952a52ef4b2aa6595de84943e97a08356e974d0866004726693c"], 0x18}, 0x1, 0x0, 0x0, 0x20004801}, 0x20008800) (async) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffe000/0x1000)=nil, 0x1000}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r1, 0x400448e0, &(0x7f0000000000)) (async) ioctl$SNDCTL_TMR_SOURCE(r0, 0xc0045406) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x2002, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x10000, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) (async) ioctl$SNDCTL_MIDI_PRETIME(r3, 0xc0046d00, &(0x7f0000000200)) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) getpeername$ax25(r4, 0x0, 0x0) (async) ioctl$SIOCAX25GETUID(r4, 0x89e0, &(0x7f0000000080)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xee01}) (async) ioctl$SNDCTL_SEQ_NRMIDIS(r2, 0x8004510b, &(0x7f0000000180)) (async) 14:07:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) write$bt_hci(r1, &(0x7f0000000040)={0x1, @write_auth_payload_to={{0xc7c, 0x4}, {0xc8, 0x2}}}, 0x8) 14:07:53 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x1d, 0x9, &(0x7f0000000100)=@raw=[@jmp={0x5, 0x1, 0xd, 0x9, 0x5, 0x80, 0x10}, @generic={0x1, 0x8, 0x7, 0x2, 0x73}, @call={0x85, 0x0, 0x0, 0x3d}, @call={0x85, 0x0, 0x0, 0x1e}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0xb, 0x1, 0x0, 0x1}, @generic={0x6, 0xd, 0x1, 0x1000, 0x6385}, @jmp={0x5, 0x0, 0x2, 0xd, 0x2, 0xfffffffffffffff8}], &(0x7f0000000000)='GPL\x00', 0x1f, 0x58, &(0x7f0000000180)=""/88, 0x41000, 0x3, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x8, 0x2, 0x2}, 0x10, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000240)=[0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000300)={0x0, 0x1, r3, 0x200}) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:53 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x684840, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffffffffffffffff}, 0x6) r4 = accept$unix(r2, &(0x7f0000000100)=@abs, &(0x7f0000000180)=0x6e) recvmmsg$unix(r4, &(0x7f0000000ec0)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000001c0)=""/185, 0xb9}, {&(0x7f0000000280)=""/82, 0x52}, {&(0x7f0000000300)=""/131, 0x83}], 0x3, &(0x7f0000000400)=[@cred={{0x1c}}], 0x20}}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000440)=""/141, 0x8d}, {&(0x7f0000000500)=""/83, 0x53}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb8}}, {{&(0x7f0000000680), 0x6e, &(0x7f0000000780)=[{&(0x7f0000000700)=""/99, 0x63}], 0x1, &(0x7f00000007c0)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x140}}, {{&(0x7f0000000900), 0x6e, &(0x7f0000000980), 0x0, &(0x7f00000009c0)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x80}}, {{&(0x7f0000000a40)=@abs, 0x6e, &(0x7f0000000dc0)=[{&(0x7f0000000ac0)=""/212, 0xd4}, {&(0x7f0000000bc0)=""/31, 0x1f}, {&(0x7f0000000c00)=""/155, 0x9b}, {&(0x7f0000000cc0)=""/196, 0xc4}], 0x4, &(0x7f0000000e00)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa0}}], 0x5, 0x0, &(0x7f0000001000)={0x77359400}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x684840, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffffffffffffffff}, 0x6) (async) accept$unix(r2, &(0x7f0000000100)=@abs, &(0x7f0000000180)=0x6e) (async) recvmmsg$unix(r4, &(0x7f0000000ec0)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000001c0)=""/185, 0xb9}, {&(0x7f0000000280)=""/82, 0x52}, {&(0x7f0000000300)=""/131, 0x83}], 0x3, &(0x7f0000000400)=[@cred={{0x1c}}], 0x20}}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000440)=""/141, 0x8d}, {&(0x7f0000000500)=""/83, 0x53}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb8}}, {{&(0x7f0000000680), 0x6e, &(0x7f0000000780)=[{&(0x7f0000000700)=""/99, 0x63}], 0x1, &(0x7f00000007c0)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x140}}, {{&(0x7f0000000900), 0x6e, &(0x7f0000000980), 0x0, &(0x7f00000009c0)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x80}}, {{&(0x7f0000000a40)=@abs, 0x6e, &(0x7f0000000dc0)=[{&(0x7f0000000ac0)=""/212, 0xd4}, {&(0x7f0000000bc0)=""/31, 0x1f}, {&(0x7f0000000c00)=""/155, 0x9b}, {&(0x7f0000000cc0)=""/196, 0xc4}], 0x4, &(0x7f0000000e00)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xa0}}], 0x5, 0x0, &(0x7f0000001000)={0x77359400}) (async) 14:07:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) write$bt_hci(r1, &(0x7f0000000040)={0x1, @write_auth_payload_to={{0xc7c, 0x4}, {0xc8, 0x2}}}, 0x8) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) write$bt_hci(r1, &(0x7f0000000040)={0x1, @write_auth_payload_to={{0xc7c, 0x4}, {0xc8, 0x2}}}, 0x8) (async) 14:07:53 executing program 1: ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[0x0, 0x0, r0, r1, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000480)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000580)={&(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, r2], &(0x7f0000000540)=[0xda, 0x3, 0x5, 0x401], 0x8}) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000080)={0x1, 0x1, "3767de", 0x5, 0x1}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='svcrdma_post_recv\x00'}, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RCLUNK(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x79, 0x2}, 0x7) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x140c, 0x20, 0x70bd2c, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0xeefeb9a60f71e9d1}, 0x4004800) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x40300, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000200), 0xffffffffffffffff, 0x404200) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r6, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r6, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000000f14300028bd7000fedbdf25080001005f0000000800010001000000"], 0x20}, 0x1, 0x0, 0x0, 0x4048880}, 0x4000004) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000100)) read$sequencer(0xffffffffffffffff, &(0x7f00000000c0)=""/101, 0x65) ioctl$SNDCTL_SEQ_SYNC(r4, 0x5101) ioctl$sock_bt_hci(r3, 0x400448e0, &(0x7f0000000000)) sched_rr_get_interval(0x0, &(0x7f00000001c0)) 14:07:53 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x1406, 0x10, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4804}, 0x24004880) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x4}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x1406, 0x10, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4804}, 0x24004880) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x4}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:07:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0x0, 0x8, "f89c14", 0x81, 0x6}) r1 = accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @null}, [@bcast, @rose, @default, @remote, @default, @netrom, @bcast, @default]}, &(0x7f0000000100)=0x48) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000140)={@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @bcast, @default]}) 14:07:53 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$sock_bt_hci(r1, 0x400448e6, &(0x7f0000000100)="3c52aa2178d02edf2cf23d12c43011cba7f2d81ab09728f522a30d1824ce23c253542fa8a4d1c6a49f937ad8e67ec6989cefbb652a2576d8b882a76c2e4b227127f3f168bd5ed39d312d9f52e1b4b0f259c544f3eb9b927ecd01b657a28a50265a702e115e1b695cfecdd449ebb73aaac7b5a2d58e63c19f350a12791c0ac927c23a4eeec264cd03c1b352963ff45b5172aefb80f0648975fa702371a3da0e2f1b") bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:53 executing program 1: ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[0x0, 0x0, r0, r1, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000480)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000580)={&(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, r2], &(0x7f0000000540)=[0xda, 0x3, 0x5, 0x401], 0x8}) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000080)={0x1, 0x1, "3767de", 0x5, 0x1}) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='svcrdma_post_recv\x00'}, 0x10) (async, rerun: 64) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) write$P9_RCLUNK(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x79, 0x2}, 0x7) (async) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x140c, 0x20, 0x70bd2c, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0xeefeb9a60f71e9d1}, 0x4004800) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x40300, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000200), 0xffffffffffffffff, 0x404200) (async) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r6, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r6, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000000f14300028bd7000fedbdf25080001005f0000000800010001000000"], 0x20}, 0x1, 0x0, 0x0, 0x4048880}, 0x4000004) (async) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000100)) (async) read$sequencer(0xffffffffffffffff, &(0x7f00000000c0)=""/101, 0x65) (async) ioctl$SNDCTL_SEQ_SYNC(r4, 0x5101) (async, rerun: 32) ioctl$sock_bt_hci(r3, 0x400448e0, &(0x7f0000000000)) (async, rerun: 32) sched_rr_get_interval(0x0, &(0x7f00000001c0)) 14:07:53 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x1406, 0x10, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4804}, 0x24004880) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x4}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:53 executing program 3: ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}, 0x2}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) ioctl$SNDCTL_MIDI_PRETIME(r1, 0xc0046d00, &(0x7f0000000080)) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x3b5040, 0x0) ioctl$SNDCTL_TMR_STOP(r2, 0x5403) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:53 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) write$P9_RXATTRCREATE(r2, &(0x7f0000000000)={0x7, 0x21, 0x2}, 0x7) 14:07:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0x0, 0x8, "f89c14", 0x81, 0x6}) r1 = accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @null}, [@bcast, @rose, @default, @remote, @default, @netrom, @bcast, @default]}, &(0x7f0000000100)=0x48) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000140)={@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @bcast, @default]}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0x0, 0x8, "f89c14", 0x81, 0x6}) (async) accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @null}, [@bcast, @rose, @default, @remote, @default, @netrom, @bcast, @default]}, &(0x7f0000000100)=0x48) (async) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000140)={@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @bcast, @default]}) (async) 14:07:53 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$sock_bt_hci(r1, 0x400448e6, &(0x7f0000000100)="3c52aa2178d02edf2cf23d12c43011cba7f2d81ab09728f522a30d1824ce23c253542fa8a4d1c6a49f937ad8e67ec6989cefbb652a2576d8b882a76c2e4b227127f3f168bd5ed39d312d9f52e1b4b0f259c544f3eb9b927ecd01b657a28a50265a702e115e1b695cfecdd449ebb73aaac7b5a2d58e63c19f350a12791c0ac927c23a4eeec264cd03c1b352963ff45b5172aefb80f0648975fa702371a3da0e2f1b") bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) ioctl$sock_bt_hci(r1, 0x400448e6, &(0x7f0000000100)="3c52aa2178d02edf2cf23d12c43011cba7f2d81ab09728f522a30d1824ce23c253542fa8a4d1c6a49f937ad8e67ec6989cefbb652a2576d8b882a76c2e4b227127f3f168bd5ed39d312d9f52e1b4b0f259c544f3eb9b927ecd01b657a28a50265a702e115e1b695cfecdd449ebb73aaac7b5a2d58e63c19f350a12791c0ac927c23a4eeec264cd03c1b352963ff45b5172aefb80f0648975fa702371a3da0e2f1b") (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:53 executing program 5: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="180000000414e1fb00010000000000000000000000200000ed7baa850e73ebc5f2763c0a152e3445024b1a7df4248e4a75952a52ef4b2aa6595de84943e97a08356e974d0866004726693c"], 0x18}, 0x1, 0x0, 0x0, 0x20004801}, 0x20008800) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffe000/0x1000)=nil, 0x1000}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448e0, &(0x7f0000000000)) ioctl$SNDCTL_TMR_SOURCE(r0, 0xc0045406) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x2002, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x10000, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$SNDCTL_MIDI_PRETIME(r3, 0xc0046d00, &(0x7f0000000200)) r4 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r4, 0x0, 0x0) ioctl$SIOCAX25GETUID(r4, 0x89e0, &(0x7f0000000080)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xee01}) ioctl$SNDCTL_SEQ_NRMIDIS(r2, 0x8004510b, &(0x7f0000000180)) 14:07:53 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0x0, 0x8, "f89c14", 0x81, 0x6}) r1 = accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @null}, [@bcast, @rose, @default, @remote, @default, @netrom, @bcast, @default]}, &(0x7f0000000100)=0x48) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000140)={@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @bcast, @default]}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0x0, 0x8, "f89c14", 0x81, 0x6}) (async) accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @null}, [@bcast, @rose, @default, @remote, @default, @netrom, @bcast, @default]}, &(0x7f0000000100)=0x48) (async) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000140)={@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @bcast, @default]}) (async) 14:07:53 executing program 3: ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}, 0x2}) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) ioctl$SNDCTL_MIDI_PRETIME(r1, 0xc0046d00, &(0x7f0000000080)) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x3b5040, 0x0) ioctl$SNDCTL_TMR_STOP(r2, 0x5403) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:53 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) (async) write$P9_RXATTRCREATE(r2, &(0x7f0000000000)={0x7, 0x21, 0x2}, 0x7) 14:07:53 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$sock_bt_hci(r1, 0x400448e6, &(0x7f0000000100)="3c52aa2178d02edf2cf23d12c43011cba7f2d81ab09728f522a30d1824ce23c253542fa8a4d1c6a49f937ad8e67ec6989cefbb652a2576d8b882a76c2e4b227127f3f168bd5ed39d312d9f52e1b4b0f259c544f3eb9b927ecd01b657a28a50265a702e115e1b695cfecdd449ebb73aaac7b5a2d58e63c19f350a12791c0ac927c23a4eeec264cd03c1b352963ff45b5172aefb80f0648975fa702371a3da0e2f1b") bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:53 executing program 5: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="180000000414e1fb00010000000000000000000000200000ed7baa850e73ebc5f2763c0a152e3445024b1a7df4248e4a75952a52ef4b2aa6595de84943e97a08356e974d0866004726693c"], 0x18}, 0x1, 0x0, 0x0, 0x20004801}, 0x20008800) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffe000/0x1000)=nil, 0x1000}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448e0, &(0x7f0000000000)) ioctl$SNDCTL_TMR_SOURCE(r0, 0xc0045406) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x2002, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x10000, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$SNDCTL_MIDI_PRETIME(r3, 0xc0046d00, &(0x7f0000000200)) r4 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r4, 0x0, 0x0) ioctl$SIOCAX25GETUID(r4, 0x89e0, &(0x7f0000000080)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0xee01}) ioctl$SNDCTL_SEQ_NRMIDIS(r2, 0x8004510b, &(0x7f0000000180)) 14:07:53 executing program 1: ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[0x0, 0x0, r0, r1, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000480)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000580)={&(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, r2], &(0x7f0000000540)=[0xda, 0x3, 0x5, 0x401], 0x8}) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000080)={0x1, 0x1, "3767de", 0x5, 0x1}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='svcrdma_post_recv\x00'}, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RCLUNK(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x79, 0x2}, 0x7) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x140c, 0x20, 0x70bd2c, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0xeefeb9a60f71e9d1}, 0x4004800) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x40300, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000200), 0xffffffffffffffff, 0x404200) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r6, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r6, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000000f14300028bd7000fedbdf25080001005f0000000800010001000000"], 0x20}, 0x1, 0x0, 0x0, 0x4048880}, 0x4000004) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000100)) read$sequencer(0xffffffffffffffff, &(0x7f00000000c0)=""/101, 0x65) ioctl$SNDCTL_SEQ_SYNC(r4, 0x5101) ioctl$sock_bt_hci(r3, 0x400448e0, &(0x7f0000000000)) sched_rr_get_interval(0x0, &(0x7f00000001c0)) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[0x0, 0x0, r0, r1, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000480)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000580)={&(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, r2], &(0x7f0000000540)=[0xda, 0x3, 0x5, 0x401], 0x8}) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000080)={0x1, 0x1, "3767de", 0x5, 0x1}) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='svcrdma_post_recv\x00'}, 0x10) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$P9_RCLUNK(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x79, 0x2}, 0x7) (async) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x140c, 0x20, 0x70bd2c, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0xeefeb9a60f71e9d1}, 0x4004800) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x40300, 0x0) (async) syz_open_dev$dri(&(0x7f0000000200), 0xffffffffffffffff, 0x404200) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r6, 0x0, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r6, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000000f14300028bd7000fedbdf25080001005f0000000800010001000000"], 0x20}, 0x1, 0x0, 0x0, 0x4048880}, 0x4000004) (async) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000100)) (async) read$sequencer(0xffffffffffffffff, &(0x7f00000000c0)=""/101, 0x65) (async) ioctl$SNDCTL_SEQ_SYNC(r4, 0x5101) (async) ioctl$sock_bt_hci(r3, 0x400448e0, &(0x7f0000000000)) (async) sched_rr_get_interval(0x0, &(0x7f00000001c0)) (async) 14:07:53 executing program 0: ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000040)={0x0}) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r2, r3, r4, r5, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000080)=[r0, 0x0, 0x0, r3, 0x0], &(0x7f00000000c0)=[0x10001, 0x401, 0x4, 0xfffffffffffffffc, 0x4], 0x5, 0x1}) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:53 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x4, 0x3}, 0xfffffffffffffe63) socket$isdn(0x22, 0x3, 0x68) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x2, 0x3}, 0x6) 14:07:53 executing program 3: ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}, 0x2}) (async, rerun: 32) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) ioctl$SNDCTL_MIDI_PRETIME(r1, 0xc0046d00, &(0x7f0000000080)) (async, rerun: 64) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async, rerun: 64) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x3b5040, 0x0) ioctl$SNDCTL_TMR_STOP(r2, 0x5403) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:53 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) write$P9_RXATTRCREATE(r2, &(0x7f0000000000)={0x7, 0x21, 0x2}, 0x7) 14:07:53 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = accept4$unix(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0x6e, 0xc00) clock_gettime(0x0, &(0x7f00000007c0)={0x0, 0x0}) recvmmsg$unix(r1, &(0x7f0000000740)=[{{&(0x7f0000000100), 0x6e, &(0x7f00000004c0)=[{&(0x7f0000000180)=""/244, 0xf4}, {&(0x7f0000000280)=""/74, 0x4a}, {&(0x7f0000000300)=""/221, 0xdd}, {&(0x7f0000000400)=""/140, 0x8c}], 0x4, &(0x7f0000000500)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x150}}, {{&(0x7f0000000680), 0x6e, &(0x7f0000000700)}}], 0x2, 0x2, &(0x7f0000000800)={r2, r3+10000000}) 14:07:53 executing program 0: ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000040)={0x0}) (async) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r2, r3, r4, r5, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000080)=[r0, 0x0, 0x0, r3, 0x0], &(0x7f00000000c0)=[0x10001, 0x401, 0x4, 0xfffffffffffffffc, 0x4], 0x5, 0x1}) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:53 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x4, 0x3}, 0xfffffffffffffe63) (async) socket$isdn(0x22, 0x3, 0x68) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x2, 0x3}, 0x6) 14:07:53 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000000)={0xff, [0x8000, 0x512], 0x100}, 0x10) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:53 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000040)={@bcast, @default}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x58, 0x140c, 0x1, 0x70bd2c, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0xb3fb}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x2}]}, 0x58}}, 0xc001) ioctl$SIOCAX25NOUID(r1, 0x89e3, &(0x7f0000000080)) 14:07:53 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x58, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x0, 0x1, 0x7f, 0x8, 0x40, 0xffffffffffffffff, 0x85, '\x00', r2, 0xffffffffffffffff, 0x0, 0x5, 0x5}, 0x48) 14:07:53 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x4, 0x3}, 0xfffffffffffffe63) socket$isdn(0x22, 0x3, 0x68) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x2, 0x3}, 0x6) 14:07:53 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000000)={0xff, [0x8000, 0x512], 0x100}, 0x10) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000000)={0xff, [0x8000, 0x512], 0x100}, 0x10) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) [ 2828.044739] Bluetooth: hci2 command 0x0401 tx timeout 14:07:53 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000000)={0xff, [0x8000, 0x512], 0x100}, 0x10) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:53 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x4, 0x3}, 0xfffffffffffffe63) (async) socket$isdn(0x22, 0x3, 0x68) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x2, 0x3}, 0x6) 14:07:53 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x58, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x0, 0x1, 0x7f, 0x8, 0x40, 0xffffffffffffffff, 0x85, '\x00', r2, 0xffffffffffffffff, 0x0, 0x5, 0x5}, 0x48) 14:07:53 executing program 0: ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000040)={0x0}) (async, rerun: 64) r1 = socket$unix(0x1, 0x5, 0x0) (rerun: 64) recvmsg$unix(r1, 0x0, 0x0) (async, rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async, rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r2, r3, r4, r5, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000080)=[r0, 0x0, 0x0, r3, 0x0], &(0x7f00000000c0)=[0x10001, 0x401, 0x4, 0xfffffffffffffffc, 0x4], 0x5, 0x1}) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:53 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000040)={@bcast, @default}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x58, 0x140c, 0x1, 0x70bd2c, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0xb3fb}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x2}]}, 0x58}}, 0xc001) ioctl$SIOCAX25NOUID(r1, 0x89e3, &(0x7f0000000080)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000040)={@bcast, @default}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) getpeername$ax25(r1, 0x0, 0x0) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x58, 0x140c, 0x1, 0x70bd2c, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0xb3fb}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x2}]}, 0x58}}, 0xc001) (async) ioctl$SIOCAX25NOUID(r1, 0x89e3, &(0x7f0000000080)) (async) 14:07:54 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000000)={0xff, [0x8000, 0x512], 0x100}, 0x10) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:54 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x800, 0x1}, 0x6) 14:07:54 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x58, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x0, 0x1, 0x7f, 0x8, 0x40, 0xffffffffffffffff, 0x85, '\x00', r2, 0xffffffffffffffff, 0x0, 0x5, 0x5}, 0x48) 14:07:54 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$SIOCAX25DELUID(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0x3, @bcast, 0xee00}) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000080)=0x9, 0x4) 14:07:54 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x800, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x800, 0x1}, 0x6) (async) 14:07:54 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x200000, 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:54 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) ioctl$SIOCAX25DELFWD(0xffffffffffffffff, 0x89eb, &(0x7f0000000040)={@bcast, @default}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x58, 0x140c, 0x1, 0x70bd2c, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0xb3fb}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x2}]}, 0x58}}, 0xc001) ioctl$SIOCAX25NOUID(r1, 0x89e3, &(0x7f0000000080)) 14:07:54 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f00000000c0)={0x59, [0x7af50c30, 0x613c], 0x22}, 0x10) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000080)={0x5, [0x7, 0x9]}, 0x10) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x18, 0x140f, 0x200, 0x70bd2b, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040044) write$bt_hci(r1, &(0x7f0000000100)={0x1, @write_eir={{0xc52, 0xf1}, {0x2, "6f88f4dbd68ddf307b68abd434fa79a167b793d02f922bdee750d258dbf7b21e9551670221d9b4cff16f0198b01e13bd628e789852fe51e7188423469ebb0e1d70a33fc6ddf24bffaf2b651ad47e060c93b72e19ca64966a6799c4b372556bc11cd316f8ec3cdb0a3a6a26057d6a0db2b82ee37d224a3bd0252d9bd42eecf5df9c0da550a61e46054d1c310fd8ebf380f5ace14b2436b6c47d42c1b1516c42010d2fbb648abd7a7a1d4c9237c6b94714e500f65e3396034d91fe46b8ec64787f95f1b025d404e09f7292a49a8eb2f36104d37851fbaae0569866cee9858109b52a092ea645135c41878ba660c4cf36e3"}}}, 0xf5) 14:07:54 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x2, 0x4}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x1, 0x1}, 0x6) 14:07:54 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e7, &(0x7f0000000080)="5aaddc9eec4e205975722c88cf164bb7d8451ab2f933d8835f99eecf255a63d44252d2f283b054a3f3159708b35a0ec65bb3ff000048a87ca2c0563607ccb21ae6aed58bfd627444b0ae210048611e3c0000f8638b73e35ff789a13111a58eecfb5823abd4bd43531fc9e945871fbd5515afaefc85ed07eaaf6e862106fa772a76ddd2774b99f005e8510ba08e5f07b6f9bab185d395881e968ad380e026d2bef5ecd438e86dfced2f5558e7c44946911a2850beebb363ee001e915225562a1f7888ae8b396aeb91da6e774c7f1636a78013") 14:07:54 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f00000000c0)={0x59, [0x7af50c30, 0x613c], 0x22}, 0x10) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000080)={0x5, [0x7, 0x9]}, 0x10) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) (async) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x18, 0x140f, 0x200, 0x70bd2b, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040044) (async) write$bt_hci(r1, &(0x7f0000000100)={0x1, @write_eir={{0xc52, 0xf1}, {0x2, "6f88f4dbd68ddf307b68abd434fa79a167b793d02f922bdee750d258dbf7b21e9551670221d9b4cff16f0198b01e13bd628e789852fe51e7188423469ebb0e1d70a33fc6ddf24bffaf2b651ad47e060c93b72e19ca64966a6799c4b372556bc11cd316f8ec3cdb0a3a6a26057d6a0db2b82ee37d224a3bd0252d9bd42eecf5df9c0da550a61e46054d1c310fd8ebf380f5ace14b2436b6c47d42c1b1516c42010d2fbb648abd7a7a1d4c9237c6b94714e500f65e3396034d91fe46b8ec64787f95f1b025d404e09f7292a49a8eb2f36104d37851fbaae0569866cee9858109b52a092ea645135c41878ba660c4cf36e3"}}}, 0xf5) 14:07:54 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0x0, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) write$P9_RSTATFS(r2, &(0x7f0000000100)={0x43, 0x9, 0x1, {0x2bbe, 0xffffffff, 0xc1f, 0x5, 0x800, 0x9, 0xe7, 0x8, 0xd5ea}}, 0x43) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xfffe, 0x4}, 0x4) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e21}, 0x6e) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x3}, 0x6) 14:07:54 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async, rerun: 32) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x800, 0x1}, 0x6) 14:07:54 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x200000, 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:54 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e7, &(0x7f0000000080)="5aaddc9eec4e205975722c88cf164bb7d8451ab2f933d8835f99eecf255a63d44252d2f283b054a3f3159708b35a0ec65bb3ff000048a87ca2c0563607ccb21ae6aed58bfd627444b0ae210048611e3c0000f8638b73e35ff789a13111a58eecfb5823abd4bd43531fc9e945871fbd5515afaefc85ed07eaaf6e862106fa772a76ddd2774b99f005e8510ba08e5f07b6f9bab185d395881e968ad380e026d2bef5ecd438e86dfced2f5558e7c44946911a2850beebb363ee001e915225562a1f7888ae8b396aeb91da6e774c7f1636a78013") syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e7, &(0x7f0000000080)="5aaddc9eec4e205975722c88cf164bb7d8451ab2f933d8835f99eecf255a63d44252d2f283b054a3f3159708b35a0ec65bb3ff000048a87ca2c0563607ccb21ae6aed58bfd627444b0ae210048611e3c0000f8638b73e35ff789a13111a58eecfb5823abd4bd43531fc9e945871fbd5515afaefc85ed07eaaf6e862106fa772a76ddd2774b99f005e8510ba08e5f07b6f9bab185d395881e968ad380e026d2bef5ecd438e86dfced2f5558e7c44946911a2850beebb363ee001e915225562a1f7888ae8b396aeb91da6e774c7f1636a78013") (async) 14:07:54 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f00000000c0)={0x59, [0x7af50c30, 0x613c], 0x22}, 0x10) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000080)={0x5, [0x7, 0x9]}, 0x10) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) (async) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x18, 0x140f, 0x200, 0x70bd2b, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040044) write$bt_hci(r1, &(0x7f0000000100)={0x1, @write_eir={{0xc52, 0xf1}, {0x2, "6f88f4dbd68ddf307b68abd434fa79a167b793d02f922bdee750d258dbf7b21e9551670221d9b4cff16f0198b01e13bd628e789852fe51e7188423469ebb0e1d70a33fc6ddf24bffaf2b651ad47e060c93b72e19ca64966a6799c4b372556bc11cd316f8ec3cdb0a3a6a26057d6a0db2b82ee37d224a3bd0252d9bd42eecf5df9c0da550a61e46054d1c310fd8ebf380f5ace14b2436b6c47d42c1b1516c42010d2fbb648abd7a7a1d4c9237c6b94714e500f65e3396034d91fe46b8ec64787f95f1b025d404e09f7292a49a8eb2f36104d37851fbaae0569866cee9858109b52a092ea645135c41878ba660c4cf36e3"}}}, 0xf5) 14:07:54 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000000)={0xc}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:54 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000000)=0xffffffbf, 0x4) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$HCIINQUIRY(r2, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:54 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x200000, 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:54 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getpeername$ax25(r2, 0x0, 0x0) ioctl$SIOCAX25DELFWD(r2, 0x89eb, &(0x7f0000000000)={@bcast, @null}) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:54 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000380)=ANY=[@ANYBLOB="00000000000a00000000000228bf532d472686fb11c456f6f88febb4f887b70aecf8e6a35ab802f44bc24e01f92dcf840b760c0000000000", @ANYRES32=0x0, @ANYBLOB="00100001000000070000000146c900d80066000002049078e0000002ac14143f94040100891fbcffffffffac1414bb0a0101027f0000010a010102e0000001e0000001891bd60a010100e00000010a0101027f0000010a010102ac1414bb4428371000000004000000080000000100000003000004010000ffff0000020000000009000100018903cb4414d971ffffffff00000003e000000100000004830c7432aca423e58852e19c8927d47f0000017f000001e0000001ac1414bb0a0101010a010100000000000a010102e000000283133fe000000200000000ac14141b0000000000"]}) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000040)={"b012516c936fbcc7268c1adf49ef7c8b491e93a5546758f0457bc4834d81", 0xd8e, 0x1, 0x401, 0xfffffff9, 0x7, 0x1ff, 0x7ff, 0x4, [0x1ff, 0x8001, 0x8000, 0x6, 0x9, 0x8, 0x10000, 0x5, 0x9, 0x401, 0x5a, 0xbd6, 0x3f, 0xa97, 0x9, 0x7f, 0x1, 0x3, 0x1ff]}) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f00000004c0)={"52a5e758ffa122ff053ccc5ea304fd665e551d50577e7b5d6f08e09c6718", 0x4, 0x0, 0x0, 0x7f, 0x4, 0x7, 0x7fff, 0x0, [0x5, 0x3, 0xfffff801, 0x54, 0x7, 0x3, 0x91b, 0x4, 0x7, 0x9, 0x3, 0x8001, 0x5, 0x0, 0x2, 0x10000, 0x6, 0x1, 0x3f]}) ioctl$GIO_FONT(0xffffffffffffffff, 0x4b60, &(0x7f0000000280)=""/202) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000041400042dbd7000fbdbdf250800010001000000080001000000000800010002000000080001000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20004004}, 0x40040090) 14:07:54 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e7, &(0x7f0000000080)="5aaddc9eec4e205975722c88cf164bb7d8451ab2f933d8835f99eecf255a63d44252d2f283b054a3f3159708b35a0ec65bb3ff000048a87ca2c0563607ccb21ae6aed58bfd627444b0ae210048611e3c0000f8638b73e35ff789a13111a58eecfb5823abd4bd43531fc9e945871fbd5515afaefc85ed07eaaf6e862106fa772a76ddd2774b99f005e8510ba08e5f07b6f9bab185d395881e968ad380e026d2bef5ecd438e86dfced2f5558e7c44946911a2850beebb363ee001e915225562a1f7888ae8b396aeb91da6e774c7f1636a78013") syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e7, &(0x7f0000000080)="5aaddc9eec4e205975722c88cf164bb7d8451ab2f933d8835f99eecf255a63d44252d2f283b054a3f3159708b35a0ec65bb3ff000048a87ca2c0563607ccb21ae6aed58bfd627444b0ae210048611e3c0000f8638b73e35ff789a13111a58eecfb5823abd4bd43531fc9e945871fbd5515afaefc85ed07eaaf6e862106fa772a76ddd2774b99f005e8510ba08e5f07b6f9bab185d395881e968ad380e026d2bef5ecd438e86dfced2f5558e7c44946911a2850beebb363ee001e915225562a1f7888ae8b396aeb91da6e774c7f1636a78013") (async) 14:07:54 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getpeername$ax25(r2, 0x0, 0x0) (async) ioctl$SIOCAX25DELFWD(r2, 0x89eb, &(0x7f0000000000)={@bcast, @null}) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:54 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) (rerun: 64) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000000)={0xc}) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:54 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000380)=ANY=[@ANYBLOB="00000000000a00000000000228bf532d472686fb11c456f6f88febb4f887b70aecf8e6a35ab802f44bc24e01f92dcf840b760c0000000000", @ANYRES32=0x0, @ANYBLOB="00100001000000070000000146c900d80066000002049078e0000002ac14143f94040100891fbcffffffffac1414bb0a0101027f0000010a010102e0000001e0000001891bd60a010100e00000010a0101027f0000010a010102ac1414bb4428371000000004000000080000000100000003000004010000ffff0000020000000009000100018903cb4414d971ffffffff00000003e000000100000004830c7432aca423e58852e19c8927d47f0000017f000001e0000001ac1414bb0a0101010a010100000000000a010102e000000283133fe000000200000000ac14141b0000000000"]}) (async) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000040)={"b012516c936fbcc7268c1adf49ef7c8b491e93a5546758f0457bc4834d81", 0xd8e, 0x1, 0x401, 0xfffffff9, 0x7, 0x1ff, 0x7ff, 0x4, [0x1ff, 0x8001, 0x8000, 0x6, 0x9, 0x8, 0x10000, 0x5, 0x9, 0x401, 0x5a, 0xbd6, 0x3f, 0xa97, 0x9, 0x7f, 0x1, 0x3, 0x1ff]}) (async) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f00000004c0)={"52a5e758ffa122ff053ccc5ea304fd665e551d50577e7b5d6f08e09c6718", 0x4, 0x0, 0x0, 0x7f, 0x4, 0x7, 0x7fff, 0x0, [0x5, 0x3, 0xfffff801, 0x54, 0x7, 0x3, 0x91b, 0x4, 0x7, 0x9, 0x3, 0x8001, 0x5, 0x0, 0x2, 0x10000, 0x6, 0x1, 0x3f]}) ioctl$GIO_FONT(0xffffffffffffffff, 0x4b60, &(0x7f0000000280)=""/202) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000041400042dbd7000fbdbdf250800010001000000080001000000000800010002000000080001000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20004004}, 0x40040090) 14:07:54 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x29) ioctl$SNDCTL_TMR_METRONOME(r2, 0x40045407) 14:07:54 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000380)=ANY=[@ANYBLOB="00000000000a00000000000228bf532d472686fb11c456f6f88febb4f887b70aecf8e6a35ab802f44bc24e01f92dcf840b760c0000000000", @ANYRES32=0x0, @ANYBLOB="00100001000000070000000146c900d80066000002049078e0000002ac14143f94040100891fbcffffffffac1414bb0a0101027f0000010a010102e0000001e0000001891bd60a010100e00000010a0101027f0000010a010102ac1414bb4428371000000004000000080000000100000003000004010000ffff0000020000000009000100018903cb4414d971ffffffff00000003e000000100000004830c7432aca423e58852e19c8927d47f0000017f000001e0000001ac1414bb0a0101010a010100000000000a010102e000000283133fe000000200000000ac14141b0000000000"]}) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000040)={"b012516c936fbcc7268c1adf49ef7c8b491e93a5546758f0457bc4834d81", 0xd8e, 0x1, 0x401, 0xfffffff9, 0x7, 0x1ff, 0x7ff, 0x4, [0x1ff, 0x8001, 0x8000, 0x6, 0x9, 0x8, 0x10000, 0x5, 0x9, 0x401, 0x5a, 0xbd6, 0x3f, 0xa97, 0x9, 0x7f, 0x1, 0x3, 0x1ff]}) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f00000004c0)={"52a5e758ffa122ff053ccc5ea304fd665e551d50577e7b5d6f08e09c6718", 0x4, 0x0, 0x0, 0x7f, 0x4, 0x7, 0x7fff, 0x0, [0x5, 0x3, 0xfffff801, 0x54, 0x7, 0x3, 0x91b, 0x4, 0x7, 0x9, 0x3, 0x8001, 0x5, 0x0, 0x2, 0x10000, 0x6, 0x1, 0x3f]}) ioctl$GIO_FONT(0xffffffffffffffff, 0x4b60, &(0x7f0000000280)=""/202) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000041400042dbd7000fbdbdf250800010001000000080001000000000800010002000000080001000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20004004}, 0x40040090) 14:07:54 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getpeername$ax25(r2, 0x0, 0x0) ioctl$SIOCAX25DELFWD(r2, 0x89eb, &(0x7f0000000000)={@bcast, @null}) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$ax25(0x3, 0x5, 0x0) (async) getpeername$ax25(r2, 0x0, 0x0) (async) ioctl$SIOCAX25DELFWD(r2, 0x89eb, &(0x7f0000000000)={@bcast, @null}) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:54 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x29) ioctl$SNDCTL_TMR_METRONOME(r2, 0x40045407) 14:07:54 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000380)=ANY=[@ANYBLOB="00000000000a00000000000228bf532d472686fb11c456f6f88febb4f887b70aecf8e6a35ab802f44bc24e01f92dcf840b760c0000000000", @ANYRES32=0x0, @ANYBLOB="00100001000000070000000146c900d80066000002049078e0000002ac14143f94040100891fbcffffffffac1414bb0a0101027f0000010a010102e0000001e0000001891bd60a010100e00000010a0101027f0000010a010102ac1414bb4428371000000004000000080000000100000003000004010000ffff0000020000000009000100018903cb4414d971ffffffff00000003e000000100000004830c7432aca423e58852e19c8927d47f0000017f000001e0000001ac1414bb0a0101010a010100000000000a010102e000000283133fe000000200000000ac14141b0000000000"]}) (async) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000040)={"b012516c936fbcc7268c1adf49ef7c8b491e93a5546758f0457bc4834d81", 0xd8e, 0x1, 0x401, 0xfffffff9, 0x7, 0x1ff, 0x7ff, 0x4, [0x1ff, 0x8001, 0x8000, 0x6, 0x9, 0x8, 0x10000, 0x5, 0x9, 0x401, 0x5a, 0xbd6, 0x3f, 0xa97, 0x9, 0x7f, 0x1, 0x3, 0x1ff]}) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f00000004c0)={"52a5e758ffa122ff053ccc5ea304fd665e551d50577e7b5d6f08e09c6718", 0x4, 0x0, 0x0, 0x7f, 0x4, 0x7, 0x7fff, 0x0, [0x5, 0x3, 0xfffff801, 0x54, 0x7, 0x3, 0x91b, 0x4, 0x7, 0x9, 0x3, 0x8001, 0x5, 0x0, 0x2, 0x10000, 0x6, 0x1, 0x3f]}) (async) ioctl$GIO_FONT(0xffffffffffffffff, 0x4b60, &(0x7f0000000280)=""/202) (async, rerun: 32) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000041400042dbd7000fbdbdf250800010001000000080001000000000800010002000000080001000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20004004}, 0x40040090) (rerun: 32) 14:07:54 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000380)=ANY=[@ANYBLOB="00000000000a00000000000228bf532d472686fb11c456f6f88febb4f887b70aecf8e6a35ab802f44bc24e01f92dcf840b760c0000000000", @ANYRES32=0x0, @ANYBLOB="00100001000000070000000146c900d80066000002049078e0000002ac14143f94040100891fbcffffffffac1414bb0a0101027f0000010a010102e0000001e0000001891bd60a010100e00000010a0101027f0000010a010102ac1414bb4428371000000004000000080000000100000003000004010000ffff0000020000000009000100018903cb4414d971ffffffff00000003e000000100000004830c7432aca423e58852e19c8927d47f0000017f000001e0000001ac1414bb0a0101010a010100000000000a010102e000000283133fe000000200000000ac14141b0000000000"]}) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000040)={"b012516c936fbcc7268c1adf49ef7c8b491e93a5546758f0457bc4834d81", 0xd8e, 0x1, 0x401, 0xfffffff9, 0x7, 0x1ff, 0x7ff, 0x4, [0x1ff, 0x8001, 0x8000, 0x6, 0x9, 0x8, 0x10000, 0x5, 0x9, 0x401, 0x5a, 0xbd6, 0x3f, 0xa97, 0x9, 0x7f, 0x1, 0x3, 0x1ff]}) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f00000004c0)={"52a5e758ffa122ff053ccc5ea304fd665e551d50577e7b5d6f08e09c6718", 0x4, 0x0, 0x0, 0x7f, 0x4, 0x7, 0x7fff, 0x0, [0x5, 0x3, 0xfffff801, 0x54, 0x7, 0x3, 0x91b, 0x4, 0x7, 0x9, 0x3, 0x8001, 0x5, 0x0, 0x2, 0x10000, 0x6, 0x1, 0x3f]}) ioctl$GIO_FONT(0xffffffffffffffff, 0x4b60, &(0x7f0000000280)=""/202) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000041400042dbd7000fbdbdf250800010001000000080001000000000800010002000000080001000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20004004}, 0x40040090) 14:07:54 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0xffffff7c, [0x8, 0x6c], 0xffe0}, 0x10) recvmmsg$unix(r1, &(0x7f0000008380)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000240)=[{&(0x7f0000000100)=""/249, 0xf9}, {&(0x7f0000000200)=""/40, 0x28}], 0x2}}, {{&(0x7f0000000280)=@abs, 0x6e, &(0x7f0000002500)=[{&(0x7f0000000300)=""/73, 0x49}, {&(0x7f0000000380)=""/45, 0x2d}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/138, 0x8a}, {&(0x7f0000001480)=""/103, 0x67}, {&(0x7f0000001500)=""/4096, 0x1000}], 0x6, &(0x7f0000002580)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xe0}}, {{0x0, 0x0, &(0x7f0000004b40)=[{&(0x7f0000002680)=""/220, 0xdc}, {&(0x7f0000002780)=""/24, 0x18}, {&(0x7f00000027c0)=""/4096, 0x1000}, {&(0x7f00000037c0)=""/223, 0xdf}, {&(0x7f00000038c0)=""/15, 0xf}, {&(0x7f0000003900)=""/52, 0x34}, {&(0x7f0000003940)=""/199, 0xc7}, {&(0x7f0000003a40)=""/5, 0x5}, {&(0x7f0000003a80)=""/168, 0xa8}, {&(0x7f0000003b40)=""/4096, 0x1000}], 0xa, &(0x7f0000004c00)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="180000000000e5ff4271eb69f0d8e953", @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x150}}, {{&(0x7f0000004d80), 0x6e, &(0x7f0000004f00)=[{&(0x7f0000004e00)=""/208, 0xd0}], 0x1, &(0x7f0000004f40)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x108}}, {{0x0, 0x0, &(0x7f00000052c0)=[{&(0x7f0000005080)=""/50, 0x32}, {&(0x7f00000050c0)=""/116, 0x74}, {&(0x7f0000005140)=""/137, 0x89}, {&(0x7f0000005200)=""/112, 0x70}, {&(0x7f0000005280)}], 0x5, &(0x7f0000005340)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xc8}}, {{&(0x7f0000005440)=@abs, 0x6e, &(0x7f0000005600)=[{&(0x7f00000054c0)=""/12, 0xc}, {&(0x7f0000005500)=""/196, 0xc4}], 0x2, &(0x7f0000005640)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xe0}}, {{0x0, 0x0, &(0x7f0000005900)=[{&(0x7f0000005740)=""/28, 0x1c}, {&(0x7f0000005780)=""/26, 0x1a}, {&(0x7f00000057c0)=""/140, 0x8c}, {&(0x7f0000005880)=""/93, 0x5d}], 0x4, &(0x7f0000005940)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x140}}, {{0x0, 0x0, &(0x7f0000006c40)=[{&(0x7f0000005a80)=""/141, 0x8d}, {&(0x7f0000005b40)=""/4096, 0x1000}, {&(0x7f0000006b40)=""/230, 0xe6}], 0x3, &(0x7f0000006c80)=[@cred={{0x1c}}, @rights={{0x10}}], 0x30}}, {{0x0, 0x0, &(0x7f0000007f00)=[{&(0x7f0000006cc0)=""/229, 0xe5}, {&(0x7f0000006dc0)=""/35, 0x23}, {&(0x7f0000006e00)=""/4096, 0x1000}, {&(0x7f0000007e00)=""/202, 0xca}], 0x4, &(0x7f0000007f40)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{0x0, 0x0, &(0x7f0000008240)=[{&(0x7f0000007fc0)=""/110, 0x6e}, {&(0x7f0000008040)=""/158, 0x9e}, {&(0x7f0000008100)=""/242, 0xf2}, {&(0x7f0000008200)=""/3, 0x3}], 0x4, &(0x7f0000008280)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xf8}}], 0xa, 0x10002, &(0x7f0000008600)={0x0, 0x989680}) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:54 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SIOCAX25ADDUID(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={0x3, @null, 0xee00}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000080)=0x1f, 0x4) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:54 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000040)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) 14:07:54 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SIOCAX25ADDUID(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={0x3, @null, 0xee00}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000080)=0x1f, 0x4) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SIOCAX25ADDUID(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={0x3, @null, 0xee00}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000080)=0x1f, 0x4) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:54 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000000)={0xc}) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:54 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async, rerun: 64) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) (rerun: 64) getpeername$ax25(r1, 0x0, 0x0) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000040)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) 14:07:54 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x29) ioctl$SNDCTL_TMR_METRONOME(r2, 0x40045407) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r2, 0x0, 0x29) (async) ioctl$SNDCTL_TMR_METRONOME(r2, 0x40045407) (async) 14:07:54 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SIOCAX25ADDUID(0xffffffffffffffff, 0x89e1, &(0x7f0000000000)={0x3, @null, 0xee00}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (rerun: 32) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async, rerun: 32) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000080)=0x1f, 0x4) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:54 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000380)=ANY=[@ANYBLOB="00000000000a00000000000228bf532d472686fb11c456f6f88febb4f887b70aecf8e6a35ab802f44bc24e01f92dcf840b760c0000000000", @ANYRES32=0x0, @ANYBLOB="00100001000000070000000146c900d80066000002049078e0000002ac14143f94040100891fbcffffffffac1414bb0a0101027f0000010a010102e0000001e0000001891bd60a010100e00000010a0101027f0000010a010102ac1414bb4428371000000004000000080000000100000003000004010000ffff0000020000000009000100018903cb4414d971ffffffff00000003e000000100000004830c7432aca423e58852e19c8927d47f0000017f000001e0000001ac1414bb0a0101010a010100000000000a010102e000000283133fe000000200000000ac14141b0000000000"]}) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000040)={"b012516c936fbcc7268c1adf49ef7c8b491e93a5546758f0457bc4834d81", 0xd8e, 0x1, 0x401, 0xfffffff9, 0x7, 0x1ff, 0x7ff, 0x4, [0x1ff, 0x8001, 0x8000, 0x6, 0x9, 0x8, 0x10000, 0x5, 0x9, 0x401, 0x5a, 0xbd6, 0x3f, 0xa97, 0x9, 0x7f, 0x1, 0x3, 0x1ff]}) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f00000004c0)={"52a5e758ffa122ff053ccc5ea304fd665e551d50577e7b5d6f08e09c6718", 0x4, 0x0, 0x0, 0x7f, 0x4, 0x7, 0x7fff, 0x0, [0x5, 0x3, 0xfffff801, 0x54, 0x7, 0x3, 0x91b, 0x4, 0x7, 0x9, 0x3, 0x8001, 0x5, 0x0, 0x2, 0x10000, 0x6, 0x1, 0x3f]}) ioctl$GIO_FONT(0xffffffffffffffff, 0x4b60, &(0x7f0000000280)=""/202) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000041400042dbd7000fbdbdf250800010001000000080001000000000800010002000000080001000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x20004004}, 0x40040090) 14:07:54 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r1, 0x80045105, &(0x7f00000001c0)) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r2, 0xc0045103, &(0x7f0000000080)=0x3f) ioctl$SNDCTL_SEQ_RESET(0xffffffffffffffff, 0x5100) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x4300, 0x0) write$apparmor_current(r3, 0x0, 0x0) ioctl$SNDCTL_SEQ_NRSYNTHS(r3, 0x8004510a, &(0x7f00000000c0)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x281, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r4, 0x40085112, &(0x7f0000000180)=@v={0x93, 0x2, 0x90, 0x15, @generic=0x81, 0x8e, 0x4}) 14:07:54 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000380)=ANY=[@ANYBLOB="00000000000a00000000000228bf532d472686fb11c456f6f88febb4f887b70aecf8e6a35ab802f44bc24e01f92dcf840b760c0000000000", @ANYRES32=0x0, @ANYBLOB="00100001000000070000000146c900d80066000002049078e0000002ac14143f94040100891fbcffffffffac1414bb0a0101027f0000010a010102e0000001e0000001891bd60a010100e00000010a0101027f0000010a010102ac1414bb4428371000000004000000080000000100000003000004010000ffff0000020000000009000100018903cb4414d971ffffffff00000003e000000100000004830c7432aca423e58852e19c8927d47f0000017f000001e0000001ac1414bb0a0101010a010100000000000a010102e000000283133fe000000200000000ac14141b0000000000"]}) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000040)={"b012516c936fbcc7268c1adf49ef7c8b491e93a5546758f0457bc4834d81", 0xd8e, 0x1, 0x401, 0xfffffff9, 0x7, 0x1ff, 0x7ff, 0x4, [0x1ff, 0x8001, 0x8000, 0x6, 0x9, 0x8, 0x10000, 0x5, 0x9, 0x401, 0x5a, 0xbd6, 0x3f, 0xa97, 0x9, 0x7f, 0x1, 0x3, 0x1ff]}) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f00000004c0)={"52a5e758ffa122ff053ccc5ea304fd665e551d50577e7b5d6f08e09c6718", 0x4, 0x0, 0x0, 0x7f, 0x4, 0x7, 0x7fff, 0x0, [0x5, 0x3, 0xfffff801, 0x54, 0x7, 0x3, 0x91b, 0x4, 0x7, 0x9, 0x3, 0x8001, 0x5, 0x0, 0x2, 0x10000, 0x6, 0x1, 0x3f]}) ioctl$GIO_FONT(0xffffffffffffffff, 0x4b60, &(0x7f0000000280)=""/202) 14:07:54 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000040)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) getpeername$ax25(r1, 0x0, 0x0) (async) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000040)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x3, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) (async) 14:07:55 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000380)=ANY=[@ANYBLOB="00000000000a00000000000228bf532d472686fb11c456f6f88febb4f887b70aecf8e6a35ab802f44bc24e01f92dcf840b760c0000000000", @ANYRES32=0x0, @ANYBLOB="00100001000000070000000146c900d80066000002049078e0000002ac14143f94040100891fbcffffffffac1414bb0a0101027f0000010a010102e0000001e0000001891bd60a010100e00000010a0101027f0000010a010102ac1414bb4428371000000004000000080000000100000003000004010000ffff0000020000000009000100018903cb4414d971ffffffff00000003e000000100000004830c7432aca423e58852e19c8927d47f0000017f000001e0000001ac1414bb0a0101010a010100000000000a010102e000000283133fe000000200000000ac14141b0000000000"]}) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000040)={"b012516c936fbcc7268c1adf49ef7c8b491e93a5546758f0457bc4834d81", 0xd8e, 0x1, 0x401, 0xfffffff9, 0x7, 0x1ff, 0x7ff, 0x4, [0x1ff, 0x8001, 0x8000, 0x6, 0x9, 0x8, 0x10000, 0x5, 0x9, 0x401, 0x5a, 0xbd6, 0x3f, 0xa97, 0x9, 0x7f, 0x1, 0x3, 0x1ff]}) ioctl$SNDCTL_SYNTH_INFO(0xffffffffffffffff, 0xc08c5102, &(0x7f00000004c0)={"52a5e758ffa122ff053ccc5ea304fd665e551d50577e7b5d6f08e09c6718", 0x4, 0x0, 0x0, 0x7f, 0x4, 0x7, 0x7fff, 0x0, [0x5, 0x3, 0xfffff801, 0x54, 0x7, 0x3, 0x91b, 0x4, 0x7, 0x9, 0x3, 0x8001, 0x5, 0x0, 0x2, 0x10000, 0x6, 0x1, 0x3f]}) 14:07:55 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) bind$vsock_dgram(r2, &(0x7f0000000080)={0x28, 0x0, 0x2711}, 0x10) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xfffd, 0x3}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:55 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_GETINCOUNT(r1, 0x80045105, &(0x7f00000001c0)) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r2, 0xc0045103, &(0x7f0000000080)=0x3f) (async, rerun: 64) ioctl$SNDCTL_SEQ_RESET(0xffffffffffffffff, 0x5100) (rerun: 64) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x4300, 0x0) write$apparmor_current(r3, 0x0, 0x0) ioctl$SNDCTL_SEQ_NRSYNTHS(r3, 0x8004510a, &(0x7f00000000c0)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x281, 0x0) (rerun: 32) ioctl$SNDCTL_SEQ_OUTOFBAND(r4, 0x40085112, &(0x7f0000000180)=@v={0x93, 0x2, 0x90, 0x15, @generic=0x81, 0x8e, 0x4}) 14:07:55 executing program 0: write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000040)='1', 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:55 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0xffffff7c, [0x8, 0x6c], 0xffe0}, 0x10) recvmmsg$unix(r1, &(0x7f0000008380)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000240)=[{&(0x7f0000000100)=""/249, 0xf9}, {&(0x7f0000000200)=""/40, 0x28}], 0x2}}, {{&(0x7f0000000280)=@abs, 0x6e, &(0x7f0000002500)=[{&(0x7f0000000300)=""/73, 0x49}, {&(0x7f0000000380)=""/45, 0x2d}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/138, 0x8a}, {&(0x7f0000001480)=""/103, 0x67}, {&(0x7f0000001500)=""/4096, 0x1000}], 0x6, &(0x7f0000002580)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xe0}}, {{0x0, 0x0, &(0x7f0000004b40)=[{&(0x7f0000002680)=""/220, 0xdc}, {&(0x7f0000002780)=""/24, 0x18}, {&(0x7f00000027c0)=""/4096, 0x1000}, {&(0x7f00000037c0)=""/223, 0xdf}, {&(0x7f00000038c0)=""/15, 0xf}, {&(0x7f0000003900)=""/52, 0x34}, {&(0x7f0000003940)=""/199, 0xc7}, {&(0x7f0000003a40)=""/5, 0x5}, {&(0x7f0000003a80)=""/168, 0xa8}, {&(0x7f0000003b40)=""/4096, 0x1000}], 0xa, &(0x7f0000004c00)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="180000000000e5ff4271eb69f0d8e953", @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x150}}, {{&(0x7f0000004d80), 0x6e, &(0x7f0000004f00)=[{&(0x7f0000004e00)=""/208, 0xd0}], 0x1, &(0x7f0000004f40)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x108}}, {{0x0, 0x0, &(0x7f00000052c0)=[{&(0x7f0000005080)=""/50, 0x32}, {&(0x7f00000050c0)=""/116, 0x74}, {&(0x7f0000005140)=""/137, 0x89}, {&(0x7f0000005200)=""/112, 0x70}, {&(0x7f0000005280)}], 0x5, &(0x7f0000005340)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xc8}}, {{&(0x7f0000005440)=@abs, 0x6e, &(0x7f0000005600)=[{&(0x7f00000054c0)=""/12, 0xc}, {&(0x7f0000005500)=""/196, 0xc4}], 0x2, &(0x7f0000005640)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xe0}}, {{0x0, 0x0, &(0x7f0000005900)=[{&(0x7f0000005740)=""/28, 0x1c}, {&(0x7f0000005780)=""/26, 0x1a}, {&(0x7f00000057c0)=""/140, 0x8c}, {&(0x7f0000005880)=""/93, 0x5d}], 0x4, &(0x7f0000005940)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x140}}, {{0x0, 0x0, &(0x7f0000006c40)=[{&(0x7f0000005a80)=""/141, 0x8d}, {&(0x7f0000005b40)=""/4096, 0x1000}, {&(0x7f0000006b40)=""/230, 0xe6}], 0x3, &(0x7f0000006c80)=[@cred={{0x1c}}, @rights={{0x10}}], 0x30}}, {{0x0, 0x0, &(0x7f0000007f00)=[{&(0x7f0000006cc0)=""/229, 0xe5}, {&(0x7f0000006dc0)=""/35, 0x23}, {&(0x7f0000006e00)=""/4096, 0x1000}, {&(0x7f0000007e00)=""/202, 0xca}], 0x4, &(0x7f0000007f40)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{0x0, 0x0, &(0x7f0000008240)=[{&(0x7f0000007fc0)=""/110, 0x6e}, {&(0x7f0000008040)=""/158, 0x9e}, {&(0x7f0000008100)=""/242, 0xf2}, {&(0x7f0000008200)=""/3, 0x3}], 0x4, &(0x7f0000008280)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xf8}}], 0xa, 0x10002, &(0x7f0000008600)={0x0, 0x989680}) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0xffffff7c, [0x8, 0x6c], 0xffe0}, 0x10) (async) recvmmsg$unix(r1, &(0x7f0000008380)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000240)=[{&(0x7f0000000100)=""/249, 0xf9}, {&(0x7f0000000200)=""/40, 0x28}], 0x2}}, {{&(0x7f0000000280)=@abs, 0x6e, &(0x7f0000002500)=[{&(0x7f0000000300)=""/73, 0x49}, {&(0x7f0000000380)=""/45, 0x2d}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/138, 0x8a}, {&(0x7f0000001480)=""/103, 0x67}, {&(0x7f0000001500)=""/4096, 0x1000}], 0x6, &(0x7f0000002580)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xe0}}, {{0x0, 0x0, &(0x7f0000004b40)=[{&(0x7f0000002680)=""/220, 0xdc}, {&(0x7f0000002780)=""/24, 0x18}, {&(0x7f00000027c0)=""/4096, 0x1000}, {&(0x7f00000037c0)=""/223, 0xdf}, {&(0x7f00000038c0)=""/15, 0xf}, {&(0x7f0000003900)=""/52, 0x34}, {&(0x7f0000003940)=""/199, 0xc7}, {&(0x7f0000003a40)=""/5, 0x5}, {&(0x7f0000003a80)=""/168, 0xa8}, {&(0x7f0000003b40)=""/4096, 0x1000}], 0xa, &(0x7f0000004c00)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="180000000000e5ff4271eb69f0d8e953", @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x150}}, {{&(0x7f0000004d80), 0x6e, &(0x7f0000004f00)=[{&(0x7f0000004e00)=""/208, 0xd0}], 0x1, &(0x7f0000004f40)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x108}}, {{0x0, 0x0, &(0x7f00000052c0)=[{&(0x7f0000005080)=""/50, 0x32}, {&(0x7f00000050c0)=""/116, 0x74}, {&(0x7f0000005140)=""/137, 0x89}, {&(0x7f0000005200)=""/112, 0x70}, {&(0x7f0000005280)}], 0x5, &(0x7f0000005340)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xc8}}, {{&(0x7f0000005440)=@abs, 0x6e, &(0x7f0000005600)=[{&(0x7f00000054c0)=""/12, 0xc}, {&(0x7f0000005500)=""/196, 0xc4}], 0x2, &(0x7f0000005640)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xe0}}, {{0x0, 0x0, &(0x7f0000005900)=[{&(0x7f0000005740)=""/28, 0x1c}, {&(0x7f0000005780)=""/26, 0x1a}, {&(0x7f00000057c0)=""/140, 0x8c}, {&(0x7f0000005880)=""/93, 0x5d}], 0x4, &(0x7f0000005940)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x140}}, {{0x0, 0x0, &(0x7f0000006c40)=[{&(0x7f0000005a80)=""/141, 0x8d}, {&(0x7f0000005b40)=""/4096, 0x1000}, {&(0x7f0000006b40)=""/230, 0xe6}], 0x3, &(0x7f0000006c80)=[@cred={{0x1c}}, @rights={{0x10}}], 0x30}}, {{0x0, 0x0, &(0x7f0000007f00)=[{&(0x7f0000006cc0)=""/229, 0xe5}, {&(0x7f0000006dc0)=""/35, 0x23}, {&(0x7f0000006e00)=""/4096, 0x1000}, {&(0x7f0000007e00)=""/202, 0xca}], 0x4, &(0x7f0000007f40)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{0x0, 0x0, &(0x7f0000008240)=[{&(0x7f0000007fc0)=""/110, 0x6e}, {&(0x7f0000008040)=""/158, 0x9e}, {&(0x7f0000008100)=""/242, 0xf2}, {&(0x7f0000008200)=""/3, 0x3}], 0x4, &(0x7f0000008280)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xf8}}], 0xa, 0x10002, &(0x7f0000008600)={0x0, 0x989680}) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) 14:07:55 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x10400, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r2, 0x40285107) 14:07:55 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000380)=ANY=[@ANYBLOB="00000000000a00000000000228bf532d472686fb11c456f6f88febb4f887b70aecf8e6a35ab802f44bc24e01f92dcf840b760c0000000000", @ANYRES32=0x0, @ANYBLOB="00100001000000070000000146c900d80066000002049078e0000002ac14143f94040100891fbcffffffffac1414bb0a0101027f0000010a010102e0000001e0000001891bd60a010100e00000010a0101027f0000010a010102ac1414bb4428371000000004000000080000000100000003000004010000ffff0000020000000009000100018903cb4414d971ffffffff00000003e000000100000004830c7432aca423e58852e19c8927d47f0000017f000001e0000001ac1414bb0a0101010a010100000000000a010102e000000283133fe000000200000000ac14141b0000000000"]}) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000040)={"b012516c936fbcc7268c1adf49ef7c8b491e93a5546758f0457bc4834d81", 0xd8e, 0x1, 0x401, 0xfffffff9, 0x7, 0x1ff, 0x7ff, 0x4, [0x1ff, 0x8001, 0x8000, 0x6, 0x9, 0x8, 0x10000, 0x5, 0x9, 0x401, 0x5a, 0xbd6, 0x3f, 0xa97, 0x9, 0x7f, 0x1, 0x3, 0x1ff]}) 14:07:55 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000380)=ANY=[@ANYBLOB="00000000000a00000000000228bf532d472686fb11c456f6f88febb4f887b70aecf8e6a35ab802f44bc24e01f92dcf840b760c0000000000", @ANYRES32=0x0, @ANYBLOB="00100001000000070000000146c900d80066000002049078e0000002ac14143f94040100891fbcffffffffac1414bb0a0101027f0000010a010102e0000001e0000001891bd60a010100e00000010a0101027f0000010a010102ac1414bb4428371000000004000000080000000100000003000004010000ffff0000020000000009000100018903cb4414d971ffffffff00000003e000000100000004830c7432aca423e58852e19c8927d47f0000017f000001e0000001ac1414bb0a0101010a010100000000000a010102e000000283133fe000000200000000ac14141b0000000000"]}) 14:07:55 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x10400, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r2, 0x40285107) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x10400, 0x0) (async) ioctl$SNDCTL_FM_LOAD_INSTR(r2, 0x40285107) (async) 14:07:55 executing program 0: write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000040)='1', 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000040)='1', 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) 14:07:55 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) 14:07:55 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) bind$vsock_dgram(r2, &(0x7f0000000080)={0x28, 0x0, 0x2711}, 0x10) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xfffd, 0x3}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r2, 0x0, 0x0) (async) bind$vsock_dgram(r2, &(0x7f0000000080)={0x28, 0x0, 0x2711}, 0x10) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xfffd, 0x3}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:55 executing program 0: write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000040)='1', 0x1) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:55 executing program 5: bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) 14:07:55 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r1, 0x80045105, &(0x7f00000001c0)) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r2, 0xc0045103, &(0x7f0000000080)=0x3f) ioctl$SNDCTL_SEQ_RESET(0xffffffffffffffff, 0x5100) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x4300, 0x0) write$apparmor_current(r3, 0x0, 0x0) ioctl$SNDCTL_SEQ_NRSYNTHS(r3, 0x8004510a, &(0x7f00000000c0)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x281, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r4, 0x40085112, &(0x7f0000000180)=@v={0x93, 0x2, 0x90, 0x15, @generic=0x81, 0x8e, 0x4}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_GETINCOUNT(r1, 0x80045105, &(0x7f00000001c0)) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_CTRLRATE(r2, 0xc0045103, &(0x7f0000000080)=0x3f) (async) ioctl$SNDCTL_SEQ_RESET(0xffffffffffffffff, 0x5100) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x4300, 0x0) (async) write$apparmor_current(r3, 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_NRSYNTHS(r3, 0x8004510a, &(0x7f00000000c0)) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x281, 0x0) (async) ioctl$SNDCTL_SEQ_OUTOFBAND(r4, 0x40085112, &(0x7f0000000180)=@v={0x93, 0x2, 0x90, 0x15, @generic=0x81, 0x8e, 0x4}) (async) 14:07:55 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0x19, 0x4) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) [ 2830.124449] Bluetooth: hci2 command 0x0401 tx timeout 14:07:56 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0xffffff7c, [0x8, 0x6c], 0xffe0}, 0x10) recvmmsg$unix(r1, &(0x7f0000008380)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000240)=[{&(0x7f0000000100)=""/249, 0xf9}, {&(0x7f0000000200)=""/40, 0x28}], 0x2}}, {{&(0x7f0000000280)=@abs, 0x6e, &(0x7f0000002500)=[{&(0x7f0000000300)=""/73, 0x49}, {&(0x7f0000000380)=""/45, 0x2d}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/138, 0x8a}, {&(0x7f0000001480)=""/103, 0x67}, {&(0x7f0000001500)=""/4096, 0x1000}], 0x6, &(0x7f0000002580)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xe0}}, {{0x0, 0x0, &(0x7f0000004b40)=[{&(0x7f0000002680)=""/220, 0xdc}, {&(0x7f0000002780)=""/24, 0x18}, {&(0x7f00000027c0)=""/4096, 0x1000}, {&(0x7f00000037c0)=""/223, 0xdf}, {&(0x7f00000038c0)=""/15, 0xf}, {&(0x7f0000003900)=""/52, 0x34}, {&(0x7f0000003940)=""/199, 0xc7}, {&(0x7f0000003a40)=""/5, 0x5}, {&(0x7f0000003a80)=""/168, 0xa8}, {&(0x7f0000003b40)=""/4096, 0x1000}], 0xa, &(0x7f0000004c00)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="180000000000e5ff4271eb69f0d8e953", @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x150}}, {{&(0x7f0000004d80), 0x6e, &(0x7f0000004f00)=[{&(0x7f0000004e00)=""/208, 0xd0}], 0x1, &(0x7f0000004f40)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x108}}, {{0x0, 0x0, &(0x7f00000052c0)=[{&(0x7f0000005080)=""/50, 0x32}, {&(0x7f00000050c0)=""/116, 0x74}, {&(0x7f0000005140)=""/137, 0x89}, {&(0x7f0000005200)=""/112, 0x70}, {&(0x7f0000005280)}], 0x5, &(0x7f0000005340)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xc8}}, {{&(0x7f0000005440)=@abs, 0x6e, &(0x7f0000005600)=[{&(0x7f00000054c0)=""/12, 0xc}, {&(0x7f0000005500)=""/196, 0xc4}], 0x2, &(0x7f0000005640)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xe0}}, {{0x0, 0x0, &(0x7f0000005900)=[{&(0x7f0000005740)=""/28, 0x1c}, {&(0x7f0000005780)=""/26, 0x1a}, {&(0x7f00000057c0)=""/140, 0x8c}, {&(0x7f0000005880)=""/93, 0x5d}], 0x4, &(0x7f0000005940)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x140}}, {{0x0, 0x0, &(0x7f0000006c40)=[{&(0x7f0000005a80)=""/141, 0x8d}, {&(0x7f0000005b40)=""/4096, 0x1000}, {&(0x7f0000006b40)=""/230, 0xe6}], 0x3, &(0x7f0000006c80)=[@cred={{0x1c}}, @rights={{0x10}}], 0x30}}, {{0x0, 0x0, &(0x7f0000007f00)=[{&(0x7f0000006cc0)=""/229, 0xe5}, {&(0x7f0000006dc0)=""/35, 0x23}, {&(0x7f0000006e00)=""/4096, 0x1000}, {&(0x7f0000007e00)=""/202, 0xca}], 0x4, &(0x7f0000007f40)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{0x0, 0x0, &(0x7f0000008240)=[{&(0x7f0000007fc0)=""/110, 0x6e}, {&(0x7f0000008040)=""/158, 0x9e}, {&(0x7f0000008100)=""/242, 0xf2}, {&(0x7f0000008200)=""/3, 0x3}], 0x4, &(0x7f0000008280)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xf8}}], 0xa, 0x10002, &(0x7f0000008600)={0x0, 0x989680}) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0xffffff7c, [0x8, 0x6c], 0xffe0}, 0x10) (async) recvmmsg$unix(r1, &(0x7f0000008380)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000240)=[{&(0x7f0000000100)=""/249, 0xf9}, {&(0x7f0000000200)=""/40, 0x28}], 0x2}}, {{&(0x7f0000000280)=@abs, 0x6e, &(0x7f0000002500)=[{&(0x7f0000000300)=""/73, 0x49}, {&(0x7f0000000380)=""/45, 0x2d}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/138, 0x8a}, {&(0x7f0000001480)=""/103, 0x67}, {&(0x7f0000001500)=""/4096, 0x1000}], 0x6, &(0x7f0000002580)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xe0}}, {{0x0, 0x0, &(0x7f0000004b40)=[{&(0x7f0000002680)=""/220, 0xdc}, {&(0x7f0000002780)=""/24, 0x18}, {&(0x7f00000027c0)=""/4096, 0x1000}, {&(0x7f00000037c0)=""/223, 0xdf}, {&(0x7f00000038c0)=""/15, 0xf}, {&(0x7f0000003900)=""/52, 0x34}, {&(0x7f0000003940)=""/199, 0xc7}, {&(0x7f0000003a40)=""/5, 0x5}, {&(0x7f0000003a80)=""/168, 0xa8}, {&(0x7f0000003b40)=""/4096, 0x1000}], 0xa, &(0x7f0000004c00)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="180000000000e5ff4271eb69f0d8e953", @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x150}}, {{&(0x7f0000004d80), 0x6e, &(0x7f0000004f00)=[{&(0x7f0000004e00)=""/208, 0xd0}], 0x1, &(0x7f0000004f40)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x108}}, {{0x0, 0x0, &(0x7f00000052c0)=[{&(0x7f0000005080)=""/50, 0x32}, {&(0x7f00000050c0)=""/116, 0x74}, {&(0x7f0000005140)=""/137, 0x89}, {&(0x7f0000005200)=""/112, 0x70}, {&(0x7f0000005280)}], 0x5, &(0x7f0000005340)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xc8}}, {{&(0x7f0000005440)=@abs, 0x6e, &(0x7f0000005600)=[{&(0x7f00000054c0)=""/12, 0xc}, {&(0x7f0000005500)=""/196, 0xc4}], 0x2, &(0x7f0000005640)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0xe0}}, {{0x0, 0x0, &(0x7f0000005900)=[{&(0x7f0000005740)=""/28, 0x1c}, {&(0x7f0000005780)=""/26, 0x1a}, {&(0x7f00000057c0)=""/140, 0x8c}, {&(0x7f0000005880)=""/93, 0x5d}], 0x4, &(0x7f0000005940)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x140}}, {{0x0, 0x0, &(0x7f0000006c40)=[{&(0x7f0000005a80)=""/141, 0x8d}, {&(0x7f0000005b40)=""/4096, 0x1000}, {&(0x7f0000006b40)=""/230, 0xe6}], 0x3, &(0x7f0000006c80)=[@cred={{0x1c}}, @rights={{0x10}}], 0x30}}, {{0x0, 0x0, &(0x7f0000007f00)=[{&(0x7f0000006cc0)=""/229, 0xe5}, {&(0x7f0000006dc0)=""/35, 0x23}, {&(0x7f0000006e00)=""/4096, 0x1000}, {&(0x7f0000007e00)=""/202, 0xca}], 0x4, &(0x7f0000007f40)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{0x0, 0x0, &(0x7f0000008240)=[{&(0x7f0000007fc0)=""/110, 0x6e}, {&(0x7f0000008040)=""/158, 0x9e}, {&(0x7f0000008100)=""/242, 0xf2}, {&(0x7f0000008200)=""/3, 0x3}], 0x4, &(0x7f0000008280)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xf8}}], 0xa, 0x10002, &(0x7f0000008600)={0x0, 0x989680}) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) 14:07:56 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) (async) bind$vsock_dgram(r2, &(0x7f0000000080)={0x28, 0x0, 0x2711}, 0x10) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xfffd, 0x3}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:56 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0x19, 0x4) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0x19, 0x4) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) 14:07:56 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async, rerun: 32) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async, rerun: 32) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x10400, 0x0) ioctl$SNDCTL_FM_LOAD_INSTR(r2, 0x40285107) 14:07:56 executing program 5: bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) 14:07:56 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) connect$ax25(r1, &(0x7f00000004c0)={{0x3, @default, 0x3}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}, 0x48) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f00000003c0)={0x2, 0x2, "741025", 0x8, 0x6}) sendmsg$RDMA_NLDEV_CMD_SET(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000021400032abd7000fbdbdf2508000100de0000000900020073797a3000000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040010) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x7) ioctl$sock_bt_hci(r3, 0x400448cc, &(0x7f00000002c0)="af5c8281d127aa0324ae4e5318af4e46860fdfe26c68734e99c72a19a24d420382ffd03e432208253659fdc0e015ae5911b6598703d690b385f3b4eb08af7ea05e668e79b9b75250b961c86edb94c6325712490963762b3f33bc3f31a142aae0ec4e50ab52e7ac51cdbb5f6684c62575873e0dacc2db6e58748ab7060f8bce7eb30dad921b6e6bb4c01e8a28bba2564a88c6bf6a7358c4eb24aaf85ac53d8e8a083e0905c39bb7889882a3fc2423506b9427e9307da4eecad633858d2e4c6e") syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000280)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r5 = accept$unix(0xffffffffffffffff, &(0x7f0000000400)=@abs, &(0x7f0000000480)=0x6e) bind$unix(r5, &(0x7f0000000200)=@abs={0x0, 0x0, 0x4e21}, 0x6e) accept4$unix(r4, 0x0, &(0x7f0000000380), 0x80000) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x402001, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r6, 0xc00c642e, &(0x7f0000000180)) 14:07:56 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0x19, 0x4) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0x19, 0x4) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) 14:07:56 executing program 5: bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) 14:07:56 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$sock_bt_hci(r2, 0x800448d7, &(0x7f0000000100)="c85c1e16be54693a8eac96024326a421b8ea8448fb0f840c15996e0f29a4704a7d87a643c75ea34052603c0143a0b13f9232b6e3a1ea7029056b0a80f6ea84581f3313a108174e934307113da2") bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x800) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000080)={0x7fffffff, [0x1ff, 0x2], 0x8}, 0x10) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:56 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080)=0x4, 0x4) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000100)={0x3, 0x1, '&jm', 0xff, 0x8}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000140)={0x13, 0x65, 0xffff, 0x10001, 0x6, '9P2000'}, 0x13) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x24c100, 0x0) ioctl$SNDCTL_TMR_SOURCE(r2, 0xc0045406) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:56 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) (async) connect$ax25(r1, &(0x7f00000004c0)={{0x3, @default, 0x3}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}, 0x48) (async, rerun: 32) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (rerun: 32) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f00000003c0)={0x2, 0x2, "741025", 0x8, 0x6}) sendmsg$RDMA_NLDEV_CMD_SET(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000021400032abd7000fbdbdf2508000100de0000000900020073797a3000000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040010) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x7) (async) ioctl$sock_bt_hci(r3, 0x400448cc, &(0x7f00000002c0)="af5c8281d127aa0324ae4e5318af4e46860fdfe26c68734e99c72a19a24d420382ffd03e432208253659fdc0e015ae5911b6598703d690b385f3b4eb08af7ea05e668e79b9b75250b961c86edb94c6325712490963762b3f33bc3f31a142aae0ec4e50ab52e7ac51cdbb5f6684c62575873e0dacc2db6e58748ab7060f8bce7eb30dad921b6e6bb4c01e8a28bba2564a88c6bf6a7358c4eb24aaf85ac53d8e8a083e0905c39bb7889882a3fc2423506b9427e9307da4eecad633858d2e4c6e") (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000280)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) (async) r5 = accept$unix(0xffffffffffffffff, &(0x7f0000000400)=@abs, &(0x7f0000000480)=0x6e) bind$unix(r5, &(0x7f0000000200)=@abs={0x0, 0x0, 0x4e21}, 0x6e) accept4$unix(r4, 0x0, &(0x7f0000000380), 0x80000) (async, rerun: 32) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x402001, 0x0) (rerun: 32) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r6, 0xc00c642e, &(0x7f0000000180)) 14:07:56 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x20600, 0x0) getresuid(&(0x7f0000000080)=0x0, &(0x7f00000000c0), &(0x7f0000000100)=0x0) write$P9_RWALK(r1, &(0x7f00000001c0)={0x4a, 0x6f, 0x2, {0x5, [{0x4, 0x4, 0x3}, {0x4, 0x0, 0x4}, {0x4, 0x400, 0x7}, {0x2, 0x4, 0x7}, {0x20, 0x4, 0x1}]}}, 0x4a) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f0000000180)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, r3}) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f0000000140)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, r2}) [ 2830.407070] ax25_connect(): syz-executor.3 uses autobind, please contact jreuter@yaina.de [ 2830.486784] ax25_connect(): syz-executor.3 uses autobind, please contact jreuter@yaina.de 14:07:57 executing program 1: ioctl$sock_bt_hci(0xffffffffffffffff, 0x800448d5, &(0x7f00000001c0)="8898cd1e67c37d0a93912e89a32fffc64e6c9adfea1699ab7b28d192ec22b60656db870029b4c6291e1c88eca48d670337bb9b75d7897423edb98bc4928270ed88f870cbf8bbc00f8d7a6c9706e663a22efb949dca93900049e9809fbaad0c6d82e0cd271205bc68b04fc9342a6c0381c55b946e53e7104c0e6eab51418550879ed5a77387674f2fa42bcad70622af77b583137a6dd751fd830b148450a939eec35fa213b7d75469035f04904df4c93b0a7fb8205612c5e4b8fc402c88b1427829daddf26138b24214f00bba246f59a5a5adf471dba7dc1dd4e1fd84a8f4e98f5b676443068ecdf82b0a15f943f33c6aa3883a5b9b4319304bcd0feb69e3e5ff5e73d39e9ca2fd90e50a3f20cb9c69c4b0a9f853e4c2f9f60c2204318a38dcf5cf413786333e97edae51453be463202e0ae04d65d5d0545027d96b5b030848eb439ae2b736d49681eaab85b79c4ed2816f333f4ae0289c9d242e0385fc443be577db6ede1f95fa65bb9041a2ffd83f50ff8f617ebc0cb90f38e42a9e6d5ad3f1b538d107253a78cb4934077c887562e1afccaac374e8746973bb4ed418c29d566078b515397634") r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0xffff, 0x4) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x4, &(0x7f0000000040)=[{0x1, 0x28, 0xff, 0x800}, {0x2, 0x5, 0x8, 0x39}, {0x100, 0x4, 0x9, 0xffff8001}, {0x81, 0x5, 0x1, 0x5}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000000c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000140)={r2, 0x2, r0, 0x6, 0x80000}) 14:07:57 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) 14:07:57 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080)=0x4, 0x4) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000100)={0x3, 0x1, '&jm', 0xff, 0x8}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000140)={0x13, 0x65, 0xffff, 0x10001, 0x6, '9P2000'}, 0x13) (async) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x24c100, 0x0) ioctl$SNDCTL_TMR_SOURCE(r2, 0xc0045406) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:57 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) ioctl$sock_bt_hci(r2, 0x800448d7, &(0x7f0000000100)="c85c1e16be54693a8eac96024326a421b8ea8448fb0f840c15996e0f29a4704a7d87a643c75ea34052603c0143a0b13f9232b6e3a1ea7029056b0a80f6ea84581f3313a108174e934307113da2") bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x800) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000080)={0x7fffffff, [0x1ff, 0x2], 0x8}, 0x10) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:57 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) (async) connect$ax25(r1, &(0x7f00000004c0)={{0x3, @default, 0x3}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}, 0x48) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f00000003c0)={0x2, 0x2, "741025", 0x8, 0x6}) sendmsg$RDMA_NLDEV_CMD_SET(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000021400032abd7000fbdbdf2508000100de0000000900020073797a3000000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040010) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x7) (async) ioctl$sock_bt_hci(r3, 0x400448cc, &(0x7f00000002c0)="af5c8281d127aa0324ae4e5318af4e46860fdfe26c68734e99c72a19a24d420382ffd03e432208253659fdc0e015ae5911b6598703d690b385f3b4eb08af7ea05e668e79b9b75250b961c86edb94c6325712490963762b3f33bc3f31a142aae0ec4e50ab52e7ac51cdbb5f6684c62575873e0dacc2db6e58748ab7060f8bce7eb30dad921b6e6bb4c01e8a28bba2564a88c6bf6a7358c4eb24aaf85ac53d8e8a083e0905c39bb7889882a3fc2423506b9427e9307da4eecad633858d2e4c6e") (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000280)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r5 = accept$unix(0xffffffffffffffff, &(0x7f0000000400)=@abs, &(0x7f0000000480)=0x6e) bind$unix(r5, &(0x7f0000000200)=@abs={0x0, 0x0, 0x4e21}, 0x6e) accept4$unix(r4, 0x0, &(0x7f0000000380), 0x80000) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x402001, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r6, 0xc00c642e, &(0x7f0000000180)) 14:07:57 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x20600, 0x0) (async, rerun: 64) getresuid(&(0x7f0000000080)=0x0, &(0x7f00000000c0), &(0x7f0000000100)=0x0) (rerun: 64) write$P9_RWALK(r1, &(0x7f00000001c0)={0x4a, 0x6f, 0x2, {0x5, [{0x4, 0x4, 0x3}, {0x4, 0x0, 0x4}, {0x4, 0x400, 0x7}, {0x2, 0x4, 0x7}, {0x20, 0x4, 0x1}]}}, 0x4a) (async) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f0000000180)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, r3}) (async) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f0000000140)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, r2}) 14:07:57 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) 14:07:57 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x20600, 0x0) (async) getresuid(&(0x7f0000000080)=0x0, &(0x7f00000000c0), &(0x7f0000000100)=0x0) write$P9_RWALK(r1, &(0x7f00000001c0)={0x4a, 0x6f, 0x2, {0x5, [{0x4, 0x4, 0x3}, {0x4, 0x0, 0x4}, {0x4, 0x400, 0x7}, {0x2, 0x4, 0x7}, {0x20, 0x4, 0x1}]}}, 0x4a) (async) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f0000000180)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, r3}) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f0000000140)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, r2}) 14:07:57 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$sock_bt_hci(r2, 0x800448d7, &(0x7f0000000100)="c85c1e16be54693a8eac96024326a421b8ea8448fb0f840c15996e0f29a4704a7d87a643c75ea34052603c0143a0b13f9232b6e3a1ea7029056b0a80f6ea84581f3313a108174e934307113da2") bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x800) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000080)={0x7fffffff, [0x1ff, 0x2], 0x8}, 0x10) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) ioctl$sock_bt_hci(r2, 0x800448d7, &(0x7f0000000100)="c85c1e16be54693a8eac96024326a421b8ea8448fb0f840c15996e0f29a4704a7d87a643c75ea34052603c0143a0b13f9232b6e3a1ea7029056b0a80f6ea84581f3313a108174e934307113da2") (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x800) (async) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000080)={0x7fffffff, [0x1ff, 0x2], 0x8}, 0x10) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:57 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, 0x0, 0x34) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x5a441) setsockopt$bt_hci_HCI_DATA_DIR(r4, 0x0, 0x1, &(0x7f0000000140)=0x4, 0x4) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs={0x0, 0x0, 0x4e24}, 0x6e) ioctl$sock_bt_hci(r3, 0x400448c9, &(0x7f0000000000)="1bf724300c38ef0284484e15bde6b7b5e406eeaa4f7fe2d3846c4e5628a8754f0956d93099af9da3f853ff513b0518") 14:07:57 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080)=0x4, 0x4) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000100)={0x3, 0x1, '&jm', 0xff, 0x8}) (async, rerun: 32) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000140)={0x13, 0x65, 0xffff, 0x10001, 0x6, '9P2000'}, 0x13) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x24c100, 0x0) ioctl$SNDCTL_TMR_SOURCE(r2, 0xc0045406) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) [ 2831.274703] ax25_connect(): syz-executor.3 uses autobind, please contact jreuter@yaina.de 14:07:57 executing program 1: ioctl$sock_bt_hci(0xffffffffffffffff, 0x800448d5, &(0x7f00000001c0)="8898cd1e67c37d0a93912e89a32fffc64e6c9adfea1699ab7b28d192ec22b60656db870029b4c6291e1c88eca48d670337bb9b75d7897423edb98bc4928270ed88f870cbf8bbc00f8d7a6c9706e663a22efb949dca93900049e9809fbaad0c6d82e0cd271205bc68b04fc9342a6c0381c55b946e53e7104c0e6eab51418550879ed5a77387674f2fa42bcad70622af77b583137a6dd751fd830b148450a939eec35fa213b7d75469035f04904df4c93b0a7fb8205612c5e4b8fc402c88b1427829daddf26138b24214f00bba246f59a5a5adf471dba7dc1dd4e1fd84a8f4e98f5b676443068ecdf82b0a15f943f33c6aa3883a5b9b4319304bcd0feb69e3e5ff5e73d39e9ca2fd90e50a3f20cb9c69c4b0a9f853e4c2f9f60c2204318a38dcf5cf413786333e97edae51453be463202e0ae04d65d5d0545027d96b5b030848eb439ae2b736d49681eaab85b79c4ed2816f333f4ae0289c9d242e0385fc443be577db6ede1f95fa65bb9041a2ffd83f50ff8f617ebc0cb90f38e42a9e6d5ad3f1b538d107253a78cb4934077c887562e1afccaac374e8746973bb4ed418c29d566078b515397634") (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0xffff, 0x4) (async) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x4, &(0x7f0000000040)=[{0x1, 0x28, 0xff, 0x800}, {0x2, 0x5, 0x8, 0x39}, {0x100, 0x4, 0x9, 0xffff8001}, {0x81, 0x5, 0x1, 0x5}]}) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000000c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000140)={r2, 0x2, r0, 0x6, 0x80000}) 14:07:57 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xfffc}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000080)={0xb0, [0xe6, 0xa], 0x8001}, 0x10) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:57 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$sock_bt_hci(r0, 0x400448de, &(0x7f0000000000)="e9c9002f86491b7394af7c8b4cc34fc15c0d7a4a921b8af7642a15f36349c28da2b524350fae9e20") ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000180)={"ad5a563069589cd0288d91016689ab83cd597f03ed2ba945cb794829089f", 0x5, 0x1, 0x1, 0x3f, 0x1f, 0x40, 0xcaa1, 0x6, [0xb42, 0xce, 0x9, 0x7ff, 0x4facaa59, 0x2, 0x2, 0x80000000, 0x7, 0x6, 0x0, 0x8f9, 0x1f, 0x9, 0x8, 0x1ff, 0x1, 0x29d3ba47, 0x50ba]}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="0113047aff3902f1010000002424f9e7ca3f3260da81d652c312e0b5324d0324949ed4b4a63e5f6ff5d131c8336d507e08a7dd5bdc1da403000000000000003d2139f61b4b9a07daec74830de306da315d8c90cac9b7cc691ebf9f85512bf06809825d0b9cbe94ae88c2120967625291585dd313851088cc8d5ac2bd6b7728515e056ee62973f3d52c0db1dd52b721af577196e6330fb4c20de8425310eed6e6651a07432732df4d57926e8bd937742ff7f248c4a5e0215f86115a67c6242d0257e7ea"], 0x7) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) gettid() 14:07:57 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) write$bt_hci(r1, &(0x7f0000000040)={0x1, @le_set_ext_scan_enable={{0x2042, 0x6}, {0x1f, 0x1f, 0x0, 0x77}}}, 0xa) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000140), 0x400000) r3 = geteuid() ioctl$SIOCAX25ADDUID(r2, 0x89e1, &(0x7f0000000180)={0x3, @bcast, r3}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x10001) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r5, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$HCIINQUIRY(r5, 0x800448f0, &(0x7f0000000100)={0x3, 0xb89, "e352c6", 0x80}) write$apparmor_current(r4, 0x0, 0x0) ioctl$GIO_FONT(r4, 0x4b60, &(0x7f0000000080)=""/40) 14:07:57 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) 14:07:57 executing program 1: ioctl$sock_bt_hci(0xffffffffffffffff, 0x800448d5, &(0x7f00000001c0)="8898cd1e67c37d0a93912e89a32fffc64e6c9adfea1699ab7b28d192ec22b60656db870029b4c6291e1c88eca48d670337bb9b75d7897423edb98bc4928270ed88f870cbf8bbc00f8d7a6c9706e663a22efb949dca93900049e9809fbaad0c6d82e0cd271205bc68b04fc9342a6c0381c55b946e53e7104c0e6eab51418550879ed5a77387674f2fa42bcad70622af77b583137a6dd751fd830b148450a939eec35fa213b7d75469035f04904df4c93b0a7fb8205612c5e4b8fc402c88b1427829daddf26138b24214f00bba246f59a5a5adf471dba7dc1dd4e1fd84a8f4e98f5b676443068ecdf82b0a15f943f33c6aa3883a5b9b4319304bcd0feb69e3e5ff5e73d39e9ca2fd90e50a3f20cb9c69c4b0a9f853e4c2f9f60c2204318a38dcf5cf413786333e97edae51453be463202e0ae04d65d5d0545027d96b5b030848eb439ae2b736d49681eaab85b79c4ed2816f333f4ae0289c9d242e0385fc443be577db6ede1f95fa65bb9041a2ffd83f50ff8f617ebc0cb90f38e42a9e6d5ad3f1b538d107253a78cb4934077c887562e1afccaac374e8746973bb4ed418c29d566078b515397634") (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0xffff, 0x4) (async) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x4, &(0x7f0000000040)=[{0x1, 0x28, 0xff, 0x800}, {0x2, 0x5, 0x8, 0x39}, {0x100, 0x4, 0x9, 0xffff8001}, {0x81, 0x5, 0x1, 0x5}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000000c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r1, 0x40182103, &(0x7f0000000140)={r2, 0x2, r0, 0x6, 0x80000}) 14:07:57 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xfffc}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000080)={0xb0, [0xe6, 0xa], 0x8001}, 0x10) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xfffc}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000080)={0xb0, [0xe6, 0xa], 0x8001}, 0x10) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:57 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) write$bt_hci(r1, &(0x7f0000000040)={0x1, @le_set_ext_scan_enable={{0x2042, 0x6}, {0x1f, 0x1f, 0x0, 0x77}}}, 0xa) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000140), 0x400000) r3 = geteuid() ioctl$SIOCAX25ADDUID(r2, 0x89e1, &(0x7f0000000180)={0x3, @bcast, r3}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x10001) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r5, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$HCIINQUIRY(r5, 0x800448f0, &(0x7f0000000100)={0x3, 0xb89, "e352c6", 0x80}) write$apparmor_current(r4, 0x0, 0x0) ioctl$GIO_FONT(r4, 0x4b60, &(0x7f0000000080)=""/40) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) write$bt_hci(r1, &(0x7f0000000040)={0x1, @le_set_ext_scan_enable={{0x2042, 0x6}, {0x1f, 0x1f, 0x0, 0x77}}}, 0xa) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000140), 0x400000) (async) geteuid() (async) ioctl$SIOCAX25ADDUID(r2, 0x89e1, &(0x7f0000000180)={0x3, @bcast, r3}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x10001) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r5, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) ioctl$HCIINQUIRY(r5, 0x800448f0, &(0x7f0000000100)={0x3, 0xb89, "e352c6", 0x80}) (async) write$apparmor_current(r4, 0x0, 0x0) (async) ioctl$GIO_FONT(r4, 0x4b60, &(0x7f0000000080)=""/40) (async) 14:07:57 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$sock_bt_hci(r0, 0x400448de, &(0x7f0000000000)="e9c9002f86491b7394af7c8b4cc34fc15c0d7a4a921b8af7642a15f36349c28da2b524350fae9e20") (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000180)={"ad5a563069589cd0288d91016689ab83cd597f03ed2ba945cb794829089f", 0x5, 0x1, 0x1, 0x3f, 0x1f, 0x40, 0xcaa1, 0x6, [0xb42, 0xce, 0x9, 0x7ff, 0x4facaa59, 0x2, 0x2, 0x80000000, 0x7, 0x6, 0x0, 0x8f9, 0x1f, 0x9, 0x8, 0x1ff, 0x1, 0x29d3ba47, 0x50ba]}) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="0113047aff3902f1010000002424f9e7ca3f3260da81d652c312e0b5324d0324949ed4b4a63e5f6ff5d131c8336d507e08a7dd5bdc1da403000000000000003d2139f61b4b9a07daec74830de306da315d8c90cac9b7cc691ebf9f85512bf06809825d0b9cbe94ae88c2120967625291585dd313851088cc8d5ac2bd6b7728515e056ee62973f3d52c0db1dd52b721af577196e6330fb4c20de8425310eed6e6651a07432732df4d57926e8bd937742ff7f248c4a5e0215f86115a67c6242d0257e7ea"], 0x7) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) gettid() 14:07:57 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) 14:07:58 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, 0x0, 0x34) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x5a441) setsockopt$bt_hci_HCI_DATA_DIR(r4, 0x0, 0x1, &(0x7f0000000140)=0x4, 0x4) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs={0x0, 0x0, 0x4e24}, 0x6e) ioctl$sock_bt_hci(r3, 0x400448c9, &(0x7f0000000000)="1bf724300c38ef0284484e15bde6b7b5e406eeaa4f7fe2d3846c4e5628a8754f0956d93099af9da3f853ff513b0518") syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, 0x0, 0x34) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x5a441) (async) setsockopt$bt_hci_HCI_DATA_DIR(r4, 0x0, 0x1, &(0x7f0000000140)=0x4, 0x4) (async) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs={0x0, 0x0, 0x4e24}, 0x6e) (async) ioctl$sock_bt_hci(r3, 0x400448c9, &(0x7f0000000000)="1bf724300c38ef0284484e15bde6b7b5e406eeaa4f7fe2d3846c4e5628a8754f0956d93099af9da3f853ff513b0518") (async) 14:07:58 executing program 1: ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000000)={0x42, 0xc7fd, 0x9, 0x9, 0x61a84e6c}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCALLUSERDATA(r1, 0x89e5, &(0x7f0000000040)={0x3, "701c45460a899e461955ffd6c16feea00a7dedf63f0b721a57821bafa467062fb8fce3cb56d6d6feb1553734fa932172236fd2db4461c30d232b4ed1ce39a82c5bc0a8311a5799cd87afdff60d0a58e30c22f90e2e5f0ae6c1e27386892e8ac0ca038092e70987d4161280564526861cf8db428e240c992cfef7c619035fc452"}) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:58 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xfffc}, 0x6) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000080)={0xb0, [0xe6, 0xa], 0x8001}, 0x10) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:58 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448de, &(0x7f0000000000)="e9c9002f86491b7394af7c8b4cc34fc15c0d7a4a921b8af7642a15f36349c28da2b524350fae9e20") (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$SNDCTL_SYNTH_ID(0xffffffffffffffff, 0xc08c5114, &(0x7f0000000180)={"ad5a563069589cd0288d91016689ab83cd597f03ed2ba945cb794829089f", 0x5, 0x1, 0x1, 0x3f, 0x1f, 0x40, 0xcaa1, 0x6, [0xb42, 0xce, 0x9, 0x7ff, 0x4facaa59, 0x2, 0x2, 0x80000000, 0x7, 0x6, 0x0, 0x8f9, 0x1f, 0x9, 0x8, 0x1ff, 0x1, 0x29d3ba47, 0x50ba]}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="0113047aff3902f1010000002424f9e7ca3f3260da81d652c312e0b5324d0324949ed4b4a63e5f6ff5d131c8336d507e08a7dd5bdc1da403000000000000003d2139f61b4b9a07daec74830de306da315d8c90cac9b7cc691ebf9f85512bf06809825d0b9cbe94ae88c2120967625291585dd313851088cc8d5ac2bd6b7728515e056ee62973f3d52c0db1dd52b721af577196e6330fb4c20de8425310eed6e6651a07432732df4d57926e8bd937742ff7f248c4a5e0215f86115a67c6242d0257e7ea"], 0x7) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) gettid() 14:07:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) 14:07:58 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) write$bt_hci(r1, &(0x7f0000000040)={0x1, @le_set_ext_scan_enable={{0x2042, 0x6}, {0x1f, 0x1f, 0x0, 0x77}}}, 0xa) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000140), 0x400000) r3 = geteuid() ioctl$SIOCAX25ADDUID(r2, 0x89e1, &(0x7f0000000180)={0x3, @bcast, r3}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x10001) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r5, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$HCIINQUIRY(r5, 0x800448f0, &(0x7f0000000100)={0x3, 0xb89, "e352c6", 0x80}) write$apparmor_current(r4, 0x0, 0x0) ioctl$GIO_FONT(r4, 0x4b60, &(0x7f0000000080)=""/40) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) write$bt_hci(r1, &(0x7f0000000040)={0x1, @le_set_ext_scan_enable={{0x2042, 0x6}, {0x1f, 0x1f, 0x0, 0x77}}}, 0xa) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000140), 0x400000) (async) geteuid() (async) ioctl$SIOCAX25ADDUID(r2, 0x89e1, &(0x7f0000000180)={0x3, @bcast, r3}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) openat$mice(0xffffffffffffff9c, &(0x7f00000000c0), 0x10001) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r5, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) ioctl$HCIINQUIRY(r5, 0x800448f0, &(0x7f0000000100)={0x3, 0xb89, "e352c6", 0x80}) (async) write$apparmor_current(r4, 0x0, 0x0) (async) ioctl$GIO_FONT(r4, 0x4b60, &(0x7f0000000080)=""/40) (async) [ 2832.204270] Bluetooth: hci2 command 0x0401 tx timeout 14:07:58 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x18, 0x1411, 0x8, 0x70bd25, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0xc0}, 0x4081) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r3 = accept4$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, &(0x7f0000000000)=0x6e, 0x80000) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r5, &(0x7f0000000340)=@file={0x1, './file0\x00'}, 0x6e) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000200), 0x40800, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r6, 0x40045108, &(0x7f0000000240)=0xffffffff) recvmsg$unix(r3, &(0x7f0000000300)={&(0x7f0000000180)=@abs, 0x6e, &(0x7f0000000280), 0x0, &(0x7f00000002c0)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r4, 0x0, 0x2, &(0x7f0000000080)={0x9, [0x6, 0x207], 0xcbd9}, 0x10) 14:07:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_ax25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000100)={@null, @bcast, 0x0, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000000)={0x1, [0x6d, 0x5], 0x8}, 0x10) 14:07:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) 14:07:58 executing program 1: ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000000)={0x42, 0xc7fd, 0x9, 0x9, 0x61a84e6c}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCALLUSERDATA(r1, 0x89e5, &(0x7f0000000040)={0x3, "701c45460a899e461955ffd6c16feea00a7dedf63f0b721a57821bafa467062fb8fce3cb56d6d6feb1553734fa932172236fd2db4461c30d232b4ed1ce39a82c5bc0a8311a5799cd87afdff60d0a58e30c22f90e2e5f0ae6c1e27386892e8ac0ca038092e70987d4161280564526861cf8db428e240c992cfef7c619035fc452"}) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:58 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x18, 0x1411, 0x8, 0x70bd25, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0xc0}, 0x4081) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) r3 = accept4$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, &(0x7f0000000000)=0x6e, 0x80000) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r5, &(0x7f0000000340)=@file={0x1, './file0\x00'}, 0x6e) (async) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000200), 0x40800, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r6, 0x40045108, &(0x7f0000000240)=0xffffffff) (async) recvmsg$unix(r3, &(0x7f0000000300)={&(0x7f0000000180)=@abs, 0x6e, &(0x7f0000000280), 0x0, &(0x7f00000002c0)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r4, 0x0, 0x2, &(0x7f0000000080)={0x9, [0x6, 0x207], 0xcbd9}, 0x10) 14:07:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_ax25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000100)={@null, @bcast, 0x0, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000000)={0x1, [0x6d, 0x5], 0x8}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_ax25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000100)={@null, @bcast, 0x0, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000000)={0x1, [0x6d, 0x5], 0x8}, 0x10) (async) 14:07:58 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async, rerun: 64) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, 0x0, 0x34) (rerun: 64) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x5a441) setsockopt$bt_hci_HCI_DATA_DIR(r4, 0x0, 0x1, &(0x7f0000000140)=0x4, 0x4) (async, rerun: 32) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs={0x0, 0x0, 0x4e24}, 0x6e) (async, rerun: 32) ioctl$sock_bt_hci(r3, 0x400448c9, &(0x7f0000000000)="1bf724300c38ef0284484e15bde6b7b5e406eeaa4f7fe2d3846c4e5628a8754f0956d93099af9da3f853ff513b0518") 14:07:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x4}, 0x6) 14:07:58 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x18, 0x1411, 0x8, 0x70bd25, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0xc0}, 0x4081) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) r3 = accept4$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, &(0x7f0000000000)=0x6e, 0x80000) (async) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r5, &(0x7f0000000340)=@file={0x1, './file0\x00'}, 0x6e) (async) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000200), 0x40800, 0x0) ioctl$SNDCTL_SEQ_TESTMIDI(r6, 0x40045108, &(0x7f0000000240)=0xffffffff) (async) recvmsg$unix(r3, &(0x7f0000000300)={&(0x7f0000000180)=@abs, 0x6e, &(0x7f0000000280), 0x0, &(0x7f00000002c0)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r4, 0x0, 0x2, &(0x7f0000000080)={0x9, [0x6, 0x207], 0xcbd9}, 0x10) 14:07:58 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x0, 0x2}, 0x6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000080)={r1, 0x80000, 0xffffffffffffffff}) r3 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r3, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r3, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r4, r5, r6, r7, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) r8 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r8, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r8, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r9, r10, r11, r12, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(0xffffffffffffffff, 0xc02064c3, &(0x7f0000000480)={&(0x7f0000000440)=[r9], 0x2, 0x1, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000200)={&(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, r9], 0x8}) 14:07:58 executing program 1: ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000000)={0x42, 0xc7fd, 0x9, 0x9, 0x61a84e6c}) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCALLUSERDATA(r1, 0x89e5, &(0x7f0000000040)={0x3, "701c45460a899e461955ffd6c16feea00a7dedf63f0b721a57821bafa467062fb8fce3cb56d6d6feb1553734fa932172236fd2db4461c30d232b4ed1ce39a82c5bc0a8311a5799cd87afdff60d0a58e30c22f90e2e5f0ae6c1e27386892e8ac0ca038092e70987d4161280564526861cf8db428e240c992cfef7c619035fc452"}) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_ax25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000100)={@null, @bcast, 0x0, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000000)={0x1, [0x6d, 0x5], 0x8}, 0x10) 14:07:58 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) write$apparmor_current(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_CLOSE(0xffffffffffffffff, 0x40086409, &(0x7f0000000000)) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:58 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x10000) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f0000000040)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f0000000100)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f0000000180)={r3}) ioctl$DRM_IOCTL_GEM_CLOSE(r1, 0x40086409, &(0x7f0000000080)={r2}) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x1, &(0x7f0000000340)=ANY=[@ANYBLOB="d6ab3ab06ec8502e143b55a1c979815953267e03e96d55ba2e3736867d406c9517be78d92d7f4d8c1ca26caff3c07b2215a828659b93d5c7bc520bb708f42e5bd36aa32f1f107e2243e94186bce152f984644ef8321a369d52367d8ff9b5903d7ae1e0cf32dc60c21ea9cd235db8aba1a5cca14cae388aad66cca6801e96"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, &(0x7f0000000180), 0x41000, 0x28, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x6, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000240)=[0x1, 0x1, 0x1, 0xffffffffffffffff]}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f00000000c0)='cachefiles_mkdir\x00', r4}, 0x10) 14:07:58 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @bcast}, [@remote, @null, @bcast, @bcast, @netrom, @rose, @bcast, @default]}, &(0x7f0000000000)=0x48) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000100)={@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x0, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null]}) 14:07:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x4}, 0x6) 14:07:58 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x0, 0x2}, 0x6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000080)={r1, 0x80000, 0xffffffffffffffff}) r3 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r3, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r3, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r4, r5, r6, r7, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) r8 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r8, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r8, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r9, r10, r11, r12, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(0xffffffffffffffff, 0xc02064c3, &(0x7f0000000480)={&(0x7f0000000440)=[r9], 0x2, 0x1, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000200)={&(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, r9], 0x8}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x0, 0x2}, 0x6) (async) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000040)) (async) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000080)={r1, 0x80000}) (async) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(r3, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r3, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r4, r5, r6, r7, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) (async) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(r8, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r8, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r9, r10, r11, r12, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(0xffffffffffffffff, 0xc02064c3, &(0x7f0000000480)={&(0x7f0000000440)=[r9], 0x2, 0x1, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000200)={&(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, r9], 0x8}) (async) 14:07:58 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x10000) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f0000000040)={0x0, 0x0}) (async) ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f0000000100)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f0000000180)={r3}) (async, rerun: 32) ioctl$DRM_IOCTL_GEM_CLOSE(r1, 0x40086409, &(0x7f0000000080)={r2}) (async, rerun: 32) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x1, &(0x7f0000000340)=ANY=[@ANYBLOB="d6ab3ab06ec8502e143b55a1c979815953267e03e96d55ba2e3736867d406c9517be78d92d7f4d8c1ca26caff3c07b2215a828659b93d5c7bc520bb708f42e5bd36aa32f1f107e2243e94186bce152f984644ef8321a369d52367d8ff9b5903d7ae1e0cf32dc60c21ea9cd235db8aba1a5cca14cae388aad66cca6801e96"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, &(0x7f0000000180), 0x41000, 0x28, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x6, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000240)=[0x1, 0x1, 0x1, 0xffffffffffffffff]}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f00000000c0)='cachefiles_mkdir\x00', r4}, 0x10) 14:07:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x0, 0x4}, 0x6) 14:07:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$KDFONTOP_GET(0xffffffffffffffff, 0x4b72, &(0x7f0000000000)={0x1, 0x0, 0x7, 0x16, 0x1f0, &(0x7f0000000100)}) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:58 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @bcast}, [@remote, @null, @bcast, @bcast, @netrom, @rose, @bcast, @default]}, &(0x7f0000000000)=0x48) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000100)={@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x0, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null]}) 14:07:58 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) write$apparmor_current(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$DRM_IOCTL_GEM_CLOSE(0xffffffffffffffff, 0x40086409, &(0x7f0000000000)) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:58 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x0, 0x2}, 0x6) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000080)={r1, 0x80000, 0xffffffffffffffff}) r3 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r3, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r3, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r4, r5, r6, r7, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) r8 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r8, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r8, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r9, r10, r11, r12, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(0xffffffffffffffff, 0xc02064c3, &(0x7f0000000480)={&(0x7f0000000440)=[r9], 0x2, 0x1, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000200)={&(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, r9], 0x8}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0x0, 0x2}, 0x6) (async) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000040)) (async) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000080)={r1, 0x80000}) (async) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(r3, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r3, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r4, r5, r6, r7, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) (async) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(r8, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r8, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r9, r10, r11, r12, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(0xffffffffffffffff, 0xc02064c3, &(0x7f0000000480)={&(0x7f0000000440)=[r9], 0x2, 0x1, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r2, 0xc01064c5, &(0x7f0000000200)={&(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, r9], 0x8}) (async) 14:07:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) 14:07:58 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @bcast}, [@remote, @null, @bcast, @bcast, @netrom, @rose, @bcast, @default]}, &(0x7f0000000000)=0x48) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000100)={@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x0, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null]}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @bcast}, [@remote, @null, @bcast, @bcast, @netrom, @rose, @bcast, @default]}, &(0x7f0000000000)=0x48) (async) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000100)={@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x0, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null]}) (async) 14:07:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) ioctl$KDFONTOP_GET(0xffffffffffffffff, 0x4b72, &(0x7f0000000000)={0x1, 0x0, 0x7, 0x16, 0x1f0, &(0x7f0000000100)}) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:58 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) write$apparmor_current(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_CLOSE(0xffffffffffffffff, 0x40086409, &(0x7f0000000000)) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) write$apparmor_current(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$DRM_IOCTL_GEM_CLOSE(0xffffffffffffffff, 0x40086409, &(0x7f0000000000)) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) 14:07:58 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x10000) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f0000000040)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f0000000100)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f0000000180)={r3}) (async) ioctl$DRM_IOCTL_GEM_CLOSE(r1, 0x40086409, &(0x7f0000000080)={r2}) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x1, &(0x7f0000000340)=ANY=[@ANYBLOB="d6ab3ab06ec8502e143b55a1c979815953267e03e96d55ba2e3736867d406c9517be78d92d7f4d8c1ca26caff3c07b2215a828659b93d5c7bc520bb708f42e5bd36aa32f1f107e2243e94186bce152f984644ef8321a369d52367d8ff9b5903d7ae1e0cf32dc60c21ea9cd235db8aba1a5cca14cae388aad66cca6801e96"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, &(0x7f0000000180), 0x41000, 0x28, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x6, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000240)=[0x1, 0x1, 0x1, 0xffffffffffffffff]}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f00000000c0)='cachefiles_mkdir\x00', r4}, 0x10) 14:07:58 executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) connect$unix(0xffffffffffffffff, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="011304090048ff"], 0x7) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f00000000c0)={0xffffffff, [0x23f1b085, 0x3], 0x2}, 0x10) 14:07:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff}, 0x6) 14:07:58 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = accept$unix(0xffffffffffffffff, &(0x7f0000000140), &(0x7f00000001c0)=0x6e) recvmmsg$unix(r1, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000200)=""/119, 0x77}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="38000000b2ffffff7f0000000072815d", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000001000000", @ANYRES32, @ANYRES32=0xffffffffffffffff, @ANYRES32, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="18000000000000000100000001000000", @ANYRES32, @ANYRES32], 0xc8}}], 0x1, 0x2000, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x2}, 0x6) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x6}) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) accept$unix(r2, &(0x7f0000000400)=@abs, &(0x7f0000000480)=0x6e) ioctl$DRM_IOCTL_SYNCOBJ_RESET(0xffffffffffffffff, 0xc01064c4, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0, r4], 0x2}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async, rerun: 64) ioctl$KDFONTOP_GET(0xffffffffffffffff, 0x4b72, &(0x7f0000000000)={0x1, 0x0, 0x7, 0x16, 0x1f0, &(0x7f0000000100)}) (rerun: 64) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:58 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x7}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f0000000000)=0x80000001, 0x4) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x8000, 0x0) ioctl$MEDIA_REQUEST_IOC_QUEUE(r4, 0x7c80, 0x0) 14:07:58 executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) connect$unix(0xffffffffffffffff, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="011304090048ff"], 0x7) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f00000000c0)={0xffffffff, [0x23f1b085, 0x3], 0x2}, 0x10) 14:07:58 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = accept$unix(0xffffffffffffffff, &(0x7f0000000140), &(0x7f00000001c0)=0x6e) recvmmsg$unix(r1, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000200)=""/119, 0x77}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="38000000b2ffffff7f0000000072815d", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000001000000", @ANYRES32, @ANYRES32=0xffffffffffffffff, @ANYRES32, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="18000000000000000100000001000000", @ANYRES32, @ANYRES32], 0xc8}}], 0x1, 0x2000, 0x0) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x2}, 0x6) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x6}) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) accept$unix(r2, &(0x7f0000000400)=@abs, &(0x7f0000000480)=0x6e) (async) ioctl$DRM_IOCTL_SYNCOBJ_RESET(0xffffffffffffffff, 0xc01064c4, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0, r4], 0x2}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = accept$unix(0xffffffffffffffff, &(0x7f0000000140), &(0x7f00000001c0)=0x6e) recvmmsg$unix(r1, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000200)=""/119, 0x77}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="38000000b2ffffff7f0000000072815d", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000001000000", @ANYRES32, @ANYRES32=0xffffffffffffffff, @ANYRES32, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="18000000000000000100000001000000", @ANYRES32, @ANYRES32], 0xc8}}], 0x1, 0x2000, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x2}, 0x6) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x6}) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) accept$unix(r2, &(0x7f0000000400)=@abs, &(0x7f0000000480)=0x6e) ioctl$DRM_IOCTL_SYNCOBJ_RESET(0xffffffffffffffff, 0xc01064c4, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0, r4], 0x2}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:58 executing program 1: r0 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r0, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r0, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000140), &(0x7f00000000c0)=[0x100, 0x7f, 0x4], 0x0, 0x1}) socket$unix(0x1, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x21) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) r4 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r4, 0x0, 0x0) ioctl$SIOCAX25NOUID(r4, 0x89e3, &(0x7f0000000080)=0x1) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000100)=[r3, r1, 0x0, r2, 0x0], &(0x7f0000000140)=[0xffffffffffffffff], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(0xffffffffffffffff, 0xc01064c5, &(0x7f0000000040)={&(0x7f0000000000)=[r2, 0x0, r3, 0x0, 0x0, 0x0], 0x6}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r5, 0x400448e0, &(0x7f0000000000)) 14:07:58 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) (async) bind$ax25(r1, &(0x7f0000000100)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x7}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f0000000000)=0x80000001, 0x4) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x8000, 0x0) ioctl$MEDIA_REQUEST_IOC_QUEUE(r4, 0x7c80, 0x0) 14:07:58 executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) connect$unix(0xffffffffffffffff, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="011304090048ff"], 0x7) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f00000000c0)={0xffffffff, [0x23f1b085, 0x3], 0x2}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) connect$unix(0xffffffffffffffff, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="011304090048ff"], 0x7) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f00000000c0)={0xffffffff, [0x23f1b085, 0x3], 0x2}, 0x10) (async) 14:07:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000380)={'gre0\x00', &(0x7f00000002c0)={'gre0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2f, 0x0, @multicast1, @empty, {[@ra={0x94, 0x4}]}}}}}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r3, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000080)={0x0, 0x1, r0, 0x0, 0x80000}) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x0, 0xe27, "5c04cd", 0xff}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_TMR_METRONOME(r4, 0x40045407) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:58 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = accept$unix(0xffffffffffffffff, &(0x7f0000000140), &(0x7f00000001c0)=0x6e) recvmmsg$unix(r1, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000200)=""/119, 0x77}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="20000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="38000000b2ffffff7f0000000072815d", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="1c000000000000000100000001000000", @ANYRES32, @ANYRES32=0xffffffffffffffff, @ANYRES32, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYBLOB="18000000000000000100000001000000", @ANYRES32, @ANYRES32], 0xc8}}], 0x1, 0x2000, 0x0) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x2}, 0x6) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x6}) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) accept$unix(r2, &(0x7f0000000400)=@abs, &(0x7f0000000480)=0x6e) (async) ioctl$DRM_IOCTL_SYNCOBJ_RESET(0xffffffffffffffff, 0xc01064c4, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0, r4], 0x2}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x10000) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f0000000040)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f0000000100)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f0000000180)={r3}) ioctl$DRM_IOCTL_GEM_CLOSE(r1, 0x40086409, &(0x7f0000000080)={r2}) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x1, &(0x7f0000000340)=ANY=[@ANYBLOB="d6ab3ab06ec8502e143b55a1c979815953267e03e96d55ba2e3736867d406c9517be78d92d7f4d8c1ca26caff3c07b2215a828659b93d5c7bc520bb708f42e5bd36aa32f1f107e2243e94186bce152f984644ef8321a369d52367d8ff9b5903d7ae1e0cf32dc60c21ea9cd235db8aba1a5cca14cae388aad66cca6801e96"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, &(0x7f0000000180), 0x41000, 0x28, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x4, 0x4}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x6, 0x3, 0x3}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000240)=[0x1, 0x1, 0x1, 0xffffffffffffffff]}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f00000000c0)='cachefiles_mkdir\x00', r4}, 0x10) 14:07:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000380)={'gre0\x00', &(0x7f00000002c0)={'gre0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2f, 0x0, @multicast1, @empty, {[@ra={0x94, 0x4}]}}}}}) (async) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r3, 0x0, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000080)={0x0, 0x1, r0, 0x0, 0x80000}) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x0, 0xe27, "5c04cd", 0xff}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_TMR_METRONOME(r4, 0x40045407) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:58 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:58 executing program 1: r0 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r0, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r0, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000140), &(0x7f00000000c0)=[0x100, 0x7f, 0x4], 0x0, 0x1}) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(0xffffffffffffffff, 0x0, 0x21) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) (async) r4 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r4, 0x0, 0x0) (async) ioctl$SIOCAX25NOUID(r4, 0x89e3, &(0x7f0000000080)=0x1) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000100)=[r3, r1, 0x0, r2, 0x0], &(0x7f0000000140)=[0xffffffffffffffff], 0x5, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(0xffffffffffffffff, 0xc01064c5, &(0x7f0000000040)={&(0x7f0000000000)=[r2, 0x0, r3, 0x0, 0x0, 0x0], 0x6}) (async) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r5, 0x400448e0, &(0x7f0000000000)) 14:07:58 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x7}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f0000000000)=0x80000001, 0x4) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x8000, 0x0) ioctl$MEDIA_REQUEST_IOC_QUEUE(r4, 0x7c80, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) getpeername$ax25(r1, 0x0, 0x0) (async) bind$ax25(r1, &(0x7f0000000100)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x7}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r3, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_DATA_DIR(r3, 0x0, 0x1, &(0x7f0000000000)=0x80000001, 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x8000, 0x0) (async) ioctl$MEDIA_REQUEST_IOC_QUEUE(r4, 0x7c80, 0x0) (async) 14:07:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) 14:07:58 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="01bbc92206381daa5d000000"], 0xc) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, 0x1402, 0x300, 0x70bd2d, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) write$P9_RSETATTR(r1, &(0x7f0000000280)={0x7, 0x1b, 0x2}, 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0xcd) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCALLUSERDATA(r3, 0x89e5, &(0x7f00000002c0)={0x63, "ef8c6a87e9eaebb05f50380c27c7625c9b3197c399ae2721f653a3b9fb0a8ac085d9be25ce2988c048938a00f2ba3aeb90d9b726d98853f3b4282c78e1fe73cd13a07fa24debf5d6f8535b4be6d113067214d830175b570571ef16c80b46695f71efd09d1662ef4272430a33211409d15d4c95db852ff955f5c5131cbda0b967"}) accept$ax25(r2, &(0x7f00000000c0)={{0x3, @default}, [@default, @rose, @netrom, @bcast, @default, @netrom, @null, @default]}, &(0x7f0000000140)=0x48) write$bt_hci(r0, &(0x7f0000000080)={0x1, @io_capability_reply={{0x42b, 0x9}, {@none, 0x80, 0xfb, 0x2}}}, 0xd) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000380)={'gre0\x00', &(0x7f00000002c0)={'gre0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2f, 0x0, @multicast1, @empty, {[@ra={0x94, 0x4}]}}}}}) (async) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r3, 0x0, 0x0) (async, rerun: 64) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r3, 0x40182103, &(0x7f0000000080)={0x0, 0x1, r0, 0x0, 0x80000}) (rerun: 64) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x0, 0xe27, "5c04cd", 0xff}) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$SNDCTL_TMR_METRONOME(r4, 0x40045407) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:58 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:58 executing program 1: r0 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r0, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r0, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000140), &(0x7f00000000c0)=[0x100, 0x7f, 0x4], 0x0, 0x1}) socket$unix(0x1, 0x5, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x21) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) (async) r4 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r4, 0x0, 0x0) (async) ioctl$SIOCAX25NOUID(r4, 0x89e3, &(0x7f0000000080)=0x1) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000100)=[r3, r1, 0x0, r2, 0x0], &(0x7f0000000140)=[0xffffffffffffffff], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(0xffffffffffffffff, 0xc01064c5, &(0x7f0000000040)={&(0x7f0000000000)=[r2, 0x0, r3, 0x0, 0x0, 0x0], 0x6}) (async) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r5, 0x400448e0, &(0x7f0000000000)) 14:07:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xfffc}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000080)={0xb0, [0xe6, 0xa], 0x8001}, 0x10) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:58 executing program 4: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x2200) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) 14:07:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0xa000, 0x0) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000080)={0xffffffffffffffff, 0x3, "10c233", 0xc1, 0xf9}) 14:07:58 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="01bbc92206381daa5d000000"], 0xc) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, 0x1402, 0x300, 0x70bd2d, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) write$P9_RSETATTR(r1, &(0x7f0000000280)={0x7, 0x1b, 0x2}, 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0xcd) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCALLUSERDATA(r3, 0x89e5, &(0x7f00000002c0)={0x63, "ef8c6a87e9eaebb05f50380c27c7625c9b3197c399ae2721f653a3b9fb0a8ac085d9be25ce2988c048938a00f2ba3aeb90d9b726d98853f3b4282c78e1fe73cd13a07fa24debf5d6f8535b4be6d113067214d830175b570571ef16c80b46695f71efd09d1662ef4272430a33211409d15d4c95db852ff955f5c5131cbda0b967"}) accept$ax25(r2, &(0x7f00000000c0)={{0x3, @default}, [@default, @rose, @netrom, @bcast, @default, @netrom, @null, @default]}, &(0x7f0000000140)=0x48) write$bt_hci(r0, &(0x7f0000000080)={0x1, @io_capability_reply={{0x42b, 0x9}, {@none, 0x80, 0xfb, 0x2}}}, 0xd) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="01bbc92206381daa5d000000"], 0xc) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, 0x1402, 0x300, 0x70bd2d, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r1, 0x0, 0x0) (async) write$P9_RSETATTR(r1, &(0x7f0000000280)={0x7, 0x1b, 0x2}, 0x7) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$ax25(0x3, 0x5, 0xcd) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f0000000000)) (async) ioctl$SIOCX25SCALLUSERDATA(r3, 0x89e5, &(0x7f00000002c0)={0x63, "ef8c6a87e9eaebb05f50380c27c7625c9b3197c399ae2721f653a3b9fb0a8ac085d9be25ce2988c048938a00f2ba3aeb90d9b726d98853f3b4282c78e1fe73cd13a07fa24debf5d6f8535b4be6d113067214d830175b570571ef16c80b46695f71efd09d1662ef4272430a33211409d15d4c95db852ff955f5c5131cbda0b967"}) (async) accept$ax25(r2, &(0x7f00000000c0)={{0x3, @default}, [@default, @rose, @netrom, @bcast, @default, @netrom, @null, @default]}, &(0x7f0000000140)=0x48) (async) write$bt_hci(r0, &(0x7f0000000080)={0x1, @io_capability_reply={{0x42b, 0x9}, {@none, 0x80, 0xfb, 0x2}}}, 0xd) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:07:58 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:58 executing program 4: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async, rerun: 64) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x2200) (rerun: 64) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) 14:07:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0xa000, 0x0) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000080)={0xffffffffffffffff, 0x3, "10c233", 0xc1, 0xf9}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0xa000, 0x0) (async) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000080)={0xffffffffffffffff, 0x3, "10c233", 0xc1, 0xf9}) (async) 14:07:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080)=0x4, 0x4) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000100)={0x3, 0x1, '&jm', 0xff, 0x8}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000140)={0x13, 0x65, 0xffff, 0x10001, 0x6, '9P2000'}, 0x13) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x24c100, 0x0) ioctl$SNDCTL_TMR_SOURCE(r2, 0xc0045406) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:58 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448ca, &(0x7f0000000080)="87fc9cdfca0f5b63cf668df26739d93660ec2feca06ba5b43df3708019c0a42214bf3b9339f7b2093a14a524596805b5f7b1bbfe6a9718eaab22e1a83d981a0906d9") 14:07:58 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000040)=@bpq0, 0x10) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080), 0x6) 14:07:58 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="01bbc92206381daa5d000000"], 0xc) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, 0x1402, 0x300, 0x70bd2d, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) write$P9_RSETATTR(r1, &(0x7f0000000280)={0x7, 0x1b, 0x2}, 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0xcd) (async) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r3, 0x89ea, &(0x7f0000000000)) (async, rerun: 64) ioctl$SIOCX25SCALLUSERDATA(r3, 0x89e5, &(0x7f00000002c0)={0x63, "ef8c6a87e9eaebb05f50380c27c7625c9b3197c399ae2721f653a3b9fb0a8ac085d9be25ce2988c048938a00f2ba3aeb90d9b726d98853f3b4282c78e1fe73cd13a07fa24debf5d6f8535b4be6d113067214d830175b570571ef16c80b46695f71efd09d1662ef4272430a33211409d15d4c95db852ff955f5c5131cbda0b967"}) (async, rerun: 64) accept$ax25(r2, &(0x7f00000000c0)={{0x3, @default}, [@default, @rose, @netrom, @bcast, @default, @netrom, @null, @default]}, &(0x7f0000000140)=0x48) (async) write$bt_hci(r0, &(0x7f0000000080)={0x1, @io_capability_reply={{0x42b, 0x9}, {@none, 0x80, 0xfb, 0x2}}}, 0xd) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:59 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080)=0x4, 0x4) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000100)={0x3, 0x1, '&jm', 0xff, 0x8}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000140)={0x13, 0x65, 0xffff, 0x10001, 0x6, '9P2000'}, 0x13) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x24c100, 0x0) ioctl$SNDCTL_TMR_SOURCE(r2, 0xc0045406) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0xa000, 0x0) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000080)={0xffffffffffffffff, 0x3, "10c233", 0xc1, 0xf9}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0xa000, 0x0) (async) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000080)={0xffffffffffffffff, 0x3, "10c233", 0xc1, 0xf9}) (async) 14:07:59 executing program 4: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x2200) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) 14:07:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448ca, &(0x7f0000000080)="87fc9cdfca0f5b63cf668df26739d93660ec2feca06ba5b43df3708019c0a42214bf3b9339f7b2093a14a524596805b5f7b1bbfe6a9718eaab22e1a83d981a0906d9") 14:07:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x22000, 0x0) bind$bt_hci(r0, &(0x7f0000000000), 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="0100000000"], 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0xff, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:59 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000040)=@bpq0, 0x10) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080), 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) getpeername$ax25(r1, 0x0, 0x0) (async) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000040)=@bpq0, 0x10) (async) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080), 0x6) (async) 14:07:59 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x9, 0x4) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0x4, 0x1}, 0x6) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r3, r4, r5, r6, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(0xffffffffffffffff, 0xc00864c0, &(0x7f0000000080)={r6}) 14:07:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x22000, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000000), 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="0100000000"], 0x7) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0xff, 0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:59 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xfffd, 0x1}, 0x6) 14:07:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$SNDCTL_MIDI_PRETIME(r2, 0xc0046d00, &(0x7f0000000000)=0xabd7) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) connect$unix(r2, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448ca, &(0x7f0000000080)="87fc9cdfca0f5b63cf668df26739d93660ec2feca06ba5b43df3708019c0a42214bf3b9339f7b2093a14a524596805b5f7b1bbfe6a9718eaab22e1a83d981a0906d9") 14:07:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (rerun: 64) write$apparmor_current(r2, 0x0, 0x0) (async) ioctl$SNDCTL_MIDI_PRETIME(r2, 0xc0046d00, &(0x7f0000000000)=0xabd7) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) connect$unix(r2, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448dc, &(0x7f0000000000)) 14:07:59 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) (async) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000040)=@bpq0, 0x10) (async) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080), 0x6) 14:07:59 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x9, 0x4) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) (async, rerun: 64) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0x4, 0x1}, 0x6) (async, rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r3, r4, r5, r6, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(0xffffffffffffffff, 0xc00864c0, &(0x7f0000000080)={r6}) 14:07:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x22000, 0x0) bind$bt_hci(r0, &(0x7f0000000000), 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="0100000000"], 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0xff, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x22000, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000000), 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="0100000000"], 0x7) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000040)=0xff, 0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:07:59 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xfffd, 0x1}, 0x6) 14:07:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) (async) ioctl$SNDCTL_MIDI_PRETIME(r2, 0xc0046d00, &(0x7f0000000000)=0xabd7) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) connect$unix(r2, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448dc, &(0x7f0000000000)) 14:07:59 executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x1404, 0x400, 0x70bd29, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:59 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x9, 0x4) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)={0x0}) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0x4, 0x1}, 0x6) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r3, r4, r5, r6, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(0xffffffffffffffff, 0xc00864c0, &(0x7f0000000080)={r6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x9, 0x4) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(r2, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000240)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000280)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000002c0)) (async) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0x4, 0x1}, 0x6) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000300)) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r2, 0xc01864cb, &(0x7f00000003c0)={&(0x7f0000000340)=[r3, r4, r5, r6, 0x0], &(0x7f0000000380)=[0x100, 0x80, 0x3], 0x5, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(0xffffffffffffffff, 0xc00864c0, &(0x7f0000000080)={r6}) (async) 14:07:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:59 executing program 5: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x6, &(0x7f0000000000)=[{0x20, 0x8, 0x8, 0x1f}, {0x2d6, 0x1, 0xfb}, {0x8, 0x4, 0x6}, {0xfff9, 0x2, 0xf7}, {0xca63, 0x5, 0x1, 0x4}, {0x1, 0x9, 0x2, 0x6}]}) 14:07:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448dc, &(0x7f0000000000)) 14:07:59 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0x3, [0x6, 0xf8000000], 0x5}, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="00bfcb8c3a9220c770000000000000c255e0301181befd3386de81275fa258907ca846af683ed18cf58f12b4c6d9952fc369ba1191a880e4800f174872ecc1c15ac4a384705dfc9b305f8a87b91d11afb64947818783fa39858a355623b514bc62f9525a96a633a921f77a1bd57af29c3c36248732ae10a00e6e87d6cbe8895394c8055e9c62070000006deaeb19a029e49e4557a72b10a9515bf467963c0b44ab1c8cc5a0dd22aba89fd7424eda13fcf66602201099375a03509dda64adf6382e7c940f82e91f22e45dce25309795e806a7b6849d57f690cfa08c0c06a9ac521a26b3dba05222eb147164973c558e4a52db0891dd8b75d835490a03d655695e0abaea3fdff24d25c30316f296bbfddf7d25486c776a64724cce8e2c7016033c5c8888e409680b72c1d5ec03bf97c15548c9de845b396cdde3d6b4f2d6e92f65adf78b66a3a54d64a372355f5e70028cd93f735d2cd302f474798401938a95"], 0x7) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0x2}, 0x6) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f0000000080), 0x10) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x1404, 0x400, 0x70bd29, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:59 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x4, &(0x7f0000000000)=[{0x20, 0x1, 0x7, 0x4}, {0x8, 0xa0, 0x6, 0xe6e}, {0x1f, 0x7, 0xff, 0x2}, {0x7ff, 0x0, 0x3f, 0x4}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r2, 0xc0182101, &(0x7f0000000180)={r3, 0x6, 0x1f}) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0x3, [0x6, 0xf8000000], 0x5}, 0x10) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="00bfcb8c3a9220c770000000000000c255e0301181befd3386de81275fa258907ca846af683ed18cf58f12b4c6d9952fc369ba1191a880e4800f174872ecc1c15ac4a384705dfc9b305f8a87b91d11afb64947818783fa39858a355623b514bc62f9525a96a633a921f77a1bd57af29c3c36248732ae10a00e6e87d6cbe8895394c8055e9c62070000006deaeb19a029e49e4557a72b10a9515bf467963c0b44ab1c8cc5a0dd22aba89fd7424eda13fcf66602201099375a03509dda64adf6382e7c940f82e91f22e45dce25309795e806a7b6849d57f690cfa08c0c06a9ac521a26b3dba05222eb147164973c558e4a52db0891dd8b75d835490a03d655695e0abaea3fdff24d25c30316f296bbfddf7d25486c776a64724cce8e2c7016033c5c8888e409680b72c1d5ec03bf97c15548c9de845b396cdde3d6b4f2d6e92f65adf78b66a3a54d64a372355f5e70028cd93f735d2cd302f474798401938a95"], 0x7) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0x2}, 0x6) (async) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f0000000080), 0x10) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x1404, 0x400, 0x70bd29, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async, rerun: 32) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (rerun: 32) 14:07:59 executing program 5: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000040)={0x0}) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000300)) ioctl$SIOCAX25GETINFO(r1, 0x89ed, &(0x7f0000000180)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x0, &(0x7f0000000100)}) socket$unix(0x1, 0x5, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x400500, 0x0) getpeername$ax25(r2, &(0x7f0000000200)={{0x3, @netrom}, [@rose, @null, @null, @null, @default, @default, @remote, @default]}, &(0x7f0000000280)=0x48) recvmsg$unix(r2, 0x0, 0x0) connect$ax25(r1, &(0x7f00000003c0)={{0x3, @bcast, 0x1}, [@bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48) r3 = socket$unix(0x1, 0x5, 0x0) accept4$unix(r3, 0x0, &(0x7f00000002c0), 0x0) recvmsg$unix(r3, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={r0, 0x3, r3, 0x100}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000340), 0xc000, 0x0) write$P9_RCLUNK(r5, &(0x7f0000000380)={0x7, 0x79, 0x1}, 0x7) ioctl$SNDCTL_SEQ_RESETSAMPLES(r5, 0x40045109, &(0x7f0000000440)=0x3bae) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0x1, 0x2}, 0x6) 14:07:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:07:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, &(0x7f0000000040)) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$sock_bt_hci(r2, 0x400448cb, &(0x7f0000000000)="cd70d5499541d99762dfc8e74e53964cd3d915fcb57a95132b8e9a213c70511b14d2519c667c229d91f223d19c2c2019518a98f80e56382aaf6bac66b94a150e7b89f99f64255c8071126f8e88179969a96f89d2bab01d99f096492d7e4c0a8933ded50fce54adbb2722fd11e49d54530713140847a237170f4a8d28cef49e46472fdbb260585da6884931929a574ea3104d135f306e8448b028719ad732d731e52c84f051d793f6c25fbf593667b1a93173673f3e923a14f46410680111ad6bb0ca3eba94dc7c6c7a3d5714a80b36c9e22ef66417b2f6a7846bb0896c3fc9fa6ebe77") 14:07:59 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x4, &(0x7f0000000000)=[{0x20, 0x1, 0x7, 0x4}, {0x8, 0xa0, 0x6, 0xe6e}, {0x1f, 0x7, 0xff, 0x2}, {0x7ff, 0x0, 0x3f, 0x4}]}) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r2, 0xc0182101, &(0x7f0000000180)={r3, 0x6, 0x1f}) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, &(0x7f0000000040)) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$sock_bt_hci(r2, 0x400448cb, &(0x7f0000000000)="cd70d5499541d99762dfc8e74e53964cd3d915fcb57a95132b8e9a213c70511b14d2519c667c229d91f223d19c2c2019518a98f80e56382aaf6bac66b94a150e7b89f99f64255c8071126f8e88179969a96f89d2bab01d99f096492d7e4c0a8933ded50fce54adbb2722fd11e49d54530713140847a237170f4a8d28cef49e46472fdbb260585da6884931929a574ea3104d135f306e8448b028719ad732d731e52c84f051d793f6c25fbf593667b1a93173673f3e923a14f46410680111ad6bb0ca3eba94dc7c6c7a3d5714a80b36c9e22ef66417b2f6a7846bb0896c3fc9fa6ebe77") 14:07:59 executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0xcf) connect$ax25(r1, &(0x7f0000000100)={{0x3, @bcast, 0x6}, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x100) ioctl$sock_bt_hci(r2, 0x0, &(0x7f0000000080)="4b1ee37a52a1acd51c05e26a7a88c48dd7298ef289ae32670cd73f97ccfff542adb41dc67a3067a0cb0850161b16e98daf9ea9764897abe3edfa24907bd143a9f3bf3f49bbdae4f930dfa664a327cacd1417ef8df454562f248ef4ab9168bf9d423f6873f8c7a65535041905cadb03cd96ad75500a") bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:07:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0xee3, 0x4) 14:07:59 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x4, &(0x7f0000000000)=[{0x20, 0x1, 0x7, 0x4}, {0x8, 0xa0, 0x6, 0xe6e}, {0x1f, 0x7, 0xff, 0x2}, {0x7ff, 0x0, 0x3f, 0x4}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r2, 0xc0182101, &(0x7f0000000180)={r3, 0x6, 0x1f}) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x4, &(0x7f0000000000)=[{0x20, 0x1, 0x7, 0x4}, {0x8, 0xa0, 0x6, 0xe6e}, {0x1f, 0x7, 0xff, 0x2}, {0x7ff, 0x0, 0x3f, 0x4}]}) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)) (async) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r2, 0xc0182101, &(0x7f0000000180)={r3, 0x6, 0x1f}) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:07:59 executing program 5: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000040)={0x0}) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000300)) ioctl$SIOCAX25GETINFO(r1, 0x89ed, &(0x7f0000000180)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x0, &(0x7f0000000100)}) socket$unix(0x1, 0x5, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000100), 0x400500, 0x0) getpeername$ax25(r2, &(0x7f0000000200)={{0x3, @netrom}, [@rose, @null, @null, @null, @default, @default, @remote, @default]}, &(0x7f0000000280)=0x48) recvmsg$unix(r2, 0x0, 0x0) connect$ax25(r1, &(0x7f00000003c0)={{0x3, @bcast, 0x1}, [@bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48) r3 = socket$unix(0x1, 0x5, 0x0) accept4$unix(r3, 0x0, &(0x7f00000002c0), 0x0) recvmsg$unix(r3, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0)={r0, 0x3, r3, 0x100}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000340), 0xc000, 0x0) write$P9_RCLUNK(r5, &(0x7f0000000380)={0x7, 0x79, 0x1}, 0x7) ioctl$SNDCTL_SEQ_RESETSAMPLES(r5, 0x40045109, &(0x7f0000000440)=0x3bae) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0x1, 0x2}, 0x6) [ 2833.685992] ax25_connect(): syz-executor.5 uses autobind, please contact jreuter@yaina.de 14:07:59 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000000)={0x3, [0x6, 0xf8000000], 0x5}, 0x10) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="00bfcb8c3a9220c770000000000000c255e0301181befd3386de81275fa258907ca846af683ed18cf58f12b4c6d9952fc369ba1191a880e4800f174872ecc1c15ac4a384705dfc9b305f8a87b91d11afb64947818783fa39858a355623b514bc62f9525a96a633a921f77a1bd57af29c3c36248732ae10a00e6e87d6cbe8895394c8055e9c62070000006deaeb19a029e49e4557a72b10a9515bf467963c0b44ab1c8cc5a0dd22aba89fd7424eda13fcf66602201099375a03509dda64adf6382e7c940f82e91f22e45dce25309795e806a7b6849d57f690cfa08c0c06a9ac521a26b3dba05222eb147164973c558e4a52db0891dd8b75d835490a03d655695e0abaea3fdff24d25c30316f296bbfddf7d25486c776a64724cce8e2c7016033c5c8888e409680b72c1d5ec03bf97c15548c9de845b396cdde3d6b4f2d6e92f65adf78b66a3a54d64a372355f5e70028cd93f735d2cd302f474798401938a95"], 0x7) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0x2}, 0x6) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f0000000080), 0x10) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r1, 0x40085112, &(0x7f0000000040)) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$sock_bt_hci(r2, 0x400448cb, &(0x7f0000000000)="cd70d5499541d99762dfc8e74e53964cd3d915fcb57a95132b8e9a213c70511b14d2519c667c229d91f223d19c2c2019518a98f80e56382aaf6bac66b94a150e7b89f99f64255c8071126f8e88179969a96f89d2bab01d99f096492d7e4c0a8933ded50fce54adbb2722fd11e49d54530713140847a237170f4a8d28cef49e46472fdbb260585da6884931929a574ea3104d135f306e8448b028719ad732d731e52c84f051d793f6c25fbf593667b1a93173673f3e923a14f46410680111ad6bb0ca3eba94dc7c6c7a3d5714a80b36c9e22ef66417b2f6a7846bb0896c3fc9fa6ebe77") 14:07:59 executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0xcf) connect$ax25(r1, &(0x7f0000000100)={{0x3, @bcast, 0x6}, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x100) ioctl$sock_bt_hci(r2, 0x0, &(0x7f0000000080)="4b1ee37a52a1acd51c05e26a7a88c48dd7298ef289ae32670cd73f97ccfff542adb41dc67a3067a0cb0850161b16e98daf9ea9764897abe3edfa24907bd143a9f3bf3f49bbdae4f930dfa664a327cacd1417ef8df454562f248ef4ab9168bf9d423f6873f8c7a65535041905cadb03cd96ad75500a") (async, rerun: 32) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (rerun: 32) 14:07:59 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (fail_nth: 1) 14:07:59 executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0xcf) connect$ax25(r1, &(0x7f0000000100)={{0x3, @bcast, 0x6}, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) (async) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x100) ioctl$sock_bt_hci(r2, 0x0, &(0x7f0000000080)="4b1ee37a52a1acd51c05e26a7a88c48dd7298ef289ae32670cd73f97ccfff542adb41dc67a3067a0cb0850161b16e98daf9ea9764897abe3edfa24907bd143a9f3bf3f49bbdae4f930dfa664a327cacd1417ef8df454562f248ef4ab9168bf9d423f6873f8c7a65535041905cadb03cd96ad75500a") (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) [ 2833.788575] ax25_connect(): syz-executor.5 uses autobind, please contact jreuter@yaina.de 14:07:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async, rerun: 32) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0xee3, 0x4) 14:07:59 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) sendto$ax25(0xffffffffffffffff, &(0x7f0000000000)="551e43b738ed644930b71b5978362d4f85d6f12a1bf4d004805e24700b22652c06ece43d9a4b", 0x26, 0x814, &(0x7f00000000c0)={{0x3, @default, 0x4}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @null]}, 0x48) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0x83, 0x3}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000000)=0xfff, 0x4) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:59 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r1, &(0x7f0000000040), 0x6) 14:07:59 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_CLOSE(r1, 0x40086409, &(0x7f0000000040)) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) sendto$unix(r2, &(0x7f0000000080)="1a5d6911412c21c53bf801e9d023d2e8928e47977af0b7346c6080fe1af543d899c23915ac1f8c2f4d8d87225829f7ef9112485f16a0faac9b20e09af95d6265e6a2de0d458b2ea560e81624bf3bfa4bcaef4e0575b0eb2a03bc06aaf4628f394f221d7ebfcfa947d6cde4cd187396654ed8a468d09c2381e23d159d89a816a6b88b3d8fe8b0ca44ab0ced9accb9ebc6245d687ae7ae849ca80b71abfd91682d9462f18c665a47", 0xa7, 0x20040000, 0x0, 0x0) 14:07:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0xee3, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0xee3, 0x4) (async) 14:07:59 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r1, &(0x7f0000000040), 0x6) 14:07:59 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) sendto$ax25(0xffffffffffffffff, &(0x7f0000000000)="551e43b738ed644930b71b5978362d4f85d6f12a1bf4d004805e24700b22652c06ece43d9a4b", 0x26, 0x814, &(0x7f00000000c0)={{0x3, @default, 0x4}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @null]}, 0x48) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0x83, 0x3}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000000)=0xfff, 0x4) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000000)=0xfff, 0x4) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) 14:07:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async, rerun: 64) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (rerun: 64) 14:07:59 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_CLOSE(r1, 0x40086409, &(0x7f0000000040)) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) sendto$unix(r2, &(0x7f0000000080)="1a5d6911412c21c53bf801e9d023d2e8928e47977af0b7346c6080fe1af543d899c23915ac1f8c2f4d8d87225829f7ef9112485f16a0faac9b20e09af95d6265e6a2de0d458b2ea560e81624bf3bfa4bcaef4e0575b0eb2a03bc06aaf4628f394f221d7ebfcfa947d6cde4cd187396654ed8a468d09c2381e23d159d89a816a6b88b3d8fe8b0ca44ab0ced9accb9ebc6245d687ae7ae849ca80b71abfd91682d9462f18c665a47", 0xa7, 0x20040000, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$DRM_IOCTL_GEM_CLOSE(r1, 0x40086409, &(0x7f0000000040)) (async) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(r2, 0x0, 0x0) (async) sendto$unix(r2, &(0x7f0000000080)="1a5d6911412c21c53bf801e9d023d2e8928e47977af0b7346c6080fe1af543d899c23915ac1f8c2f4d8d87225829f7ef9112485f16a0faac9b20e09af95d6265e6a2de0d458b2ea560e81624bf3bfa4bcaef4e0575b0eb2a03bc06aaf4628f394f221d7ebfcfa947d6cde4cd187396654ed8a468d09c2381e23d159d89a816a6b88b3d8fe8b0ca44ab0ced9accb9ebc6245d687ae7ae849ca80b71abfd91682d9462f18c665a47", 0xa7, 0x20040000, 0x0, 0x0) (async) 14:07:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:07:59 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r1, &(0x7f0000000040), 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) bind$bt_hci(r1, &(0x7f0000000040), 0x6) (async) 14:07:59 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) sendto$ax25(0xffffffffffffffff, &(0x7f0000000000)="551e43b738ed644930b71b5978362d4f85d6f12a1bf4d004805e24700b22652c06ece43d9a4b", 0x26, 0x814, &(0x7f00000000c0)={{0x3, @default, 0x4}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @null]}, 0x48) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0x83, 0x3}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000580)=[{&(0x7f0000000180)=""/232, 0xe8}, {&(0x7f0000000280)=""/84, 0x54}, {&(0x7f0000000300)=""/68, 0x44}, {&(0x7f0000000380)=""/152, 0x98}, {&(0x7f0000000440)=""/155, 0x9b}, {&(0x7f0000000500)=""/68, 0x44}], 0x6, &(0x7f0000000600)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32, @ANYBLOB="000008cf"], 0x50}, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000080)=0x3ff, 0x4) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:07:59 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_CLOSE(r1, 0x40086409, &(0x7f0000000040)) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) sendto$unix(r2, &(0x7f0000000080)="1a5d6911412c21c53bf801e9d023d2e8928e47977af0b7346c6080fe1af543d899c23915ac1f8c2f4d8d87225829f7ef9112485f16a0faac9b20e09af95d6265e6a2de0d458b2ea560e81624bf3bfa4bcaef4e0575b0eb2a03bc06aaf4628f394f221d7ebfcfa947d6cde4cd187396654ed8a468d09c2381e23d159d89a816a6b88b3d8fe8b0ca44ab0ced9accb9ebc6245d687ae7ae849ca80b71abfd91682d9462f18c665a47", 0xa7, 0x20040000, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$DRM_IOCTL_GEM_CLOSE(r1, 0x40086409, &(0x7f0000000040)) (async) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(r2, 0x0, 0x0) (async) sendto$unix(r2, &(0x7f0000000080)="1a5d6911412c21c53bf801e9d023d2e8928e47977af0b7346c6080fe1af543d899c23915ac1f8c2f4d8d87225829f7ef9112485f16a0faac9b20e09af95d6265e6a2de0d458b2ea560e81624bf3bfa4bcaef4e0575b0eb2a03bc06aaf4628f394f221d7ebfcfa947d6cde4cd187396654ed8a468d09c2381e23d159d89a816a6b88b3d8fe8b0ca44ab0ced9accb9ebc6245d687ae7ae849ca80b71abfd91682d9462f18c665a47", 0xa7, 0x20040000, 0x0, 0x0) (async) 14:07:59 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_TIME_STAMP(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000000)=0xfff, 0x4) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:07:59 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:07:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000580)=[{&(0x7f0000000180)=""/232, 0xe8}, {&(0x7f0000000280)=""/84, 0x54}, {&(0x7f0000000300)=""/68, 0x44}, {&(0x7f0000000380)=""/152, 0x98}, {&(0x7f0000000440)=""/155, 0x9b}, {&(0x7f0000000500)=""/68, 0x44}], 0x6, &(0x7f0000000600)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32, @ANYBLOB="000008cf"], 0x50}, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000080)=0x3ff, 0x4) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000580)=[{&(0x7f0000000180)=""/232, 0xe8}, {&(0x7f0000000280)=""/84, 0x54}, {&(0x7f0000000300)=""/68, 0x44}, {&(0x7f0000000380)=""/152, 0x98}, {&(0x7f0000000440)=""/155, 0x9b}, {&(0x7f0000000500)=""/68, 0x44}], 0x6, &(0x7f0000000600)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32, @ANYBLOB="000008cf"], 0x50}, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000080)=0x3ff, 0x4) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:08:00 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x18, 0x140c, 0x400, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x40c0004}, 0x400c0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:00 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000040)={0x7}) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:08:00 executing program 5: ioctl$MEDIA_REQUEST_IOC_REINIT(0xffffffffffffffff, 0x7c81, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x4}, 0x6) 14:08:00 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000100)=@abs, 0x6e, &(0x7f0000000580)=[{&(0x7f0000000180)=""/232, 0xe8}, {&(0x7f0000000280)=""/84, 0x54}, {&(0x7f0000000300)=""/68, 0x44}, {&(0x7f0000000380)=""/152, 0x98}, {&(0x7f0000000440)=""/155, 0x9b}, {&(0x7f0000000500)=""/68, 0x44}], 0x6, &(0x7f0000000600)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32, @ANYBLOB="000008cf"], 0x50}, 0x1) (rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 64) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000080)=0x3ff, 0x4) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:00 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x18, 0x140c, 0x400, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x40c0004}, 0x400c0) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:00 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f0000000000)) (async) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000040)={0x7}) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:08:00 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async, rerun: 32) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async, rerun: 32) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:00 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448ca, &(0x7f0000000000)="1fb4983ccfb04452f7c18fa19504b6962e50369a378f9157d0e300c30c9920938e9b8e183a8a822e5333f92c2c0bcf69ac7d9fe650ca83e97e518d73318ef43f4b1df05c2b29fd017e9afaff614fb455d3b4ffcbcd406c22") 14:08:00 executing program 5: ioctl$MEDIA_REQUEST_IOC_REINIT(0xffffffffffffffff, 0x7c81, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x4}, 0x6) ioctl$MEDIA_REQUEST_IOC_REINIT(0xffffffffffffffff, 0x7c81, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x4}, 0x6) (async) [ 2834.284195] Bluetooth: hci2 command 0x0401 tx timeout 14:08:00 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, 0x0, 0x0) recvmmsg$unix(r1, &(0x7f0000000300)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000000)=[{&(0x7f0000000100)=""/196, 0xc4}, {&(0x7f0000000200)=""/89, 0x59}, {&(0x7f0000000280)=""/100, 0x64}], 0x3}}], 0x1, 0x2021, &(0x7f0000000340)) ioctl$sock_ax25_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, 0x5, [@default, @default, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) 14:08:00 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x18, 0x140c, 0x400, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x40c0004}, 0x400c0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x18, 0x140c, 0x400, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x40c0004}, 0x400c0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:08:00 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000040)={0x7}) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) ioctl$SIOCX25GDTEFACILITIES(r1, 0x89ea, &(0x7f0000000000)) (async) ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000040)={0x7}) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) 14:08:00 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448ca, &(0x7f0000000000)="1fb4983ccfb04452f7c18fa19504b6962e50369a378f9157d0e300c30c9920938e9b8e183a8a822e5333f92c2c0bcf69ac7d9fe650ca83e97e518d73318ef43f4b1df05c2b29fd017e9afaff614fb455d3b4ffcbcd406c22") 14:08:00 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) connect$ax25(r1, &(0x7f0000000100)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000080)={0x0, 0x2, r0, 0x1ff, 0x80000}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$sock_bt_hci(r0, 0x400448c9, &(0x7f0000000000)="2a47ef5e8c9ec89f8d3e4dc4b5a8d846440f0e") 14:08:00 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, 0x0, 0x0) (async) recvmmsg$unix(r1, &(0x7f0000000300)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000000)=[{&(0x7f0000000100)=""/196, 0xc4}, {&(0x7f0000000200)=""/89, 0x59}, {&(0x7f0000000280)=""/100, 0x64}], 0x3}}], 0x1, 0x2021, &(0x7f0000000340)) ioctl$sock_ax25_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, 0x5, [@default, @default, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) 14:08:00 executing program 5: ioctl$MEDIA_REQUEST_IOC_REINIT(0xffffffffffffffff, 0x7c81, 0x0) (async, rerun: 32) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x3, 0x4}, 0x6) 14:08:00 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448df, &(0x7f0000000000)="56012dbcf121f716ea6960ffae8f54a34ab31eac297b17e19074620aa75a65fcd8c2fe932561") r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:00 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, 0x0, 0x0) recvmmsg$unix(r1, &(0x7f0000000300)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000000)=[{&(0x7f0000000100)=""/196, 0xc4}, {&(0x7f0000000200)=""/89, 0x59}, {&(0x7f0000000280)=""/100, 0x64}], 0x3}}], 0x1, 0x2021, &(0x7f0000000340)) ioctl$sock_ax25_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, 0x5, [@default, @default, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(r1, 0x0, 0x0) (async) recvmmsg$unix(r1, &(0x7f0000000300)=[{{&(0x7f0000000080), 0x6e, &(0x7f0000000000)=[{&(0x7f0000000100)=""/196, 0xc4}, {&(0x7f0000000200)=""/89, 0x59}, {&(0x7f0000000280)=""/100, 0x64}], 0x3}}], 0x1, 0x2021, &(0x7f0000000340)) (async) ioctl$sock_ax25_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, 0x5, [@default, @default, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) (async) 14:08:00 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0xffffffffffffffd9) 14:08:00 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448ca, &(0x7f0000000000)="1fb4983ccfb04452f7c18fa19504b6962e50369a378f9157d0e300c30c9920938e9b8e183a8a822e5333f92c2c0bcf69ac7d9fe650ca83e97e518d73318ef43f4b1df05c2b29fd017e9afaff614fb455d3b4ffcbcd406c22") 14:08:00 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) connect$ax25(r1, &(0x7f0000000100)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000080)={0x0, 0x2, r0, 0x1ff, 0x80000}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$sock_bt_hci(r0, 0x400448c9, &(0x7f0000000000)="2a47ef5e8c9ec89f8d3e4dc4b5a8d846440f0e") syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) getpeername$ax25(r1, 0x0, 0x0) (async) connect$ax25(r1, &(0x7f0000000100)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000080)={0x0, 0x2, r0, 0x1ff, 0x80000}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448c9, &(0x7f0000000000)="2a47ef5e8c9ec89f8d3e4dc4b5a8d846440f0e") (async) [ 2834.445778] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de 14:08:00 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448df, &(0x7f0000000000)="56012dbcf121f716ea6960ffae8f54a34ab31eac297b17e19074620aa75a65fcd8c2fe932561") (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84080) r3 = socket$isdn(0x22, 0x3, 0x11) r4 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r4, 0x0, 0x0) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x11, 0x7, &(0x7f0000000680)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4}, [@map_idx={0x18, 0x3, 0x5, 0x0, 0x4}, @exit, @jmp={0x5, 0x1, 0x4, 0x3, 0x5, 0xfffffffffffffff0, 0x1}]}, &(0x7f00000006c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x0, r5, 0x8, &(0x7f0000000700)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000740)={0x3, 0x10, 0x5, 0x9}, 0x10}, 0x80) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000640)={0x164, 0x0, &(0x7f00000003c0)=[@dead_binder_done, @clear_death, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000080)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x3, 0x2, 0x25}, @fda={0x66646185, 0x8, 0x0, 0x13}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @decrefs={0x40046307, 0x2}, @request_death={0x400c630e, 0x1}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r3}, @flat=@binder={0x73622a85, 0xa}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/28, 0x1c, 0x1, 0x5}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}, @increfs_done={0x40106308, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000240)={@flat=@handle={0x73682a85, 0xb}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r4}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}}, @enter_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000300)={@fda={0x66646185, 0x9, 0x1, 0x12}, @fda={0x66646185, 0x0, 0x0, 0x3b}, @fda={0x66646185, 0x7, 0x0, 0x18}}, &(0x7f0000000380)={0x0, 0x20, 0x40}}}], 0xf0, 0x0, &(0x7f0000000540)="4fe8dd5eb9cc7cc6cb7503162e81e11dedea62de93876c4b0e38512d927277787c82f38997b1f0b038dad96ed7e3f3fc10198d8cf16d4aa5d7cb4255f00cc48a6d0aa92e6e426c0eac78103ef8de800a1e3cd7251f2d415d44b181465c602a66520fd9296b6af5af22efbd873f1238619777a9b6748a6f3f6bf166833cedb230be136a28dc3b6e5ace711c18d3d873486ec64f3118a30ebfee78f0a3e631ae2d7edeb7e78087e7ae27f995dbc45fd478c3b87330fac8564bba8899093c096cedcb6748c26e175e996d5d54f739cbc006649edb17ee50e1b0054211b32b888a06d442250b85b237392028bda16b6d3092"}) 14:08:00 executing program 1: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0, 0x0}) ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f00000001c0)={r0, 0x1, 0xbe}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000200)=0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SNDCTL_SEQ_GETOUTCOUNT(0xffffffffffffffff, 0x80045104, &(0x7f0000000240)) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) ioctl$SNDCTL_MIDI_INFO(r3, 0xc074510c, &(0x7f0000000340)={"2e6151e0b9923c2fe260d4c6c7c372522c464849735280d16173d4819118", 0x4, 0x8, 0x9, [0x7, 0x3, 0x9, 0x8001, 0xfffffffb, 0x63e, 0x1, 0x80, 0x7fffffff, 0x2, 0x80000000, 0x11a, 0x8, 0x643, 0x94dd, 0x8000, 0x59c8, 0x80]}) ioctl$sock_bt_hci(r2, 0x400448e0, &(0x7f0000000080)="3872f1b15e45c76bffd3bff11e4f52d8a59abfbd7dd55d7c816843ecc557ed036e7938f5ace299b0d692a8427e2c80a537396df1ea61c9a0dbfd83b85ef52cbd8d60e4a45577f2d3478267a101c58b991b5c7a4269bb2f7e63a3a7e64ee4359a267ac3fd69c5a2811b3d082d4f84e0f010e257a43f8959148f6f10082e1afe77762753ea3bd4ddf5d81a29615548f231b70b42a0d50dbea158058cdaff9357e8ecf35d0a8f56f4a8994873d2c23681a94482cd51ecdc490ad1c8f3ab3235c44f") r4 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x40000) setsockopt$bt_hci_HCI_TIME_STAMP(r4, 0x0, 0x3, &(0x7f0000000040)=0x8000, 0x4) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r5, 0x0, 0x0) ioctl$SNDCTL_SEQ_GETTIME(r5, 0x80045113, &(0x7f00000003c0)) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000280), 0x10000, 0x0) ioctl$IMHOLD_L1(r6, 0x80044948, &(0x7f00000002c0)=0x3f) 14:08:00 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0xffffffffffffffd9) 14:08:00 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x58, &(0x7f0000000080)}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:00 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448df, &(0x7f0000000000)="56012dbcf121f716ea6960ffae8f54a34ab31eac297b17e19074620aa75a65fcd8c2fe932561") r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:00 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) connect$ax25(r1, &(0x7f0000000100)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000080)={0x0, 0x2, r0, 0x1ff, 0x80000}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) ioctl$sock_bt_hci(r0, 0x400448c9, &(0x7f0000000000)="2a47ef5e8c9ec89f8d3e4dc4b5a8d846440f0e") syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) getpeername$ax25(r1, 0x0, 0x0) (async) connect$ax25(r1, &(0x7f0000000100)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000080)={0x0, 0x2, r0, 0x1ff, 0x80000}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) ioctl$sock_bt_hci(r0, 0x400448c9, &(0x7f0000000000)="2a47ef5e8c9ec89f8d3e4dc4b5a8d846440f0e") (async) [ 2834.545807] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de 14:08:00 executing program 1: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0, 0x0}) ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f00000001c0)={r0, 0x1, 0xbe}) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000200)=0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SNDCTL_SEQ_GETOUTCOUNT(0xffffffffffffffff, 0x80045104, &(0x7f0000000240)) (async) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) ioctl$SNDCTL_MIDI_INFO(r3, 0xc074510c, &(0x7f0000000340)={"2e6151e0b9923c2fe260d4c6c7c372522c464849735280d16173d4819118", 0x4, 0x8, 0x9, [0x7, 0x3, 0x9, 0x8001, 0xfffffffb, 0x63e, 0x1, 0x80, 0x7fffffff, 0x2, 0x80000000, 0x11a, 0x8, 0x643, 0x94dd, 0x8000, 0x59c8, 0x80]}) (async) ioctl$sock_bt_hci(r2, 0x400448e0, &(0x7f0000000080)="3872f1b15e45c76bffd3bff11e4f52d8a59abfbd7dd55d7c816843ecc557ed036e7938f5ace299b0d692a8427e2c80a537396df1ea61c9a0dbfd83b85ef52cbd8d60e4a45577f2d3478267a101c58b991b5c7a4269bb2f7e63a3a7e64ee4359a267ac3fd69c5a2811b3d082d4f84e0f010e257a43f8959148f6f10082e1afe77762753ea3bd4ddf5d81a29615548f231b70b42a0d50dbea158058cdaff9357e8ecf35d0a8f56f4a8994873d2c23681a94482cd51ecdc490ad1c8f3ab3235c44f") (async) r4 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x40000) setsockopt$bt_hci_HCI_TIME_STAMP(r4, 0x0, 0x3, &(0x7f0000000040)=0x8000, 0x4) (async) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r5, 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_GETTIME(r5, 0x80045113, &(0x7f00000003c0)) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000280), 0x10000, 0x0) ioctl$IMHOLD_L1(r6, 0x80044948, &(0x7f00000002c0)=0x3f) 14:08:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84080) r3 = socket$isdn(0x22, 0x3, 0x11) (async) r4 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r4, 0x0, 0x0) (async, rerun: 32) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (rerun: 32) write$apparmor_current(r5, 0x0, 0x0) (async, rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x11, 0x7, &(0x7f0000000680)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4}, [@map_idx={0x18, 0x3, 0x5, 0x0, 0x4}, @exit, @jmp={0x5, 0x1, 0x4, 0x3, 0x5, 0xfffffffffffffff0, 0x1}]}, &(0x7f00000006c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x0, r5, 0x8, &(0x7f0000000700)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000740)={0x3, 0x10, 0x5, 0x9}, 0x10}, 0x80) (async, rerun: 64) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000640)={0x164, 0x0, &(0x7f00000003c0)=[@dead_binder_done, @clear_death, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000080)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x3, 0x2, 0x25}, @fda={0x66646185, 0x8, 0x0, 0x13}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @decrefs={0x40046307, 0x2}, @request_death={0x400c630e, 0x1}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r3}, @flat=@binder={0x73622a85, 0xa}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/28, 0x1c, 0x1, 0x5}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}, @increfs_done={0x40106308, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000240)={@flat=@handle={0x73682a85, 0xb}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r4}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}}, @enter_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000300)={@fda={0x66646185, 0x9, 0x1, 0x12}, @fda={0x66646185, 0x0, 0x0, 0x3b}, @fda={0x66646185, 0x7, 0x0, 0x18}}, &(0x7f0000000380)={0x0, 0x20, 0x40}}}], 0xf0, 0x0, &(0x7f0000000540)="4fe8dd5eb9cc7cc6cb7503162e81e11dedea62de93876c4b0e38512d927277787c82f38997b1f0b038dad96ed7e3f3fc10198d8cf16d4aa5d7cb4255f00cc48a6d0aa92e6e426c0eac78103ef8de800a1e3cd7251f2d415d44b181465c602a66520fd9296b6af5af22efbd873f1238619777a9b6748a6f3f6bf166833cedb230be136a28dc3b6e5ace711c18d3d873486ec64f3118a30ebfee78f0a3e631ae2d7edeb7e78087e7ae27f995dbc45fd478c3b87330fac8564bba8899093c096cedcb6748c26e175e996d5d54f739cbc006649edb17ee50e1b0054211b32b888a06d442250b85b237392028bda16b6d3092"}) 14:08:00 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0xffffeb41, 0x4) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) ioctl$SIOCAX25GETINFO(0xffffffffffffffff, 0x89ed, &(0x7f0000000100)) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) bind$vsock_dgram(r2, &(0x7f0000000080)={0x28, 0x0, 0x0, @my=0x1}, 0x10) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000001c0)={0x3, &(0x7f0000000180)=[{0xb7a, 0x6, 0x4, 0x40}, {0x9, 0xb7, 0x2, 0x80}, {0x4, 0xa6, 0x3}]}) 14:08:00 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0xffffffffffffffd9) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0xffffffffffffffd9) (async) 14:08:00 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x58, &(0x7f0000000080)}, 0x10) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:00 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0xffffeb41, 0x4) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) ioctl$SIOCAX25GETINFO(0xffffffffffffffff, 0x89ed, &(0x7f0000000100)) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) bind$vsock_dgram(r2, &(0x7f0000000080)={0x28, 0x0, 0x0, @my=0x1}, 0x10) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000001c0)={0x3, &(0x7f0000000180)=[{0xb7a, 0x6, 0x4, 0x40}, {0x9, 0xb7, 0x2, 0x80}, {0x4, 0xa6, 0x3}]}) 14:08:00 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0xffffffffffffffff, 0x0, "439ab0", 0x6, 0x6}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)={0x1, @le_ltk_neg_reply={{0x201b, 0x2}, {0xc8}}}, 0x6) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:08:00 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RCLUNK(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x79, 0x1}, 0x7) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) [ 2834.665488] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de 14:08:00 executing program 1: ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)={0x0, 0x0}) ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f00000001c0)={r0, 0x1, 0xbe}) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f0000000200)=0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SNDCTL_SEQ_GETOUTCOUNT(0xffffffffffffffff, 0x80045104, &(0x7f0000000240)) (async, rerun: 64) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) (rerun: 64) ioctl$SNDCTL_MIDI_INFO(r3, 0xc074510c, &(0x7f0000000340)={"2e6151e0b9923c2fe260d4c6c7c372522c464849735280d16173d4819118", 0x4, 0x8, 0x9, [0x7, 0x3, 0x9, 0x8001, 0xfffffffb, 0x63e, 0x1, 0x80, 0x7fffffff, 0x2, 0x80000000, 0x11a, 0x8, 0x643, 0x94dd, 0x8000, 0x59c8, 0x80]}) ioctl$sock_bt_hci(r2, 0x400448e0, &(0x7f0000000080)="3872f1b15e45c76bffd3bff11e4f52d8a59abfbd7dd55d7c816843ecc557ed036e7938f5ace299b0d692a8427e2c80a537396df1ea61c9a0dbfd83b85ef52cbd8d60e4a45577f2d3478267a101c58b991b5c7a4269bb2f7e63a3a7e64ee4359a267ac3fd69c5a2811b3d082d4f84e0f010e257a43f8959148f6f10082e1afe77762753ea3bd4ddf5d81a29615548f231b70b42a0d50dbea158058cdaff9357e8ecf35d0a8f56f4a8994873d2c23681a94482cd51ecdc490ad1c8f3ab3235c44f") (async) r4 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x40000) setsockopt$bt_hci_HCI_TIME_STAMP(r4, 0x0, 0x3, &(0x7f0000000040)=0x8000, 0x4) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r5, 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_GETTIME(r5, 0x80045113, &(0x7f00000003c0)) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000280), 0x10000, 0x0) ioctl$IMHOLD_L1(r6, 0x80044948, &(0x7f00000002c0)=0x3f) 14:08:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84080) r3 = socket$isdn(0x22, 0x3, 0x11) r4 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r4, 0x0, 0x0) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x11, 0x7, &(0x7f0000000680)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4}, [@map_idx={0x18, 0x3, 0x5, 0x0, 0x4}, @exit, @jmp={0x5, 0x1, 0x4, 0x3, 0x5, 0xfffffffffffffff0, 0x1}]}, &(0x7f00000006c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x0, r5, 0x8, &(0x7f0000000700)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000740)={0x3, 0x10, 0x5, 0x9}, 0x10}, 0x80) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000640)={0x164, 0x0, &(0x7f00000003c0)=[@dead_binder_done, @clear_death, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000080)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x3, 0x2, 0x25}, @fda={0x66646185, 0x8, 0x0, 0x13}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @decrefs={0x40046307, 0x2}, @request_death={0x400c630e, 0x1}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r3}, @flat=@binder={0x73622a85, 0xa}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/28, 0x1c, 0x1, 0x5}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}, @increfs_done={0x40106308, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000240)={@flat=@handle={0x73682a85, 0xb}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r4}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}}, @enter_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000300)={@fda={0x66646185, 0x9, 0x1, 0x12}, @fda={0x66646185, 0x0, 0x0, 0x3b}, @fda={0x66646185, 0x7, 0x0, 0x18}}, &(0x7f0000000380)={0x0, 0x20, 0x40}}}], 0xf0, 0x0, &(0x7f0000000540)="4fe8dd5eb9cc7cc6cb7503162e81e11dedea62de93876c4b0e38512d927277787c82f38997b1f0b038dad96ed7e3f3fc10198d8cf16d4aa5d7cb4255f00cc48a6d0aa92e6e426c0eac78103ef8de800a1e3cd7251f2d415d44b181465c602a66520fd9296b6af5af22efbd873f1238619777a9b6748a6f3f6bf166833cedb230be136a28dc3b6e5ace711c18d3d873486ec64f3118a30ebfee78f0a3e631ae2d7edeb7e78087e7ae27f995dbc45fd478c3b87330fac8564bba8899093c096cedcb6748c26e175e996d5d54f739cbc006649edb17ee50e1b0054211b32b888a06d442250b85b237392028bda16b6d3092"}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r1, 0x0, 0x0) (async) pipe2$9p(&(0x7f0000000040), 0x84080) (async) socket$isdn(0x22, 0x3, 0x11) (async) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(r4, 0x0, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r5, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x11, 0x7, &(0x7f0000000680)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4}, [@map_idx={0x18, 0x3, 0x5, 0x0, 0x4}, @exit, @jmp={0x5, 0x1, 0x4, 0x3, 0x5, 0xfffffffffffffff0, 0x1}]}, &(0x7f00000006c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x0, r5, 0x8, &(0x7f0000000700)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000740)={0x3, 0x10, 0x5, 0x9}, 0x10}, 0x80) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000640)={0x164, 0x0, &(0x7f00000003c0)=[@dead_binder_done, @clear_death, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000080)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x3, 0x2, 0x25}, @fda={0x66646185, 0x8, 0x0, 0x13}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @decrefs={0x40046307, 0x2}, @request_death={0x400c630e, 0x1}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r3}, @flat=@binder={0x73622a85, 0xa}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/28, 0x1c, 0x1, 0x5}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}, @increfs_done={0x40106308, 0x2}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000240)={@flat=@handle={0x73682a85, 0xb}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r4}}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}}, @enter_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000300)={@fda={0x66646185, 0x9, 0x1, 0x12}, @fda={0x66646185, 0x0, 0x0, 0x3b}, @fda={0x66646185, 0x7, 0x0, 0x18}}, &(0x7f0000000380)={0x0, 0x20, 0x40}}}], 0xf0, 0x0, &(0x7f0000000540)="4fe8dd5eb9cc7cc6cb7503162e81e11dedea62de93876c4b0e38512d927277787c82f38997b1f0b038dad96ed7e3f3fc10198d8cf16d4aa5d7cb4255f00cc48a6d0aa92e6e426c0eac78103ef8de800a1e3cd7251f2d415d44b181465c602a66520fd9296b6af5af22efbd873f1238619777a9b6748a6f3f6bf166833cedb230be136a28dc3b6e5ace711c18d3d873486ec64f3118a30ebfee78f0a3e631ae2d7edeb7e78087e7ae27f995dbc45fd478c3b87330fac8564bba8899093c096cedcb6748c26e175e996d5d54f739cbc006649edb17ee50e1b0054211b32b888a06d442250b85b237392028bda16b6d3092"}) (async) 14:08:00 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x58, &(0x7f0000000080)}, 0x10) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:00 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$P9_RCLUNK(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x79, 0x1}, 0x7) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:00 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0xffffffffffffffff, 0x0, "439ab0", 0x6, 0x6}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)={0x1, @le_ltk_neg_reply={{0x201b, 0x2}, {0xc8}}}, 0x6) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:08:00 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) write$9p(0xffffffffffffffff, &(0x7f0000000000)="b7e0033a5e59fb6d", 0x8) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:00 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0xffffeb41, 0x4) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) ioctl$SIOCAX25GETINFO(0xffffffffffffffff, 0x89ed, &(0x7f0000000100)) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) (async) bind$vsock_dgram(r2, &(0x7f0000000080)={0x28, 0x0, 0x0, @my=0x1}, 0x10) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000001c0)={0x3, &(0x7f0000000180)=[{0xb7a, 0x6, 0x4, 0x40}, {0x9, 0xb7, 0x2, 0x80}, {0x4, 0xa6, 0x3}]}) 14:08:00 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="12046d200c6775e320aa1384f31a2c4e8f883a85fc9bd443d70fc749022e752c97cecabd4e8c247c7199d4dc8e54cd70be01d646e5b7cb3af297dc3b4f3cf61b3238f349ed9b43ae65d51bfb8d9975c53e42f29989460214061d4f8b06f488f147fe76ad036be3284fdf0c3465283610f6f8351c000000000000"], 0x7) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000100)="bc071ef5c34f975fb6e463e5f77a4038b1cc1efc33062a200bb55a6151337dd82f755ae19617756ebdc65367c22aae7002449832b1d1a0cc45c422af427303bb6b192ce68f64431576e602d831889a726e5d791263d181557b47a4ed407944607d870ef064795b84ea26fd54d3aabdd263e9f57ac7699268457ee382dbf03105809e3976290ef3b19f2c4c210a38ae42734893dd03e3059551213ad9c0dcb135a12728ffc6790439883a523784b9e68fb13e8d591ec88d0888d36acb4a7ac578f00381b87025cde67c1d7e8a462997b2ea0777c1ffdbcacbb13b1ba4f6356d5577100d66f55bad871be4") 14:08:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x1404, 0x20, 0x70bd26, 0x25dfdbfb}, 0x10}, 0x1, 0x0, 0x0, 0x40014}, 0x20000000) 14:08:00 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$P9_RCLUNK(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x79, 0x1}, 0x7) (async, rerun: 32) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:00 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) write$9p(0xffffffffffffffff, &(0x7f0000000000)="b7e0033a5e59fb6d", 0x8) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) write$9p(0xffffffffffffffff, &(0x7f0000000000)="b7e0033a5e59fb6d", 0x8) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:08:00 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0xffffffffffffffff, 0x0, "439ab0", 0x6, 0x6}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)={0x1, @le_ltk_neg_reply={{0x201b, 0x2}, {0xc8}}}, 0x6) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0xffffffffffffffff, 0x0, "439ab0", 0x6, 0x6}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000080)={0x1, @le_ltk_neg_reply={{0x201b, 0x2}, {0xc8}}}, 0x6) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) 14:08:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x1404, 0x20, 0x70bd26, 0x25dfdbfb}, 0x10}, 0x1, 0x0, 0x0, 0x40014}, 0x20000000) 14:08:00 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="12046d200c6775e320aa1384f31a2c4e8f883a85fc9bd443d70fc749022e752c97cecabd4e8c247c7199d4dc8e54cd70be01d646e5b7cb3af297dc3b4f3cf61b3238f349ed9b43ae65d51bfb8d9975c53e42f29989460214061d4f8b06f488f147fe76ad036be3284fdf0c3465283610f6f8351c000000000000"], 0x7) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000100)="bc071ef5c34f975fb6e463e5f77a4038b1cc1efc33062a200bb55a6151337dd82f755ae19617756ebdc65367c22aae7002449832b1d1a0cc45c422af427303bb6b192ce68f64431576e602d831889a726e5d791263d181557b47a4ed407944607d870ef064795b84ea26fd54d3aabdd263e9f57ac7699268457ee382dbf03105809e3976290ef3b19f2c4c210a38ae42734893dd03e3059551213ad9c0dcb135a12728ffc6790439883a523784b9e68fb13e8d591ec88d0888d36acb4a7ac578f00381b87025cde67c1d7e8a462997b2ea0777c1ffdbcacbb13b1ba4f6356d5577100d66f55bad871be4") 14:08:00 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x10000, 0x4) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x1404, 0x20, 0x70bd26, 0x25dfdbfb}, 0x10}, 0x1, 0x0, 0x0, 0x40014}, 0x20000000) 14:08:00 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x202, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000080)=0x4f9b, 0x4) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:00 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) write$9p(0xffffffffffffffff, &(0x7f0000000000)="b7e0033a5e59fb6d", 0x8) (async, rerun: 64) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async, rerun: 64) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:00 executing program 0: socket$inet6_sctp(0xa, 0x1, 0x84) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) accept$ax25(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @netrom}, [@remote, @null, @remote, @default, @default, @remote, @null, @netrom]}, &(0x7f00000000c0)=0x48) 14:08:00 executing program 0: socket$inet6_sctp(0xa, 0x1, 0x84) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) accept$ax25(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @netrom}, [@remote, @null, @remote, @default, @default, @remote, @null, @netrom]}, &(0x7f00000000c0)=0x48) 14:08:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xfffe, 0x4}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000040)) 14:08:00 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="12046d200c6775e320aa1384f31a2c4e8f883a85fc9bd443d70fc749022e752c97cecabd4e8c247c7199d4dc8e54cd70be01d646e5b7cb3af297dc3b4f3cf61b3238f349ed9b43ae65d51bfb8d9975c53e42f29989460214061d4f8b06f488f147fe76ad036be3284fdf0c3465283610f6f8351c000000000000"], 0x7) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000100)="bc071ef5c34f975fb6e463e5f77a4038b1cc1efc33062a200bb55a6151337dd82f755ae19617756ebdc65367c22aae7002449832b1d1a0cc45c422af427303bb6b192ce68f64431576e602d831889a726e5d791263d181557b47a4ed407944607d870ef064795b84ea26fd54d3aabdd263e9f57ac7699268457ee382dbf03105809e3976290ef3b19f2c4c210a38ae42734893dd03e3059551213ad9c0dcb135a12728ffc6790439883a523784b9e68fb13e8d591ec88d0888d36acb4a7ac578f00381b87025cde67c1d7e8a462997b2ea0777c1ffdbcacbb13b1ba4f6356d5577100d66f55bad871be4") syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="12046d200c6775e320aa1384f31a2c4e8f883a85fc9bd443d70fc749022e752c97cecabd4e8c247c7199d4dc8e54cd70be01d646e5b7cb3af297dc3b4f3cf61b3238f349ed9b43ae65d51bfb8d9975c53e42f29989460214061d4f8b06f488f147fe76ad036be3284fdf0c3465283610f6f8351c000000000000"], 0x7) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000100)="bc071ef5c34f975fb6e463e5f77a4038b1cc1efc33062a200bb55a6151337dd82f755ae19617756ebdc65367c22aae7002449832b1d1a0cc45c422af427303bb6b192ce68f64431576e602d831889a726e5d791263d181557b47a4ed407944607d870ef064795b84ea26fd54d3aabdd263e9f57ac7699268457ee382dbf03105809e3976290ef3b19f2c4c210a38ae42734893dd03e3059551213ad9c0dcb135a12728ffc6790439883a523784b9e68fb13e8d591ec88d0888d36acb4a7ac578f00381b87025cde67c1d7e8a462997b2ea0777c1ffdbcacbb13b1ba4f6356d5577100d66f55bad871be4") (async) 14:08:00 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="e4d439746b96ac767460c6bdbb"], 0xa) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:00 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x202, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000080)=0x4f9b, 0x4) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:00 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x10000, 0x4) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:00 executing program 0: socket$inet6_sctp(0xa, 0x1, 0x84) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) accept$ax25(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @netrom}, [@remote, @null, @remote, @default, @default, @remote, @null, @netrom]}, &(0x7f00000000c0)=0x48) socket$inet6_sctp(0xa, 0x1, 0x84) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) accept$ax25(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @netrom}, [@remote, @null, @remote, @default, @default, @remote, @null, @netrom]}, &(0x7f00000000c0)=0x48) (async) 14:08:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xfffe, 0x4}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000040)) 14:08:01 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)="331f1a704c0421c6e716f9e5ed2b7e0f7cec5dd0c60e19d87df6db73cc97a8c63fe2c814631a9bc7865686a97400971f1e36cb7ecc17056263acb29228a6507c6cf19bad6f4c352fee8d9476b9e634433525644d2ed89e7c656c6087e79270f2dc4a96ac09ac3af628a3a2329687129146b7857b461ac1969372e3578b131fdb2fa77b65d8a2e84554b96ead8d86c56c81e8cc09f98ac0f13ac4ebff39871203b3fee41db7e7f1aa9d474eaf1123a8487cdac5db43d9c1e10138f0edb3f5dd2213ca89bac8aa608d662657283393c572f292c8f55c79fa08f68113a066f64fc110d97f84") 14:08:01 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x202, 0x0) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000080)=0x4f9b, 0x4) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) sendto$ax25(r0, &(0x7f0000000040)="c0ed350a1b750c34afcd507ab8e2d3b2b6d3f4f1b91265d8237d630aa500a8d366810889514481d4f676ca7412a29147c1b9b18dbd1def5e6161ed75335aaa8d50eed84e6879794fdaa2f090081f2e81558f257d24810684117698453a85e20f7e89999d4670373837059838e24f4b6ca0771dee399776d2eaa709b317ad4f879c9e89e11729778d91d67c521a33129bdb86652745a8f55ddc92602cd42a5050943da64a4f4cb18d8426e4fba3c4de969a24b1f7bb0b9a87ab717c2d0a5a227370bba35d48b407e9608b0badef5421576f327e94955866b04c2718eb87dbcf36be24ef7e4067e1bf3325df33df59e8efb335cb0386e5ef01859e8f23b3ba08c38218e0cf7cca9153eb8bc7a241c86e86d3f5cea39e6771d75468e1de1ad1eb2c7444a30e4fd6eb955b16b68bd8eb84d489cdc7819ca9b4e94fb22204e2afda0e47c0bdea7f6b0fbe84b878c345ece29b0a5a43070ea262dedc3f4df96ca6716b71d1db257cea26596f1ef154a3fa03369709de3019dd3d1161276b4ffb8a2de71486abcf903ae965009e2d696336345b2024d6ce8408d5d1e84b2bf02a84cd691282b9842477617eea3862b0325a93c992b03055dd05e6e027197bc4608308775a25709abb90caba68e4e53c47fc4bae2cadc36543cb00df1a8b6159a3ddf0471aacccebf5ed827da432a355461ce84eadc8d8d82eba4a81dd607be8f66a7e639c22ca856dddc2959b3742dd8fca3966341cbecf439db9ca3fb1d59cc6f808a767c6f06df64ef7442d0291ae75794eea94699c13b4b09903dfa450b3a179578658febf6e28ae98e39dcfbdbb69240a22e9cf098897c11a11ceb1de60a642e7a2893f655e7c1ad611ac2cb906db4059283e66c29538e1c34ad6d22896554bcd69b8a09330759ab234872c9b7df18cd2eea0c61469ec7f984bc6ee1360c40dc3844af9723f48fe58b073d8db3310580622f83700dd062afb72f5827d9c36146912522c4e76c6153e1ee6bf515d14abefa8ee7814aa313162b4627197fce99783e74cb58edb8fbb5991b696de7b8db579cccd7fd41294ea4b5e0f055f777f976c7c8c53132725e047cfa7c25b1eacd50019884e19859107656e0618654d38b23ea922d77907834a861a564b5fc5f1e84f78dae65a85c65dfe436b45ed198a44af0d0e84e8dd7a956fcc29bed7300c89680bbc2302465417b01d812cf3717571e78d3aca9e85532815059c9554202814c8bb9758e303c5eef22a798d0bd4d8c76ccd6de274116c23771e608d5d0182d92057367f212fda2a8401e6a9317e2dcc9b19af5db194d5fc3e1c033fb1594ca6a9cedf8d0080e1abdd34efc1d248da82c377f4d45d7dc82c846a91e6d62096394b011c305d685403279f45520f4ce84192042f9a47a4e51a97635390dbfb321ef2a40b238413e3658c41dde18708005a1f8c4e8704f989f569359671b692d21360ff2dbca9f12c0bc16fe82286bca1b54d5b3ef9e9d5165cc2cd52ec54ad4983606a57e63dbdd38429a0a5b7a402a2e12f6a24a6d1507348daa3760e9b343573935cd6e65c1797c5164d2da4a6ce9a8bed052d86a96f2417ac4b55c409823baed81ca9f999e2220df255b772321b1931bb308188c6d952bd331f2c0b3c814d27b100370af528c1052756c2b140ff7ad95f7855f6ee49de720d21d1a4659aa237ee85e9b8e64855ef0d0ccee19f579b3448330d44ec7d9bb8bc8961a9c8ae8933ab02deb669955f8b765b3cba7c2c6c64a203a1af61d2020638aecce1cf00d9ba3033cb440433247d655d5167f19f09f6a33c9d7e63cc123b15ff1ab9159760067d17c44f640a2385685eb8130eeca73b26b22b7c336f076b2aa82e3a809a68915d3bd353a41b077910253eeae83e44cc6bad20e6c2cd782c16df37843332b81badfdeaf9b9653abfa6eaa9d5861acca1f020b0ea0e82f7df94be0f88c253a39ba47654470b3b778985b363bb1141347a58fbf423001d2ca92749a01637230369a99516db0e8c3750019e641a24c6c5fc34bf8520e770be31d150159ae14d88e3e51b9c583c42618e8f8e4dc415da0c89c5294f883d3a716bf5aaa12301c86b64efe08bf148b16c8de236166c7da075f50118e452c8d6b8d6aad7e89abbfe058cbcd982c3df3bfd87081f58fd5ffccd75d4e0907cd8d92f629a689c03c03d45b3c483ca9dfe4477ef6f04c1ed01ef1a247e71ec21cd2d37a8effa448f34a525f23d42e389e487732e0a6ffa3d8768dcfb958dd61af789369edd64b519e51b5d367177d1a4faa532046ef3c1be8c338cd8a8fc84eef2435ba3f53d5c5f67582e2ca01ddc59db3b8eb94e7ce196456408f1f6e3703d1d22973a56d89fb8685ac595e5afe231e0d4a15649cd004519da0532d3ce3ce82b82d511f477ad004e593959590ba6e2387e35d57ffef5bb687cd876e913a146c761590edae55357475189e4a66e23e96a604764c0ac1cd43e1bf92794706851ca9a6f9fad0f4153edcbc826f63923da7b8adbe02d6d88299936d8650511cf700dbdad0aa8dac3be970134bbfabd9877c52ec93d6f694a3c5a5b728ee6d2c8b61b9afc3479d0ad899b8b23c5265c2856b72cb9ae032cb5c1bba109c8f5def1455ce78eabddd650c93e60230d2e60d1da4e1c079bfc2ecca6b9ef1101730ef534710ce1470488acd656ed3909f06c4ce9f816c8c402ad516a4b0e9454dfcc9a10c9e3a6b8617db76131adf5662dca361458249ba85f95c287f7ac2730430596a4ff5800b73581513477d2f5b330bdc7f54d66417bfc9d4d331a1afb2a7909f5b464305ec9938f87b80f0c187dec3d5bad813feadfc13ea064997bcbe1e09a92230696096ead60c354f74184a3bcab4c76de02eb703e12296619b3c8fce67b590a4a39bcac3042076a772219be80a16a0cb36f4b3d99f69fd898a38bf9e54a45d6b13699bee7118c4c04c6bf616e72c310688727df6b903d2b2a118025de0baef02c70036385ecc771bfc02dc5a178a2d180596e97ca36d4afc60cd5f7edbeddaab47e7fa20498328ce4fea2d6843eacf479e9fc514cc575aec67011b77bdc8d19162fbeb8be463c850f7001d196c3557e983c12b1275bba3eca0da88bf403e52d9e8ec3780d15afa8a354e398a814a99049315c6eabf73fdd6704aa9dafb4acba39a90a36b858fcb58b49479c475663d1eff2e9ac467525cc1c18fd0f605c7b78cf197941b760f608be5e11b091c2cc73f7a8ec533baea5dd2efc745771f99378f8b314dfe8eb1278c0530c21088c5d92897f0f3bab26fe70e74f9803d222e7316d0d7d2623ec4de62a228831680833af36f89a596b04e5ca67fded54d2d7c38eabd726d5eface32af7f238775e01e5297b075031d10e1661a7982532d771e9af8e2e6317728df46bb1fbc7d0b48535a2d87dbbee0b4fd58ce8568c88a84cf4c78e761d7522fa4e1139ea363814a3324546cfddc2e57407f7271938f7b08808b16627e8f0887825f99eee1ad6ebc5de334aa52abfa7d9bc6897b45657a69d491a9c2b7961f758ce96cba10d9a0afc9da4d0016d0ce40ac347c31f9e2669e2672cb495ab4a29fdd75679127f2ad99671d39d6bc1d9d77ae8eeb5e58f54b62766cbcbf86022d48ce21daf23afa41539efe0df3a2f107d351f2d93bb7d862bfd40c2c2e849a3cb32de0d7cffcd85402dcf697158ec3e64c350e662f50468cbfb2c3a45406748ba2e58dc0ceba0aaff1e4ea290964764e71913fdddbfef1ef3b80c2f6337b48173d9788d83c156a6d4417e9c1eda6cfd0d11668d0f3cf5ad1af95ce6d9713ca3ff989bd953a8b8fbfb6b5d5d4fb65588055f257923ba101443c2945fb54a3363aface5c7b854dfda6f5259890bd4bfb2275c28eb0574e50894c96f92b2c9472f58d965a0673a8adb965392c304987dc5266d069507dc5989779816b4d48fba2c53208fd2b8c5f134eabe61ff68c747d3a6e43ba264229d732ebec40f6261e4ceee87238b43997d37695fb7b0fc28660c19146a4a2159c15f58c1f32889ea71e86879eaab76da58c5dd8ece30b5ab948f18f0fffa26790e2de1bba69f82eb99a49e5bcc0f4573a6962a976e24e33293a2f65f0c86d9804312a392974755a4763050f991d350eae0f7aa514a96ae727360a771495fdd1cc428c8bc73ebaa9c008fea5bf790b0986d5eb54ea993df74cba7a8e46203d640fc8ad2bef90934768c4535e98a1d6b5b326f1528ec0f67067b0471c50d8c5fdd87b74c5802e8b76fec31401cc8d9e7cd459a8dca6c48106eb7537f2d664ef7f4c333278a1b2139210e9fbf757e40803d156d2ca9dd5c84b1519fa05b18b6ecf1bca1bdf270c72651b7cf4bcbdeda907ff888390cf20eb58d218ca7aaf0bb4099f124d5b27a54db76895e64e8ab35eb2ff4cb5cf666c429f7f755f22bc1aecb1401c1a744ba83c660f5bd8def47790da5a4e7c4528f440b44c4711e874982f5d4c75cbd91633a1c4354682fd87dbbaa8925594c9272768184b4f4656f26258ece710cf4eb140d7ef7153f93857fc55eaaa105569825e54396da64523b425986b4003959e188efd346bc85d601c16fef77ebfca92061899f7cda735e48e668dc5a792628225750471b87eedee953904eb6845bf9caf521c2236cf942a7a9d715dc7a5f94eab145ba4c12b7eb1a06b9f6afefbe9e85e86ad88faa13ffe5eea1fb90525830c00993a6b815004b8522d00bcbcb2bf3177b7b9ce603de2b74b7e34f76878d52a99fa5d8fdbd79650d4b57f5cb74877867757eec593bb0cb6b7db21244b86b6372ab3a53e3234a7582fe7973bc49eb7f0943234a0d349ca2c992ac9baa18d2a68862f2a5ef12b3f842138c1b720c30bc75416063834f6e7c9a229e156ce97e1b40bbfc60f26d1d6d501a9d00e7934e9ac21bc9b812872e2f9280a53f6dd882c0fc38a8d0dd3b79bf1f4a87cc2d4a2bd0c8056b2167e9b2e5e2889bef328a8f8e4067b62e16ac2b6cf01c3652bd52247773b806c2bb7b2e60274930ac13df4c176db6a0bdc2b2575539375970833a30ae3d7d90b985f4ba9c4e1eddfaf339c17c988e1ce064d4e0fd89025afd2eff68811cd0709922bd86c5581282ad92831884f6ff33ea881744fbf34d9eb194111557bef1b01390503ca7cc5c424bb8fe9c129489afa0fbf8fb2649acfdf028b2e41541ce2feca483c3a58d39eb6b305d06def0d16a7402dc806780a3222b933352df9997187fc77cba5de8fd53250d97e2e337c91dd6ede1b45727d00ecd093845748104e4f358475f492ffee5b101a83b925545e12aaed0151d770c8d4be3549cd5504143ec944e5a0008a13f5c948a08bc330222af76cf198b629e3324158cd62201b7e93be30a129a9315aa04c3c946108b8036fed8fa0eb4e0eca8db4e1835e53d52fa36972705929793be0e70bc9411362d51d6760acabc5dbd0d55e5efe2e2dd222e99bbd73329e3f2dfb47654278ad86c188c21119b7019e9603831ee7ce27a17c156578259eba4cb637b2cf4a6ff0903abfc25473c57ae8553f13b769d21fafe613e4b0ff8e114eba88e4380e2a51ed475e701a5ce49c85d44b7365b511e5a6c6d5078e107f41e63f299b22085fb7f3e70153c41e2c8a93ff21f9994104a59b6b676129dac1fd4dae25386759cb720bb57c816a2bde148a972a2faed2844d57990ee5e4a72deb023a73764b6fb253842e733ff47479c1395bcb268c4477efe9366a5ffe54cb3ae00b39f0e93a716ddfe18dba8017862b5301592981164092b55384986062aa134852c15b3d0d9321d", 0x1000, 0x0, &(0x7f0000001040)={{0x3, @default, 0x15}, [@default, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) 14:08:01 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="e4d439746b96ac767460c6bdbb"], 0xa) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:01 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xfffe, 0x4}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000040)) 14:08:01 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x10000, 0x4) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x10000, 0x4) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:08:01 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)="331f1a704c0421c6e716f9e5ed2b7e0f7cec5dd0c60e19d87df6db73cc97a8c63fe2c814631a9bc7865686a97400971f1e36cb7ecc17056263acb29228a6507c6cf19bad6f4c352fee8d9476b9e634433525644d2ed89e7c656c6087e79270f2dc4a96ac09ac3af628a3a2329687129146b7857b461ac1969372e3578b131fdb2fa77b65d8a2e84554b96ead8d86c56c81e8cc09f98ac0f13ac4ebff39871203b3fee41db7e7f1aa9d474eaf1123a8487cdac5db43d9c1e10138f0edb3f5dd2213ca89bac8aa608d662657283393c572f292c8f55c79fa08f68113a066f64fc110d97f84") 14:08:01 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) sendto$ax25(r0, &(0x7f0000000040)="c0ed350a1b750c34afcd507ab8e2d3b2b6d3f4f1b91265d8237d630aa500a8d366810889514481d4f676ca7412a29147c1b9b18dbd1def5e6161ed75335aaa8d50eed84e6879794fdaa2f090081f2e81558f257d24810684117698453a85e20f7e89999d4670373837059838e24f4b6ca0771dee399776d2eaa709b317ad4f879c9e89e11729778d91d67c521a33129bdb86652745a8f55ddc92602cd42a5050943da64a4f4cb18d8426e4fba3c4de969a24b1f7bb0b9a87ab717c2d0a5a227370bba35d48b407e9608b0badef5421576f327e94955866b04c2718eb87dbcf36be24ef7e4067e1bf3325df33df59e8efb335cb0386e5ef01859e8f23b3ba08c38218e0cf7cca9153eb8bc7a241c86e86d3f5cea39e6771d75468e1de1ad1eb2c7444a30e4fd6eb955b16b68bd8eb84d489cdc7819ca9b4e94fb22204e2afda0e47c0bdea7f6b0fbe84b878c345ece29b0a5a43070ea262dedc3f4df96ca6716b71d1db257cea26596f1ef154a3fa03369709de3019dd3d1161276b4ffb8a2de71486abcf903ae965009e2d696336345b2024d6ce8408d5d1e84b2bf02a84cd691282b9842477617eea3862b0325a93c992b03055dd05e6e027197bc4608308775a25709abb90caba68e4e53c47fc4bae2cadc36543cb00df1a8b6159a3ddf0471aacccebf5ed827da432a355461ce84eadc8d8d82eba4a81dd607be8f66a7e639c22ca856dddc2959b3742dd8fca3966341cbecf439db9ca3fb1d59cc6f808a767c6f06df64ef7442d0291ae75794eea94699c13b4b09903dfa450b3a179578658febf6e28ae98e39dcfbdbb69240a22e9cf098897c11a11ceb1de60a642e7a2893f655e7c1ad611ac2cb906db4059283e66c29538e1c34ad6d22896554bcd69b8a09330759ab234872c9b7df18cd2eea0c61469ec7f984bc6ee1360c40dc3844af9723f48fe58b073d8db3310580622f83700dd062afb72f5827d9c36146912522c4e76c6153e1ee6bf515d14abefa8ee7814aa313162b4627197fce99783e74cb58edb8fbb5991b696de7b8db579cccd7fd41294ea4b5e0f055f777f976c7c8c53132725e047cfa7c25b1eacd50019884e19859107656e0618654d38b23ea922d77907834a861a564b5fc5f1e84f78dae65a85c65dfe436b45ed198a44af0d0e84e8dd7a956fcc29bed7300c89680bbc2302465417b01d812cf3717571e78d3aca9e85532815059c9554202814c8bb9758e303c5eef22a798d0bd4d8c76ccd6de274116c23771e608d5d0182d92057367f212fda2a8401e6a9317e2dcc9b19af5db194d5fc3e1c033fb1594ca6a9cedf8d0080e1abdd34efc1d248da82c377f4d45d7dc82c846a91e6d62096394b011c305d685403279f45520f4ce84192042f9a47a4e51a97635390dbfb321ef2a40b238413e3658c41dde18708005a1f8c4e8704f989f569359671b692d21360ff2dbca9f12c0bc16fe82286bca1b54d5b3ef9e9d5165cc2cd52ec54ad4983606a57e63dbdd38429a0a5b7a402a2e12f6a24a6d1507348daa3760e9b343573935cd6e65c1797c5164d2da4a6ce9a8bed052d86a96f2417ac4b55c409823baed81ca9f999e2220df255b772321b1931bb308188c6d952bd331f2c0b3c814d27b100370af528c1052756c2b140ff7ad95f7855f6ee49de720d21d1a4659aa237ee85e9b8e64855ef0d0ccee19f579b3448330d44ec7d9bb8bc8961a9c8ae8933ab02deb669955f8b765b3cba7c2c6c64a203a1af61d2020638aecce1cf00d9ba3033cb440433247d655d5167f19f09f6a33c9d7e63cc123b15ff1ab9159760067d17c44f640a2385685eb8130eeca73b26b22b7c336f076b2aa82e3a809a68915d3bd353a41b077910253eeae83e44cc6bad20e6c2cd782c16df37843332b81badfdeaf9b9653abfa6eaa9d5861acca1f020b0ea0e82f7df94be0f88c253a39ba47654470b3b778985b363bb1141347a58fbf423001d2ca92749a01637230369a99516db0e8c3750019e641a24c6c5fc34bf8520e770be31d150159ae14d88e3e51b9c583c42618e8f8e4dc415da0c89c5294f883d3a716bf5aaa12301c86b64efe08bf148b16c8de236166c7da075f50118e452c8d6b8d6aad7e89abbfe058cbcd982c3df3bfd87081f58fd5ffccd75d4e0907cd8d92f629a689c03c03d45b3c483ca9dfe4477ef6f04c1ed01ef1a247e71ec21cd2d37a8effa448f34a525f23d42e389e487732e0a6ffa3d8768dcfb958dd61af789369edd64b519e51b5d367177d1a4faa532046ef3c1be8c338cd8a8fc84eef2435ba3f53d5c5f67582e2ca01ddc59db3b8eb94e7ce196456408f1f6e3703d1d22973a56d89fb8685ac595e5afe231e0d4a15649cd004519da0532d3ce3ce82b82d511f477ad004e593959590ba6e2387e35d57ffef5bb687cd876e913a146c761590edae55357475189e4a66e23e96a604764c0ac1cd43e1bf92794706851ca9a6f9fad0f4153edcbc826f63923da7b8adbe02d6d88299936d8650511cf700dbdad0aa8dac3be970134bbfabd9877c52ec93d6f694a3c5a5b728ee6d2c8b61b9afc3479d0ad899b8b23c5265c2856b72cb9ae032cb5c1bba109c8f5def1455ce78eabddd650c93e60230d2e60d1da4e1c079bfc2ecca6b9ef1101730ef534710ce1470488acd656ed3909f06c4ce9f816c8c402ad516a4b0e9454dfcc9a10c9e3a6b8617db76131adf5662dca361458249ba85f95c287f7ac2730430596a4ff5800b73581513477d2f5b330bdc7f54d66417bfc9d4d331a1afb2a7909f5b464305ec9938f87b80f0c187dec3d5bad813feadfc13ea064997bcbe1e09a92230696096ead60c354f74184a3bcab4c76de02eb703e12296619b3c8fce67b590a4a39bcac3042076a772219be80a16a0cb36f4b3d99f69fd898a38bf9e54a45d6b13699bee7118c4c04c6bf616e72c310688727df6b903d2b2a118025de0baef02c70036385ecc771bfc02dc5a178a2d180596e97ca36d4afc60cd5f7edbeddaab47e7fa20498328ce4fea2d6843eacf479e9fc514cc575aec67011b77bdc8d19162fbeb8be463c850f7001d196c3557e983c12b1275bba3eca0da88bf403e52d9e8ec3780d15afa8a354e398a814a99049315c6eabf73fdd6704aa9dafb4acba39a90a36b858fcb58b49479c475663d1eff2e9ac467525cc1c18fd0f605c7b78cf197941b760f608be5e11b091c2cc73f7a8ec533baea5dd2efc745771f99378f8b314dfe8eb1278c0530c21088c5d92897f0f3bab26fe70e74f9803d222e7316d0d7d2623ec4de62a228831680833af36f89a596b04e5ca67fded54d2d7c38eabd726d5eface32af7f238775e01e5297b075031d10e1661a7982532d771e9af8e2e6317728df46bb1fbc7d0b48535a2d87dbbee0b4fd58ce8568c88a84cf4c78e761d7522fa4e1139ea363814a3324546cfddc2e57407f7271938f7b08808b16627e8f0887825f99eee1ad6ebc5de334aa52abfa7d9bc6897b45657a69d491a9c2b7961f758ce96cba10d9a0afc9da4d0016d0ce40ac347c31f9e2669e2672cb495ab4a29fdd75679127f2ad99671d39d6bc1d9d77ae8eeb5e58f54b62766cbcbf86022d48ce21daf23afa41539efe0df3a2f107d351f2d93bb7d862bfd40c2c2e849a3cb32de0d7cffcd85402dcf697158ec3e64c350e662f50468cbfb2c3a45406748ba2e58dc0ceba0aaff1e4ea290964764e71913fdddbfef1ef3b80c2f6337b48173d9788d83c156a6d4417e9c1eda6cfd0d11668d0f3cf5ad1af95ce6d9713ca3ff989bd953a8b8fbfb6b5d5d4fb65588055f257923ba101443c2945fb54a3363aface5c7b854dfda6f5259890bd4bfb2275c28eb0574e50894c96f92b2c9472f58d965a0673a8adb965392c304987dc5266d069507dc5989779816b4d48fba2c53208fd2b8c5f134eabe61ff68c747d3a6e43ba264229d732ebec40f6261e4ceee87238b43997d37695fb7b0fc28660c19146a4a2159c15f58c1f32889ea71e86879eaab76da58c5dd8ece30b5ab948f18f0fffa26790e2de1bba69f82eb99a49e5bcc0f4573a6962a976e24e33293a2f65f0c86d9804312a392974755a4763050f991d350eae0f7aa514a96ae727360a771495fdd1cc428c8bc73ebaa9c008fea5bf790b0986d5eb54ea993df74cba7a8e46203d640fc8ad2bef90934768c4535e98a1d6b5b326f1528ec0f67067b0471c50d8c5fdd87b74c5802e8b76fec31401cc8d9e7cd459a8dca6c48106eb7537f2d664ef7f4c333278a1b2139210e9fbf757e40803d156d2ca9dd5c84b1519fa05b18b6ecf1bca1bdf270c72651b7cf4bcbdeda907ff888390cf20eb58d218ca7aaf0bb4099f124d5b27a54db76895e64e8ab35eb2ff4cb5cf666c429f7f755f22bc1aecb1401c1a744ba83c660f5bd8def47790da5a4e7c4528f440b44c4711e874982f5d4c75cbd91633a1c4354682fd87dbbaa8925594c9272768184b4f4656f26258ece710cf4eb140d7ef7153f93857fc55eaaa105569825e54396da64523b425986b4003959e188efd346bc85d601c16fef77ebfca92061899f7cda735e48e668dc5a792628225750471b87eedee953904eb6845bf9caf521c2236cf942a7a9d715dc7a5f94eab145ba4c12b7eb1a06b9f6afefbe9e85e86ad88faa13ffe5eea1fb90525830c00993a6b815004b8522d00bcbcb2bf3177b7b9ce603de2b74b7e34f76878d52a99fa5d8fdbd79650d4b57f5cb74877867757eec593bb0cb6b7db21244b86b6372ab3a53e3234a7582fe7973bc49eb7f0943234a0d349ca2c992ac9baa18d2a68862f2a5ef12b3f842138c1b720c30bc75416063834f6e7c9a229e156ce97e1b40bbfc60f26d1d6d501a9d00e7934e9ac21bc9b812872e2f9280a53f6dd882c0fc38a8d0dd3b79bf1f4a87cc2d4a2bd0c8056b2167e9b2e5e2889bef328a8f8e4067b62e16ac2b6cf01c3652bd52247773b806c2bb7b2e60274930ac13df4c176db6a0bdc2b2575539375970833a30ae3d7d90b985f4ba9c4e1eddfaf339c17c988e1ce064d4e0fd89025afd2eff68811cd0709922bd86c5581282ad92831884f6ff33ea881744fbf34d9eb194111557bef1b01390503ca7cc5c424bb8fe9c129489afa0fbf8fb2649acfdf028b2e41541ce2feca483c3a58d39eb6b305d06def0d16a7402dc806780a3222b933352df9997187fc77cba5de8fd53250d97e2e337c91dd6ede1b45727d00ecd093845748104e4f358475f492ffee5b101a83b925545e12aaed0151d770c8d4be3549cd5504143ec944e5a0008a13f5c948a08bc330222af76cf198b629e3324158cd62201b7e93be30a129a9315aa04c3c946108b8036fed8fa0eb4e0eca8db4e1835e53d52fa36972705929793be0e70bc9411362d51d6760acabc5dbd0d55e5efe2e2dd222e99bbd73329e3f2dfb47654278ad86c188c21119b7019e9603831ee7ce27a17c156578259eba4cb637b2cf4a6ff0903abfc25473c57ae8553f13b769d21fafe613e4b0ff8e114eba88e4380e2a51ed475e701a5ce49c85d44b7365b511e5a6c6d5078e107f41e63f299b22085fb7f3e70153c41e2c8a93ff21f9994104a59b6b676129dac1fd4dae25386759cb720bb57c816a2bde148a972a2faed2844d57990ee5e4a72deb023a73764b6fb253842e733ff47479c1395bcb268c4477efe9366a5ffe54cb3ae00b39f0e93a716ddfe18dba8017862b5301592981164092b55384986062aa134852c15b3d0d9321d", 0x1000, 0x0, &(0x7f0000001040)={{0x3, @default, 0x15}, [@default, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) sendto$ax25(r0, &(0x7f0000000040)="c0ed350a1b750c34afcd507ab8e2d3b2b6d3f4f1b91265d8237d630aa500a8d366810889514481d4f676ca7412a29147c1b9b18dbd1def5e6161ed75335aaa8d50eed84e6879794fdaa2f090081f2e81558f257d24810684117698453a85e20f7e89999d4670373837059838e24f4b6ca0771dee399776d2eaa709b317ad4f879c9e89e11729778d91d67c521a33129bdb86652745a8f55ddc92602cd42a5050943da64a4f4cb18d8426e4fba3c4de969a24b1f7bb0b9a87ab717c2d0a5a227370bba35d48b407e9608b0badef5421576f327e94955866b04c2718eb87dbcf36be24ef7e4067e1bf3325df33df59e8efb335cb0386e5ef01859e8f23b3ba08c38218e0cf7cca9153eb8bc7a241c86e86d3f5cea39e6771d75468e1de1ad1eb2c7444a30e4fd6eb955b16b68bd8eb84d489cdc7819ca9b4e94fb22204e2afda0e47c0bdea7f6b0fbe84b878c345ece29b0a5a43070ea262dedc3f4df96ca6716b71d1db257cea26596f1ef154a3fa03369709de3019dd3d1161276b4ffb8a2de71486abcf903ae965009e2d696336345b2024d6ce8408d5d1e84b2bf02a84cd691282b9842477617eea3862b0325a93c992b03055dd05e6e027197bc4608308775a25709abb90caba68e4e53c47fc4bae2cadc36543cb00df1a8b6159a3ddf0471aacccebf5ed827da432a355461ce84eadc8d8d82eba4a81dd607be8f66a7e639c22ca856dddc2959b3742dd8fca3966341cbecf439db9ca3fb1d59cc6f808a767c6f06df64ef7442d0291ae75794eea94699c13b4b09903dfa450b3a179578658febf6e28ae98e39dcfbdbb69240a22e9cf098897c11a11ceb1de60a642e7a2893f655e7c1ad611ac2cb906db4059283e66c29538e1c34ad6d22896554bcd69b8a09330759ab234872c9b7df18cd2eea0c61469ec7f984bc6ee1360c40dc3844af9723f48fe58b073d8db3310580622f83700dd062afb72f5827d9c36146912522c4e76c6153e1ee6bf515d14abefa8ee7814aa313162b4627197fce99783e74cb58edb8fbb5991b696de7b8db579cccd7fd41294ea4b5e0f055f777f976c7c8c53132725e047cfa7c25b1eacd50019884e19859107656e0618654d38b23ea922d77907834a861a564b5fc5f1e84f78dae65a85c65dfe436b45ed198a44af0d0e84e8dd7a956fcc29bed7300c89680bbc2302465417b01d812cf3717571e78d3aca9e85532815059c9554202814c8bb9758e303c5eef22a798d0bd4d8c76ccd6de274116c23771e608d5d0182d92057367f212fda2a8401e6a9317e2dcc9b19af5db194d5fc3e1c033fb1594ca6a9cedf8d0080e1abdd34efc1d248da82c377f4d45d7dc82c846a91e6d62096394b011c305d685403279f45520f4ce84192042f9a47a4e51a97635390dbfb321ef2a40b238413e3658c41dde18708005a1f8c4e8704f989f569359671b692d21360ff2dbca9f12c0bc16fe82286bca1b54d5b3ef9e9d5165cc2cd52ec54ad4983606a57e63dbdd38429a0a5b7a402a2e12f6a24a6d1507348daa3760e9b343573935cd6e65c1797c5164d2da4a6ce9a8bed052d86a96f2417ac4b55c409823baed81ca9f999e2220df255b772321b1931bb308188c6d952bd331f2c0b3c814d27b100370af528c1052756c2b140ff7ad95f7855f6ee49de720d21d1a4659aa237ee85e9b8e64855ef0d0ccee19f579b3448330d44ec7d9bb8bc8961a9c8ae8933ab02deb669955f8b765b3cba7c2c6c64a203a1af61d2020638aecce1cf00d9ba3033cb440433247d655d5167f19f09f6a33c9d7e63cc123b15ff1ab9159760067d17c44f640a2385685eb8130eeca73b26b22b7c336f076b2aa82e3a809a68915d3bd353a41b077910253eeae83e44cc6bad20e6c2cd782c16df37843332b81badfdeaf9b9653abfa6eaa9d5861acca1f020b0ea0e82f7df94be0f88c253a39ba47654470b3b778985b363bb1141347a58fbf423001d2ca92749a01637230369a99516db0e8c3750019e641a24c6c5fc34bf8520e770be31d150159ae14d88e3e51b9c583c42618e8f8e4dc415da0c89c5294f883d3a716bf5aaa12301c86b64efe08bf148b16c8de236166c7da075f50118e452c8d6b8d6aad7e89abbfe058cbcd982c3df3bfd87081f58fd5ffccd75d4e0907cd8d92f629a689c03c03d45b3c483ca9dfe4477ef6f04c1ed01ef1a247e71ec21cd2d37a8effa448f34a525f23d42e389e487732e0a6ffa3d8768dcfb958dd61af789369edd64b519e51b5d367177d1a4faa532046ef3c1be8c338cd8a8fc84eef2435ba3f53d5c5f67582e2ca01ddc59db3b8eb94e7ce196456408f1f6e3703d1d22973a56d89fb8685ac595e5afe231e0d4a15649cd004519da0532d3ce3ce82b82d511f477ad004e593959590ba6e2387e35d57ffef5bb687cd876e913a146c761590edae55357475189e4a66e23e96a604764c0ac1cd43e1bf92794706851ca9a6f9fad0f4153edcbc826f63923da7b8adbe02d6d88299936d8650511cf700dbdad0aa8dac3be970134bbfabd9877c52ec93d6f694a3c5a5b728ee6d2c8b61b9afc3479d0ad899b8b23c5265c2856b72cb9ae032cb5c1bba109c8f5def1455ce78eabddd650c93e60230d2e60d1da4e1c079bfc2ecca6b9ef1101730ef534710ce1470488acd656ed3909f06c4ce9f816c8c402ad516a4b0e9454dfcc9a10c9e3a6b8617db76131adf5662dca361458249ba85f95c287f7ac2730430596a4ff5800b73581513477d2f5b330bdc7f54d66417bfc9d4d331a1afb2a7909f5b464305ec9938f87b80f0c187dec3d5bad813feadfc13ea064997bcbe1e09a92230696096ead60c354f74184a3bcab4c76de02eb703e12296619b3c8fce67b590a4a39bcac3042076a772219be80a16a0cb36f4b3d99f69fd898a38bf9e54a45d6b13699bee7118c4c04c6bf616e72c310688727df6b903d2b2a118025de0baef02c70036385ecc771bfc02dc5a178a2d180596e97ca36d4afc60cd5f7edbeddaab47e7fa20498328ce4fea2d6843eacf479e9fc514cc575aec67011b77bdc8d19162fbeb8be463c850f7001d196c3557e983c12b1275bba3eca0da88bf403e52d9e8ec3780d15afa8a354e398a814a99049315c6eabf73fdd6704aa9dafb4acba39a90a36b858fcb58b49479c475663d1eff2e9ac467525cc1c18fd0f605c7b78cf197941b760f608be5e11b091c2cc73f7a8ec533baea5dd2efc745771f99378f8b314dfe8eb1278c0530c21088c5d92897f0f3bab26fe70e74f9803d222e7316d0d7d2623ec4de62a228831680833af36f89a596b04e5ca67fded54d2d7c38eabd726d5eface32af7f238775e01e5297b075031d10e1661a7982532d771e9af8e2e6317728df46bb1fbc7d0b48535a2d87dbbee0b4fd58ce8568c88a84cf4c78e761d7522fa4e1139ea363814a3324546cfddc2e57407f7271938f7b08808b16627e8f0887825f99eee1ad6ebc5de334aa52abfa7d9bc6897b45657a69d491a9c2b7961f758ce96cba10d9a0afc9da4d0016d0ce40ac347c31f9e2669e2672cb495ab4a29fdd75679127f2ad99671d39d6bc1d9d77ae8eeb5e58f54b62766cbcbf86022d48ce21daf23afa41539efe0df3a2f107d351f2d93bb7d862bfd40c2c2e849a3cb32de0d7cffcd85402dcf697158ec3e64c350e662f50468cbfb2c3a45406748ba2e58dc0ceba0aaff1e4ea290964764e71913fdddbfef1ef3b80c2f6337b48173d9788d83c156a6d4417e9c1eda6cfd0d11668d0f3cf5ad1af95ce6d9713ca3ff989bd953a8b8fbfb6b5d5d4fb65588055f257923ba101443c2945fb54a3363aface5c7b854dfda6f5259890bd4bfb2275c28eb0574e50894c96f92b2c9472f58d965a0673a8adb965392c304987dc5266d069507dc5989779816b4d48fba2c53208fd2b8c5f134eabe61ff68c747d3a6e43ba264229d732ebec40f6261e4ceee87238b43997d37695fb7b0fc28660c19146a4a2159c15f58c1f32889ea71e86879eaab76da58c5dd8ece30b5ab948f18f0fffa26790e2de1bba69f82eb99a49e5bcc0f4573a6962a976e24e33293a2f65f0c86d9804312a392974755a4763050f991d350eae0f7aa514a96ae727360a771495fdd1cc428c8bc73ebaa9c008fea5bf790b0986d5eb54ea993df74cba7a8e46203d640fc8ad2bef90934768c4535e98a1d6b5b326f1528ec0f67067b0471c50d8c5fdd87b74c5802e8b76fec31401cc8d9e7cd459a8dca6c48106eb7537f2d664ef7f4c333278a1b2139210e9fbf757e40803d156d2ca9dd5c84b1519fa05b18b6ecf1bca1bdf270c72651b7cf4bcbdeda907ff888390cf20eb58d218ca7aaf0bb4099f124d5b27a54db76895e64e8ab35eb2ff4cb5cf666c429f7f755f22bc1aecb1401c1a744ba83c660f5bd8def47790da5a4e7c4528f440b44c4711e874982f5d4c75cbd91633a1c4354682fd87dbbaa8925594c9272768184b4f4656f26258ece710cf4eb140d7ef7153f93857fc55eaaa105569825e54396da64523b425986b4003959e188efd346bc85d601c16fef77ebfca92061899f7cda735e48e668dc5a792628225750471b87eedee953904eb6845bf9caf521c2236cf942a7a9d715dc7a5f94eab145ba4c12b7eb1a06b9f6afefbe9e85e86ad88faa13ffe5eea1fb90525830c00993a6b815004b8522d00bcbcb2bf3177b7b9ce603de2b74b7e34f76878d52a99fa5d8fdbd79650d4b57f5cb74877867757eec593bb0cb6b7db21244b86b6372ab3a53e3234a7582fe7973bc49eb7f0943234a0d349ca2c992ac9baa18d2a68862f2a5ef12b3f842138c1b720c30bc75416063834f6e7c9a229e156ce97e1b40bbfc60f26d1d6d501a9d00e7934e9ac21bc9b812872e2f9280a53f6dd882c0fc38a8d0dd3b79bf1f4a87cc2d4a2bd0c8056b2167e9b2e5e2889bef328a8f8e4067b62e16ac2b6cf01c3652bd52247773b806c2bb7b2e60274930ac13df4c176db6a0bdc2b2575539375970833a30ae3d7d90b985f4ba9c4e1eddfaf339c17c988e1ce064d4e0fd89025afd2eff68811cd0709922bd86c5581282ad92831884f6ff33ea881744fbf34d9eb194111557bef1b01390503ca7cc5c424bb8fe9c129489afa0fbf8fb2649acfdf028b2e41541ce2feca483c3a58d39eb6b305d06def0d16a7402dc806780a3222b933352df9997187fc77cba5de8fd53250d97e2e337c91dd6ede1b45727d00ecd093845748104e4f358475f492ffee5b101a83b925545e12aaed0151d770c8d4be3549cd5504143ec944e5a0008a13f5c948a08bc330222af76cf198b629e3324158cd62201b7e93be30a129a9315aa04c3c946108b8036fed8fa0eb4e0eca8db4e1835e53d52fa36972705929793be0e70bc9411362d51d6760acabc5dbd0d55e5efe2e2dd222e99bbd73329e3f2dfb47654278ad86c188c21119b7019e9603831ee7ce27a17c156578259eba4cb637b2cf4a6ff0903abfc25473c57ae8553f13b769d21fafe613e4b0ff8e114eba88e4380e2a51ed475e701a5ce49c85d44b7365b511e5a6c6d5078e107f41e63f299b22085fb7f3e70153c41e2c8a93ff21f9994104a59b6b676129dac1fd4dae25386759cb720bb57c816a2bde148a972a2faed2844d57990ee5e4a72deb023a73764b6fb253842e733ff47479c1395bcb268c4477efe9366a5ffe54cb3ae00b39f0e93a716ddfe18dba8017862b5301592981164092b55384986062aa134852c15b3d0d9321d", 0x1000, 0x0, &(0x7f0000001040)={{0x3, @default, 0x15}, [@default, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) (async) 14:08:01 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="e4d439746b96ac767460c6bdbb"], 0xa) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="e4d439746b96ac767460c6bdbb"], 0xa) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:08:01 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000300)={'gretap0\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x8, 0x8, 0x4, 0x8, {{0x9, 0x4, 0x2, 0x22, 0x24, 0x8000, 0x0, 0xfa, 0x4, 0x0, @remote, @empty, {[@rr={0x7, 0xf, 0x5a, [@multicast1, @multicast2, @local]}]}}}}}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r3, 0x0, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r4, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xb, 0x8000, 0x3, 0xa231, 0x80, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x1}, 0x48) r6 = openat$mice(0xffffffffffffff9c, &(0x7f0000000440), 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xa, &(0x7f0000000180)=@raw=[@map_idx={0x18, 0x7, 0x5, 0x0, 0xd}, @initr0={0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x2}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0xb, 0x0, 0x0, 0x0, 0x4fa0d0d2}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xffffffffffffffff}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x10}], &(0x7f0000000080)='GPL\x00', 0x1ff, 0x75, &(0x7f0000000200)=""/117, 0x40f00, 0x10, '\x00', r2, 0x0, r3, 0x8, &(0x7f0000000340)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000380)={0x2, 0xe, 0x4, 0x7}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000480)=[r4, r5, 0xffffffffffffffff, r6]}, 0x80) accept4$unix(r1, &(0x7f0000000100)=@abs, &(0x7f0000000000)=0x6e, 0x80000) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = accept$ax25(0xffffffffffffffff, &(0x7f00000004c0)={{0x3, @netrom}, [@bcast, @null, @null, @bcast, @bcast, @default]}, &(0x7f00000000c0)=0x6878d0c49e397fdf) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f00000001c0)={0x3, @default, r2}) getresuid(&(0x7f00000003c0), &(0x7f0000000400)=0x0, &(0x7f0000000440)) ioctl$SIOCAX25ADDUID(r1, 0x89e1, &(0x7f0000000480)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, r3}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x1, r0, 0x4}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x22202) write$bt_hci(r4, &(0x7f0000000240)=ANY=[@ANYBLOB="53409069cfeeb00035c781136ed666f6901e2f07a99fcb51bb357e3d00fa584e1a2d98426f76b375a0215905bf1b2580640ad954b5be0798486e0e6104d67a41d6910bb57716f7b71e9a840b29ec0365c09757e8d23dd84d423d3cc46b8c39b89f036e6c59fed1d4d6fc846d3d615aded56ac27ae3dc4931f7a0f7325d8f27d80430a17109a97516bb0f198e00be8a690f303c20f6b22e03c1b96c406013b027dc7baabda14e5bc6b99d284d613fb52662a8136adb4972e977cd79403509e389a756e11e7cad065eaa6ba418769b6e40763126cc7af88417fe1c7c0ac4db12c626c513c91b1abb06b18b0c3c8389994e7959dee46aa5b3efe834dc48ccd7dbe09928"], 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r4, 0x0, 0x1, &(0x7f0000000200), 0x4) 14:08:01 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)="331f1a704c0421c6e716f9e5ed2b7e0f7cec5dd0c60e19d87df6db73cc97a8c63fe2c814631a9bc7865686a97400971f1e36cb7ecc17056263acb29228a6507c6cf19bad6f4c352fee8d9476b9e634433525644d2ed89e7c656c6087e79270f2dc4a96ac09ac3af628a3a2329687129146b7857b461ac1969372e3578b131fdb2fa77b65d8a2e84554b96ead8d86c56c81e8cc09f98ac0f13ac4ebff39871203b3fee41db7e7f1aa9d474eaf1123a8487cdac5db43d9c1e10138f0edb3f5dd2213ca89bac8aa608d662657283393c572f292c8f55c79fa08f68113a066f64fc110d97f84") 14:08:01 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) sendto$ax25(r0, &(0x7f0000000040)="c0ed350a1b750c34afcd507ab8e2d3b2b6d3f4f1b91265d8237d630aa500a8d366810889514481d4f676ca7412a29147c1b9b18dbd1def5e6161ed75335aaa8d50eed84e6879794fdaa2f090081f2e81558f257d24810684117698453a85e20f7e89999d4670373837059838e24f4b6ca0771dee399776d2eaa709b317ad4f879c9e89e11729778d91d67c521a33129bdb86652745a8f55ddc92602cd42a5050943da64a4f4cb18d8426e4fba3c4de969a24b1f7bb0b9a87ab717c2d0a5a227370bba35d48b407e9608b0badef5421576f327e94955866b04c2718eb87dbcf36be24ef7e4067e1bf3325df33df59e8efb335cb0386e5ef01859e8f23b3ba08c38218e0cf7cca9153eb8bc7a241c86e86d3f5cea39e6771d75468e1de1ad1eb2c7444a30e4fd6eb955b16b68bd8eb84d489cdc7819ca9b4e94fb22204e2afda0e47c0bdea7f6b0fbe84b878c345ece29b0a5a43070ea262dedc3f4df96ca6716b71d1db257cea26596f1ef154a3fa03369709de3019dd3d1161276b4ffb8a2de71486abcf903ae965009e2d696336345b2024d6ce8408d5d1e84b2bf02a84cd691282b9842477617eea3862b0325a93c992b03055dd05e6e027197bc4608308775a25709abb90caba68e4e53c47fc4bae2cadc36543cb00df1a8b6159a3ddf0471aacccebf5ed827da432a355461ce84eadc8d8d82eba4a81dd607be8f66a7e639c22ca856dddc2959b3742dd8fca3966341cbecf439db9ca3fb1d59cc6f808a767c6f06df64ef7442d0291ae75794eea94699c13b4b09903dfa450b3a179578658febf6e28ae98e39dcfbdbb69240a22e9cf098897c11a11ceb1de60a642e7a2893f655e7c1ad611ac2cb906db4059283e66c29538e1c34ad6d22896554bcd69b8a09330759ab234872c9b7df18cd2eea0c61469ec7f984bc6ee1360c40dc3844af9723f48fe58b073d8db3310580622f83700dd062afb72f5827d9c36146912522c4e76c6153e1ee6bf515d14abefa8ee7814aa313162b4627197fce99783e74cb58edb8fbb5991b696de7b8db579cccd7fd41294ea4b5e0f055f777f976c7c8c53132725e047cfa7c25b1eacd50019884e19859107656e0618654d38b23ea922d77907834a861a564b5fc5f1e84f78dae65a85c65dfe436b45ed198a44af0d0e84e8dd7a956fcc29bed7300c89680bbc2302465417b01d812cf3717571e78d3aca9e85532815059c9554202814c8bb9758e303c5eef22a798d0bd4d8c76ccd6de274116c23771e608d5d0182d92057367f212fda2a8401e6a9317e2dcc9b19af5db194d5fc3e1c033fb1594ca6a9cedf8d0080e1abdd34efc1d248da82c377f4d45d7dc82c846a91e6d62096394b011c305d685403279f45520f4ce84192042f9a47a4e51a97635390dbfb321ef2a40b238413e3658c41dde18708005a1f8c4e8704f989f569359671b692d21360ff2dbca9f12c0bc16fe82286bca1b54d5b3ef9e9d5165cc2cd52ec54ad4983606a57e63dbdd38429a0a5b7a402a2e12f6a24a6d1507348daa3760e9b343573935cd6e65c1797c5164d2da4a6ce9a8bed052d86a96f2417ac4b55c409823baed81ca9f999e2220df255b772321b1931bb308188c6d952bd331f2c0b3c814d27b100370af528c1052756c2b140ff7ad95f7855f6ee49de720d21d1a4659aa237ee85e9b8e64855ef0d0ccee19f579b3448330d44ec7d9bb8bc8961a9c8ae8933ab02deb669955f8b765b3cba7c2c6c64a203a1af61d2020638aecce1cf00d9ba3033cb440433247d655d5167f19f09f6a33c9d7e63cc123b15ff1ab9159760067d17c44f640a2385685eb8130eeca73b26b22b7c336f076b2aa82e3a809a68915d3bd353a41b077910253eeae83e44cc6bad20e6c2cd782c16df37843332b81badfdeaf9b9653abfa6eaa9d5861acca1f020b0ea0e82f7df94be0f88c253a39ba47654470b3b778985b363bb1141347a58fbf423001d2ca92749a01637230369a99516db0e8c3750019e641a24c6c5fc34bf8520e770be31d150159ae14d88e3e51b9c583c42618e8f8e4dc415da0c89c5294f883d3a716bf5aaa12301c86b64efe08bf148b16c8de236166c7da075f50118e452c8d6b8d6aad7e89abbfe058cbcd982c3df3bfd87081f58fd5ffccd75d4e0907cd8d92f629a689c03c03d45b3c483ca9dfe4477ef6f04c1ed01ef1a247e71ec21cd2d37a8effa448f34a525f23d42e389e487732e0a6ffa3d8768dcfb958dd61af789369edd64b519e51b5d367177d1a4faa532046ef3c1be8c338cd8a8fc84eef2435ba3f53d5c5f67582e2ca01ddc59db3b8eb94e7ce196456408f1f6e3703d1d22973a56d89fb8685ac595e5afe231e0d4a15649cd004519da0532d3ce3ce82b82d511f477ad004e593959590ba6e2387e35d57ffef5bb687cd876e913a146c761590edae55357475189e4a66e23e96a604764c0ac1cd43e1bf92794706851ca9a6f9fad0f4153edcbc826f63923da7b8adbe02d6d88299936d8650511cf700dbdad0aa8dac3be970134bbfabd9877c52ec93d6f694a3c5a5b728ee6d2c8b61b9afc3479d0ad899b8b23c5265c2856b72cb9ae032cb5c1bba109c8f5def1455ce78eabddd650c93e60230d2e60d1da4e1c079bfc2ecca6b9ef1101730ef534710ce1470488acd656ed3909f06c4ce9f816c8c402ad516a4b0e9454dfcc9a10c9e3a6b8617db76131adf5662dca361458249ba85f95c287f7ac2730430596a4ff5800b73581513477d2f5b330bdc7f54d66417bfc9d4d331a1afb2a7909f5b464305ec9938f87b80f0c187dec3d5bad813feadfc13ea064997bcbe1e09a92230696096ead60c354f74184a3bcab4c76de02eb703e12296619b3c8fce67b590a4a39bcac3042076a772219be80a16a0cb36f4b3d99f69fd898a38bf9e54a45d6b13699bee7118c4c04c6bf616e72c310688727df6b903d2b2a118025de0baef02c70036385ecc771bfc02dc5a178a2d180596e97ca36d4afc60cd5f7edbeddaab47e7fa20498328ce4fea2d6843eacf479e9fc514cc575aec67011b77bdc8d19162fbeb8be463c850f7001d196c3557e983c12b1275bba3eca0da88bf403e52d9e8ec3780d15afa8a354e398a814a99049315c6eabf73fdd6704aa9dafb4acba39a90a36b858fcb58b49479c475663d1eff2e9ac467525cc1c18fd0f605c7b78cf197941b760f608be5e11b091c2cc73f7a8ec533baea5dd2efc745771f99378f8b314dfe8eb1278c0530c21088c5d92897f0f3bab26fe70e74f9803d222e7316d0d7d2623ec4de62a228831680833af36f89a596b04e5ca67fded54d2d7c38eabd726d5eface32af7f238775e01e5297b075031d10e1661a7982532d771e9af8e2e6317728df46bb1fbc7d0b48535a2d87dbbee0b4fd58ce8568c88a84cf4c78e761d7522fa4e1139ea363814a3324546cfddc2e57407f7271938f7b08808b16627e8f0887825f99eee1ad6ebc5de334aa52abfa7d9bc6897b45657a69d491a9c2b7961f758ce96cba10d9a0afc9da4d0016d0ce40ac347c31f9e2669e2672cb495ab4a29fdd75679127f2ad99671d39d6bc1d9d77ae8eeb5e58f54b62766cbcbf86022d48ce21daf23afa41539efe0df3a2f107d351f2d93bb7d862bfd40c2c2e849a3cb32de0d7cffcd85402dcf697158ec3e64c350e662f50468cbfb2c3a45406748ba2e58dc0ceba0aaff1e4ea290964764e71913fdddbfef1ef3b80c2f6337b48173d9788d83c156a6d4417e9c1eda6cfd0d11668d0f3cf5ad1af95ce6d9713ca3ff989bd953a8b8fbfb6b5d5d4fb65588055f257923ba101443c2945fb54a3363aface5c7b854dfda6f5259890bd4bfb2275c28eb0574e50894c96f92b2c9472f58d965a0673a8adb965392c304987dc5266d069507dc5989779816b4d48fba2c53208fd2b8c5f134eabe61ff68c747d3a6e43ba264229d732ebec40f6261e4ceee87238b43997d37695fb7b0fc28660c19146a4a2159c15f58c1f32889ea71e86879eaab76da58c5dd8ece30b5ab948f18f0fffa26790e2de1bba69f82eb99a49e5bcc0f4573a6962a976e24e33293a2f65f0c86d9804312a392974755a4763050f991d350eae0f7aa514a96ae727360a771495fdd1cc428c8bc73ebaa9c008fea5bf790b0986d5eb54ea993df74cba7a8e46203d640fc8ad2bef90934768c4535e98a1d6b5b326f1528ec0f67067b0471c50d8c5fdd87b74c5802e8b76fec31401cc8d9e7cd459a8dca6c48106eb7537f2d664ef7f4c333278a1b2139210e9fbf757e40803d156d2ca9dd5c84b1519fa05b18b6ecf1bca1bdf270c72651b7cf4bcbdeda907ff888390cf20eb58d218ca7aaf0bb4099f124d5b27a54db76895e64e8ab35eb2ff4cb5cf666c429f7f755f22bc1aecb1401c1a744ba83c660f5bd8def47790da5a4e7c4528f440b44c4711e874982f5d4c75cbd91633a1c4354682fd87dbbaa8925594c9272768184b4f4656f26258ece710cf4eb140d7ef7153f93857fc55eaaa105569825e54396da64523b425986b4003959e188efd346bc85d601c16fef77ebfca92061899f7cda735e48e668dc5a792628225750471b87eedee953904eb6845bf9caf521c2236cf942a7a9d715dc7a5f94eab145ba4c12b7eb1a06b9f6afefbe9e85e86ad88faa13ffe5eea1fb90525830c00993a6b815004b8522d00bcbcb2bf3177b7b9ce603de2b74b7e34f76878d52a99fa5d8fdbd79650d4b57f5cb74877867757eec593bb0cb6b7db21244b86b6372ab3a53e3234a7582fe7973bc49eb7f0943234a0d349ca2c992ac9baa18d2a68862f2a5ef12b3f842138c1b720c30bc75416063834f6e7c9a229e156ce97e1b40bbfc60f26d1d6d501a9d00e7934e9ac21bc9b812872e2f9280a53f6dd882c0fc38a8d0dd3b79bf1f4a87cc2d4a2bd0c8056b2167e9b2e5e2889bef328a8f8e4067b62e16ac2b6cf01c3652bd52247773b806c2bb7b2e60274930ac13df4c176db6a0bdc2b2575539375970833a30ae3d7d90b985f4ba9c4e1eddfaf339c17c988e1ce064d4e0fd89025afd2eff68811cd0709922bd86c5581282ad92831884f6ff33ea881744fbf34d9eb194111557bef1b01390503ca7cc5c424bb8fe9c129489afa0fbf8fb2649acfdf028b2e41541ce2feca483c3a58d39eb6b305d06def0d16a7402dc806780a3222b933352df9997187fc77cba5de8fd53250d97e2e337c91dd6ede1b45727d00ecd093845748104e4f358475f492ffee5b101a83b925545e12aaed0151d770c8d4be3549cd5504143ec944e5a0008a13f5c948a08bc330222af76cf198b629e3324158cd62201b7e93be30a129a9315aa04c3c946108b8036fed8fa0eb4e0eca8db4e1835e53d52fa36972705929793be0e70bc9411362d51d6760acabc5dbd0d55e5efe2e2dd222e99bbd73329e3f2dfb47654278ad86c188c21119b7019e9603831ee7ce27a17c156578259eba4cb637b2cf4a6ff0903abfc25473c57ae8553f13b769d21fafe613e4b0ff8e114eba88e4380e2a51ed475e701a5ce49c85d44b7365b511e5a6c6d5078e107f41e63f299b22085fb7f3e70153c41e2c8a93ff21f9994104a59b6b676129dac1fd4dae25386759cb720bb57c816a2bde148a972a2faed2844d57990ee5e4a72deb023a73764b6fb253842e733ff47479c1395bcb268c4477efe9366a5ffe54cb3ae00b39f0e93a716ddfe18dba8017862b5301592981164092b55384986062aa134852c15b3d0d9321d", 0x1000, 0x0, &(0x7f0000001040)={{0x3, @default, 0x15}, [@default, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) sendto$ax25(r0, &(0x7f0000000040)="c0ed350a1b750c34afcd507ab8e2d3b2b6d3f4f1b91265d8237d630aa500a8d366810889514481d4f676ca7412a29147c1b9b18dbd1def5e6161ed75335aaa8d50eed84e6879794fdaa2f090081f2e81558f257d24810684117698453a85e20f7e89999d4670373837059838e24f4b6ca0771dee399776d2eaa709b317ad4f879c9e89e11729778d91d67c521a33129bdb86652745a8f55ddc92602cd42a5050943da64a4f4cb18d8426e4fba3c4de969a24b1f7bb0b9a87ab717c2d0a5a227370bba35d48b407e9608b0badef5421576f327e94955866b04c2718eb87dbcf36be24ef7e4067e1bf3325df33df59e8efb335cb0386e5ef01859e8f23b3ba08c38218e0cf7cca9153eb8bc7a241c86e86d3f5cea39e6771d75468e1de1ad1eb2c7444a30e4fd6eb955b16b68bd8eb84d489cdc7819ca9b4e94fb22204e2afda0e47c0bdea7f6b0fbe84b878c345ece29b0a5a43070ea262dedc3f4df96ca6716b71d1db257cea26596f1ef154a3fa03369709de3019dd3d1161276b4ffb8a2de71486abcf903ae965009e2d696336345b2024d6ce8408d5d1e84b2bf02a84cd691282b9842477617eea3862b0325a93c992b03055dd05e6e027197bc4608308775a25709abb90caba68e4e53c47fc4bae2cadc36543cb00df1a8b6159a3ddf0471aacccebf5ed827da432a355461ce84eadc8d8d82eba4a81dd607be8f66a7e639c22ca856dddc2959b3742dd8fca3966341cbecf439db9ca3fb1d59cc6f808a767c6f06df64ef7442d0291ae75794eea94699c13b4b09903dfa450b3a179578658febf6e28ae98e39dcfbdbb69240a22e9cf098897c11a11ceb1de60a642e7a2893f655e7c1ad611ac2cb906db4059283e66c29538e1c34ad6d22896554bcd69b8a09330759ab234872c9b7df18cd2eea0c61469ec7f984bc6ee1360c40dc3844af9723f48fe58b073d8db3310580622f83700dd062afb72f5827d9c36146912522c4e76c6153e1ee6bf515d14abefa8ee7814aa313162b4627197fce99783e74cb58edb8fbb5991b696de7b8db579cccd7fd41294ea4b5e0f055f777f976c7c8c53132725e047cfa7c25b1eacd50019884e19859107656e0618654d38b23ea922d77907834a861a564b5fc5f1e84f78dae65a85c65dfe436b45ed198a44af0d0e84e8dd7a956fcc29bed7300c89680bbc2302465417b01d812cf3717571e78d3aca9e85532815059c9554202814c8bb9758e303c5eef22a798d0bd4d8c76ccd6de274116c23771e608d5d0182d92057367f212fda2a8401e6a9317e2dcc9b19af5db194d5fc3e1c033fb1594ca6a9cedf8d0080e1abdd34efc1d248da82c377f4d45d7dc82c846a91e6d62096394b011c305d685403279f45520f4ce84192042f9a47a4e51a97635390dbfb321ef2a40b238413e3658c41dde18708005a1f8c4e8704f989f569359671b692d21360ff2dbca9f12c0bc16fe82286bca1b54d5b3ef9e9d5165cc2cd52ec54ad4983606a57e63dbdd38429a0a5b7a402a2e12f6a24a6d1507348daa3760e9b343573935cd6e65c1797c5164d2da4a6ce9a8bed052d86a96f2417ac4b55c409823baed81ca9f999e2220df255b772321b1931bb308188c6d952bd331f2c0b3c814d27b100370af528c1052756c2b140ff7ad95f7855f6ee49de720d21d1a4659aa237ee85e9b8e64855ef0d0ccee19f579b3448330d44ec7d9bb8bc8961a9c8ae8933ab02deb669955f8b765b3cba7c2c6c64a203a1af61d2020638aecce1cf00d9ba3033cb440433247d655d5167f19f09f6a33c9d7e63cc123b15ff1ab9159760067d17c44f640a2385685eb8130eeca73b26b22b7c336f076b2aa82e3a809a68915d3bd353a41b077910253eeae83e44cc6bad20e6c2cd782c16df37843332b81badfdeaf9b9653abfa6eaa9d5861acca1f020b0ea0e82f7df94be0f88c253a39ba47654470b3b778985b363bb1141347a58fbf423001d2ca92749a01637230369a99516db0e8c3750019e641a24c6c5fc34bf8520e770be31d150159ae14d88e3e51b9c583c42618e8f8e4dc415da0c89c5294f883d3a716bf5aaa12301c86b64efe08bf148b16c8de236166c7da075f50118e452c8d6b8d6aad7e89abbfe058cbcd982c3df3bfd87081f58fd5ffccd75d4e0907cd8d92f629a689c03c03d45b3c483ca9dfe4477ef6f04c1ed01ef1a247e71ec21cd2d37a8effa448f34a525f23d42e389e487732e0a6ffa3d8768dcfb958dd61af789369edd64b519e51b5d367177d1a4faa532046ef3c1be8c338cd8a8fc84eef2435ba3f53d5c5f67582e2ca01ddc59db3b8eb94e7ce196456408f1f6e3703d1d22973a56d89fb8685ac595e5afe231e0d4a15649cd004519da0532d3ce3ce82b82d511f477ad004e593959590ba6e2387e35d57ffef5bb687cd876e913a146c761590edae55357475189e4a66e23e96a604764c0ac1cd43e1bf92794706851ca9a6f9fad0f4153edcbc826f63923da7b8adbe02d6d88299936d8650511cf700dbdad0aa8dac3be970134bbfabd9877c52ec93d6f694a3c5a5b728ee6d2c8b61b9afc3479d0ad899b8b23c5265c2856b72cb9ae032cb5c1bba109c8f5def1455ce78eabddd650c93e60230d2e60d1da4e1c079bfc2ecca6b9ef1101730ef534710ce1470488acd656ed3909f06c4ce9f816c8c402ad516a4b0e9454dfcc9a10c9e3a6b8617db76131adf5662dca361458249ba85f95c287f7ac2730430596a4ff5800b73581513477d2f5b330bdc7f54d66417bfc9d4d331a1afb2a7909f5b464305ec9938f87b80f0c187dec3d5bad813feadfc13ea064997bcbe1e09a92230696096ead60c354f74184a3bcab4c76de02eb703e12296619b3c8fce67b590a4a39bcac3042076a772219be80a16a0cb36f4b3d99f69fd898a38bf9e54a45d6b13699bee7118c4c04c6bf616e72c310688727df6b903d2b2a118025de0baef02c70036385ecc771bfc02dc5a178a2d180596e97ca36d4afc60cd5f7edbeddaab47e7fa20498328ce4fea2d6843eacf479e9fc514cc575aec67011b77bdc8d19162fbeb8be463c850f7001d196c3557e983c12b1275bba3eca0da88bf403e52d9e8ec3780d15afa8a354e398a814a99049315c6eabf73fdd6704aa9dafb4acba39a90a36b858fcb58b49479c475663d1eff2e9ac467525cc1c18fd0f605c7b78cf197941b760f608be5e11b091c2cc73f7a8ec533baea5dd2efc745771f99378f8b314dfe8eb1278c0530c21088c5d92897f0f3bab26fe70e74f9803d222e7316d0d7d2623ec4de62a228831680833af36f89a596b04e5ca67fded54d2d7c38eabd726d5eface32af7f238775e01e5297b075031d10e1661a7982532d771e9af8e2e6317728df46bb1fbc7d0b48535a2d87dbbee0b4fd58ce8568c88a84cf4c78e761d7522fa4e1139ea363814a3324546cfddc2e57407f7271938f7b08808b16627e8f0887825f99eee1ad6ebc5de334aa52abfa7d9bc6897b45657a69d491a9c2b7961f758ce96cba10d9a0afc9da4d0016d0ce40ac347c31f9e2669e2672cb495ab4a29fdd75679127f2ad99671d39d6bc1d9d77ae8eeb5e58f54b62766cbcbf86022d48ce21daf23afa41539efe0df3a2f107d351f2d93bb7d862bfd40c2c2e849a3cb32de0d7cffcd85402dcf697158ec3e64c350e662f50468cbfb2c3a45406748ba2e58dc0ceba0aaff1e4ea290964764e71913fdddbfef1ef3b80c2f6337b48173d9788d83c156a6d4417e9c1eda6cfd0d11668d0f3cf5ad1af95ce6d9713ca3ff989bd953a8b8fbfb6b5d5d4fb65588055f257923ba101443c2945fb54a3363aface5c7b854dfda6f5259890bd4bfb2275c28eb0574e50894c96f92b2c9472f58d965a0673a8adb965392c304987dc5266d069507dc5989779816b4d48fba2c53208fd2b8c5f134eabe61ff68c747d3a6e43ba264229d732ebec40f6261e4ceee87238b43997d37695fb7b0fc28660c19146a4a2159c15f58c1f32889ea71e86879eaab76da58c5dd8ece30b5ab948f18f0fffa26790e2de1bba69f82eb99a49e5bcc0f4573a6962a976e24e33293a2f65f0c86d9804312a392974755a4763050f991d350eae0f7aa514a96ae727360a771495fdd1cc428c8bc73ebaa9c008fea5bf790b0986d5eb54ea993df74cba7a8e46203d640fc8ad2bef90934768c4535e98a1d6b5b326f1528ec0f67067b0471c50d8c5fdd87b74c5802e8b76fec31401cc8d9e7cd459a8dca6c48106eb7537f2d664ef7f4c333278a1b2139210e9fbf757e40803d156d2ca9dd5c84b1519fa05b18b6ecf1bca1bdf270c72651b7cf4bcbdeda907ff888390cf20eb58d218ca7aaf0bb4099f124d5b27a54db76895e64e8ab35eb2ff4cb5cf666c429f7f755f22bc1aecb1401c1a744ba83c660f5bd8def47790da5a4e7c4528f440b44c4711e874982f5d4c75cbd91633a1c4354682fd87dbbaa8925594c9272768184b4f4656f26258ece710cf4eb140d7ef7153f93857fc55eaaa105569825e54396da64523b425986b4003959e188efd346bc85d601c16fef77ebfca92061899f7cda735e48e668dc5a792628225750471b87eedee953904eb6845bf9caf521c2236cf942a7a9d715dc7a5f94eab145ba4c12b7eb1a06b9f6afefbe9e85e86ad88faa13ffe5eea1fb90525830c00993a6b815004b8522d00bcbcb2bf3177b7b9ce603de2b74b7e34f76878d52a99fa5d8fdbd79650d4b57f5cb74877867757eec593bb0cb6b7db21244b86b6372ab3a53e3234a7582fe7973bc49eb7f0943234a0d349ca2c992ac9baa18d2a68862f2a5ef12b3f842138c1b720c30bc75416063834f6e7c9a229e156ce97e1b40bbfc60f26d1d6d501a9d00e7934e9ac21bc9b812872e2f9280a53f6dd882c0fc38a8d0dd3b79bf1f4a87cc2d4a2bd0c8056b2167e9b2e5e2889bef328a8f8e4067b62e16ac2b6cf01c3652bd52247773b806c2bb7b2e60274930ac13df4c176db6a0bdc2b2575539375970833a30ae3d7d90b985f4ba9c4e1eddfaf339c17c988e1ce064d4e0fd89025afd2eff68811cd0709922bd86c5581282ad92831884f6ff33ea881744fbf34d9eb194111557bef1b01390503ca7cc5c424bb8fe9c129489afa0fbf8fb2649acfdf028b2e41541ce2feca483c3a58d39eb6b305d06def0d16a7402dc806780a3222b933352df9997187fc77cba5de8fd53250d97e2e337c91dd6ede1b45727d00ecd093845748104e4f358475f492ffee5b101a83b925545e12aaed0151d770c8d4be3549cd5504143ec944e5a0008a13f5c948a08bc330222af76cf198b629e3324158cd62201b7e93be30a129a9315aa04c3c946108b8036fed8fa0eb4e0eca8db4e1835e53d52fa36972705929793be0e70bc9411362d51d6760acabc5dbd0d55e5efe2e2dd222e99bbd73329e3f2dfb47654278ad86c188c21119b7019e9603831ee7ce27a17c156578259eba4cb637b2cf4a6ff0903abfc25473c57ae8553f13b769d21fafe613e4b0ff8e114eba88e4380e2a51ed475e701a5ce49c85d44b7365b511e5a6c6d5078e107f41e63f299b22085fb7f3e70153c41e2c8a93ff21f9994104a59b6b676129dac1fd4dae25386759cb720bb57c816a2bde148a972a2faed2844d57990ee5e4a72deb023a73764b6fb253842e733ff47479c1395bcb268c4477efe9366a5ffe54cb3ae00b39f0e93a716ddfe18dba8017862b5301592981164092b55384986062aa134852c15b3d0d9321d", 0x1000, 0x0, &(0x7f0000001040)={{0x3, @default, 0x15}, [@default, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) (async) 14:08:01 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = accept$ax25(0xffffffffffffffff, &(0x7f00000004c0)={{0x3, @netrom}, [@bcast, @null, @null, @bcast, @bcast, @default]}, &(0x7f00000000c0)=0x6878d0c49e397fdf) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f00000001c0)={0x3, @default, r2}) (async) getresuid(&(0x7f00000003c0), &(0x7f0000000400)=0x0, &(0x7f0000000440)) ioctl$SIOCAX25ADDUID(r1, 0x89e1, &(0x7f0000000480)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, r3}) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x1, r0, 0x4}) (async, rerun: 64) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 64) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x22202) (async, rerun: 64) write$bt_hci(r4, &(0x7f0000000240)=ANY=[@ANYBLOB="53409069cfeeb00035c781136ed666f6901e2f07a99fcb51bb357e3d00fa584e1a2d98426f76b375a0215905bf1b2580640ad954b5be0798486e0e6104d67a41d6910bb57716f7b71e9a840b29ec0365c09757e8d23dd84d423d3cc46b8c39b89f036e6c59fed1d4d6fc846d3d615aded56ac27ae3dc4931f7a0f7325d8f27d80430a17109a97516bb0f198e00be8a690f303c20f6b22e03c1b96c406013b027dc7baabda14e5bc6b99d284d613fb52662a8136adb4972e977cd79403509e389a756e11e7cad065eaa6ba418769b6e40763126cc7af88417fe1c7c0ac4db12c626c513c91b1abb06b18b0c3c8389994e7959dee46aa5b3efe834dc48ccd7dbe09928"], 0x7) (async, rerun: 64) setsockopt$bt_hci_HCI_DATA_DIR(r4, 0x0, 0x1, &(0x7f0000000200), 0x4) 14:08:01 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$SNDCTL_MIDI_PRETIME(r1, 0xc0046d00, &(0x7f0000000000)=0x8) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) recvfrom$unix(r2, &(0x7f0000000080)=""/133, 0x85, 0x2, &(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e) 14:08:01 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000300)={'gretap0\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x8, 0x8, 0x4, 0x8, {{0x9, 0x4, 0x2, 0x22, 0x24, 0x8000, 0x0, 0xfa, 0x4, 0x0, @remote, @empty, {[@rr={0x7, 0xf, 0x5a, [@multicast1, @multicast2, @local]}]}}}}}) (async) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r3, 0x0, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r4, 0x0, 0x0) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xb, 0x8000, 0x3, 0xa231, 0x80, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x1}, 0x48) (async, rerun: 64) r6 = openat$mice(0xffffffffffffff9c, &(0x7f0000000440), 0x1) (rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xa, &(0x7f0000000180)=@raw=[@map_idx={0x18, 0x7, 0x5, 0x0, 0xd}, @initr0={0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x2}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0xb, 0x0, 0x0, 0x0, 0x4fa0d0d2}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xffffffffffffffff}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x10}], &(0x7f0000000080)='GPL\x00', 0x1ff, 0x75, &(0x7f0000000200)=""/117, 0x40f00, 0x10, '\x00', r2, 0x0, r3, 0x8, &(0x7f0000000340)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000380)={0x2, 0xe, 0x4, 0x7}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000480)=[r4, r5, 0xffffffffffffffff, r6]}, 0x80) accept4$unix(r1, &(0x7f0000000100)=@abs, &(0x7f0000000000)=0x6e, 0x80000) (async, rerun: 64) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 64) bind$bt_hci(r7, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x1b389e6108c3be47) 14:08:01 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$SNDCTL_MIDI_PRETIME(r1, 0xc0046d00, &(0x7f0000000000)=0x8) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) recvfrom$unix(r2, &(0x7f0000000080)=""/133, 0x85, 0x2, &(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e) 14:08:01 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:08:01 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) sendto$unix(r1, &(0x7f0000000080)="9323fe3be6b55ca2e47d99bd30f1e0e38a758b80472bfcf335b016dfc5132c0c82e46ee8d68dab02fe768f6e98a5876b275b4a0bd73a4fe0471d8d57f567bcdcfb41bd1587aac77843ec2f51006679e8ae24eb8bab1d36a6a4d30857b16f0dc3f6cbd2cb0a056b8ade8650a8fc4bda484b1b3314a2ff01cc181540ee92cbdeb1f281d34f3b6ab69694bd50c2aeb0b9a52f9967bac94a4aa87e471b6a5387b33c7483bccebdd85308281ac2f17023084ba8619be2173ad3a3ba4f0d7fe71a9b24a2adc1d1106950a6297361d2b726cc12efc51c7af47561", 0xd7, 0x810, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e20}, 0x6e) 14:08:01 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x1b389e6108c3be47) 14:08:01 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$SNDCTL_MIDI_PRETIME(r1, 0xc0046d00, &(0x7f0000000000)=0x8) r2 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r2, 0x0, 0x0) recvfrom$unix(r2, &(0x7f0000000080)=""/133, 0x85, 0x2, &(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$SNDCTL_MIDI_PRETIME(r1, 0xc0046d00, &(0x7f0000000000)=0x8) (async) socket$unix(0x1, 0x5, 0x0) (async) recvmsg$unix(r2, 0x0, 0x0) (async) recvfrom$unix(r2, &(0x7f0000000080)=""/133, 0x85, 0x2, &(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e) (async) 14:08:01 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = socket$unix(0x1, 0x5, 0x0) recvmsg$unix(r1, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000300)={'gretap0\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x8, 0x8, 0x4, 0x8, {{0x9, 0x4, 0x2, 0x22, 0x24, 0x8000, 0x0, 0xfa, 0x4, 0x0, @remote, @empty, {[@rr={0x7, 0xf, 0x5a, [@multicast1, @multicast2, @local]}]}}}}}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r3, 0x0, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r4, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xb, 0x8000, 0x3, 0xa231, 0x80, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x1}, 0x48) (async, rerun: 64) r6 = openat$mice(0xffffffffffffff9c, &(0x7f0000000440), 0x1) (rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xa, &(0x7f0000000180)=@raw=[@map_idx={0x18, 0x7, 0x5, 0x0, 0xd}, @initr0={0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x2}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0xb, 0x0, 0x0, 0x0, 0x4fa0d0d2}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xffffffffffffffff}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x10}], &(0x7f0000000080)='GPL\x00', 0x1ff, 0x75, &(0x7f0000000200)=""/117, 0x40f00, 0x10, '\x00', r2, 0x0, r3, 0x8, &(0x7f0000000340)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000380)={0x2, 0xe, 0x4, 0x7}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000480)=[r4, r5, 0xffffffffffffffff, r6]}, 0x80) (async) accept4$unix(r1, &(0x7f0000000100)=@abs, &(0x7f0000000000)=0x6e, 0x80000) (async) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r0, 0x89ea, &(0x7f0000000000)) ioctl$SIOCX25SCAUSEDIAG(r0, 0x89ec, &(0x7f0000000000)={0x3, 0x20}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = accept$ax25(0xffffffffffffffff, &(0x7f00000004c0)={{0x3, @netrom}, [@bcast, @null, @null, @bcast, @bcast, @default]}, &(0x7f00000000c0)=0x6878d0c49e397fdf) (async) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)=0x0) ioctl$SIOCAX25DELUID(r1, 0x89e2, &(0x7f00000001c0)={0x3, @default, r2}) getresuid(&(0x7f00000003c0), &(0x7f0000000400)=0x0, &(0x7f0000000440)) ioctl$SIOCAX25ADDUID(r1, 0x89e1, &(0x7f0000000480)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, r3}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000380)={0x0, 0x1, r0, 0x4}) (async) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x22202) (rerun: 64) write$bt_hci(r4, &(0x7f0000000240)=ANY=[@ANYBLOB="53409069cfeeb00035c781136ed666f6901e2f07a99fcb51bb357e3d00fa584e1a2d98426f76b375a0215905bf1b2580640ad954b5be0798486e0e6104d67a41d6910bb57716f7b71e9a840b29ec0365c09757e8d23dd84d423d3cc46b8c39b89f036e6c59fed1d4d6fc846d3d615aded56ac27ae3dc4931f7a0f7325d8f27d80430a17109a97516bb0f198e00be8a690f303c20f6b22e03c1b96c406013b027dc7baabda14e5bc6b99d284d613fb52662a8136adb4972e977cd79403509e389a756e11e7cad065eaa6ba418769b6e40763126cc7af88417fe1c7c0ac4db12c626c513c91b1abb06b18b0c3c8389994e7959dee46aa5b3efe834dc48ccd7dbe09928"], 0x7) (async) setsockopt$bt_hci_HCI_DATA_DIR(r4, 0x0, 0x1, &(0x7f0000000200), 0x4) 14:08:01 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async, rerun: 32) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) (rerun: 32) sendto$unix(r1, &(0x7f0000000080)="9323fe3be6b55ca2e47d99bd30f1e0e38a758b80472bfcf335b016dfc5132c0c82e46ee8d68dab02fe768f6e98a5876b275b4a0bd73a4fe0471d8d57f567bcdcfb41bd1587aac77843ec2f51006679e8ae24eb8bab1d36a6a4d30857b16f0dc3f6cbd2cb0a056b8ade8650a8fc4bda484b1b3314a2ff01cc181540ee92cbdeb1f281d34f3b6ab69694bd50c2aeb0b9a52f9967bac94a4aa87e471b6a5387b33c7483bccebdd85308281ac2f17023084ba8619be2173ad3a3ba4f0d7fe71a9b24a2adc1d1106950a6297361d2b726cc12efc51c7af47561", 0xd7, 0x810, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e20}, 0x6e) 14:08:01 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x1b389e6108c3be47) 14:08:01 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r0, 0x89ea, &(0x7f0000000000)) (async, rerun: 64) ioctl$SIOCX25SCAUSEDIAG(r0, 0x89ec, &(0x7f0000000000)={0x3, 0x20}) (async, rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r0, 0x80045104, &(0x7f0000000000)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:01 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)={0x1, @read_enc_key_size={{0x1408, 0x2}, {0xc9}}}, 0x6) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(0xffffffffffffffff, &(0x7f00000002c0)={0x1, @le_add_to_accept_list={{0x2011, 0x7}, {0x5}}}, 0xb) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000240)) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x140c, 0x100, 0x70bd2b, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x2000c0d0}, 0x10004015) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e6, &(0x7f0000000000)) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, 0x1402, 0x300, 0x70bd2e, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x440de}, 0x80) 14:08:01 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) sendto$unix(r1, &(0x7f0000000080)="9323fe3be6b55ca2e47d99bd30f1e0e38a758b80472bfcf335b016dfc5132c0c82e46ee8d68dab02fe768f6e98a5876b275b4a0bd73a4fe0471d8d57f567bcdcfb41bd1587aac77843ec2f51006679e8ae24eb8bab1d36a6a4d30857b16f0dc3f6cbd2cb0a056b8ade8650a8fc4bda484b1b3314a2ff01cc181540ee92cbdeb1f281d34f3b6ab69694bd50c2aeb0b9a52f9967bac94a4aa87e471b6a5387b33c7483bccebdd85308281ac2f17023084ba8619be2173ad3a3ba4f0d7fe71a9b24a2adc1d1106950a6297361d2b726cc12efc51c7af47561", 0xd7, 0x810, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e20}, 0x6e) 14:08:01 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r0, 0x89ea, &(0x7f0000000000)) (async) ioctl$SIOCX25SCAUSEDIAG(r0, 0x89ec, &(0x7f0000000000)={0x3, 0x20}) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r0, 0x80045104, &(0x7f0000000000)) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:01 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)={0x1, @read_enc_key_size={{0x1408, 0x2}, {0xc9}}}, 0x6) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(0xffffffffffffffff, &(0x7f00000002c0)={0x1, @le_add_to_accept_list={{0x2011, 0x7}, {0x5}}}, 0xb) (async, rerun: 64) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (rerun: 64) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000240)) (async, rerun: 32) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x140c, 0x100, 0x70bd2b, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x2000c0d0}, 0x10004015) (rerun: 32) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e6, &(0x7f0000000000)) (async) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, 0x1402, 0x300, 0x70bd2e, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x440de}, 0x80) 14:08:01 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0x4, 0x0, "1f9c32", 0x81, 0x9}) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) 14:08:01 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000040)={0x1, @read_stored_link_key={{0xc0d, 0x7}, {@any, 0xfb}}}, 0xb) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:08:01 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)={0x1, @read_enc_key_size={{0x1408, 0x2}, {0xc9}}}, 0x6) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}, {0xc9, 0xfe}}}, 0x7) ioctl$HCIINQUIRY(r2, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r0, 0x80045104, &(0x7f0000000000)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:01 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}, {0xc9, 0xfe}}}, 0x7) (async) ioctl$HCIINQUIRY(r2, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0x4, 0x0, "1f9c32", 0x81, 0x9}) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) 14:08:01 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000040)={0x1, @read_stored_link_key={{0xc0d, 0x7}, {@any, 0xfb}}}, 0xb) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000040)={0x1, @read_stored_link_key={{0xc0d, 0x7}, {@any, 0xfb}}}, 0xb) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) 14:08:01 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) write$bt_hci(0xffffffffffffffff, &(0x7f00000002c0)={0x1, @le_add_to_accept_list={{0x2011, 0x7}, {0x5}}}, 0xb) (async, rerun: 32) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000240)) (async) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x140c, 0x100, 0x70bd2b, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x2000c0d0}, 0x10004015) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) (async) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e6, &(0x7f0000000000)) (async) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, 0x1402, 0x300, 0x70bd2e, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x440de}, 0x80) 14:08:01 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x105101) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x400, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x2000000000000001) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x400) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SIOCAX25DELFWD(r2, 0x89eb, &(0x7f00000000c0)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}}) write$bt_hci(r3, &(0x7f0000000300)=ANY=[@ANYBLOB="d5162b8e00fb50ffbec4b033afaffb08523e92be183f24a4a787a7c876d8810548004d60333821fec1364a2a4ee9d139e4f4d79b1ec4997f0166c54103874c5c787b7bda0cbed1f8d1853c7ed23ec508213213528416f5275e3ff6df2786ef8d26d280528c31be34da057fa23d20f9a39611e051340a209fa919d9b23251c1afea1564ce9400791bb60b8b4b8e804e9e1acb1d2db0af587703456369a10e5f5029fdac31de9f954ef96dd6e081548895492e8e5542a687bb55669da59c16aa5a1ea2175f9996356b02ae6e654cab51d46040d289aabf714f0baf3ef550da924b7187e924940501213729d80afb0caa26b64554284ce51db94d007e67d9bba67631d9517a99ca9f0b9c5f960c1536fd8ff7b68c65e8903790f9bc577f13c3762e57a48ef46017f27d8b903e635183693fc39a966ad41219abe3f4d8b83c6f19bc6c9fa2e4d909deab80013ae3fc1a1c25c5cd677c4a5a850d7ffe1f"], 0x7) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000000)={0x400, [0xffffffe0, 0xcd7], 0x3}, 0x10) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x1406, 0x300, 0x70bd27, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040080}, 0x4004) 14:08:01 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}, {0xc9, 0xfe}}}, 0x7) ioctl$HCIINQUIRY(r2, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}, {0xc9, 0xfe}}}, 0x7) (async) ioctl$HCIINQUIRY(r2, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:08:01 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0x4, 0x0, "1f9c32", 0x81, 0x9}) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) 14:08:01 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x105101) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x105101) (async) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:08:01 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000040)={0x1, @read_stored_link_key={{0xc0d, 0x7}, {@any, 0xfb}}}, 0xb) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:08:01 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x400, 0x0) (async, rerun: 64) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (rerun: 64) write$apparmor_current(r1, 0x0, 0x0) (async) mmap$binder(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x2000000000000001) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x400) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SIOCAX25DELFWD(r2, 0x89eb, &(0x7f00000000c0)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}}) (async) write$bt_hci(r3, &(0x7f0000000300)=ANY=[@ANYBLOB="d5162b8e00fb50ffbec4b033afaffb08523e92be183f24a4a787a7c876d8810548004d60333821fec1364a2a4ee9d139e4f4d79b1ec4997f0166c54103874c5c787b7bda0cbed1f8d1853c7ed23ec508213213528416f5275e3ff6df2786ef8d26d280528c31be34da057fa23d20f9a39611e051340a209fa919d9b23251c1afea1564ce9400791bb60b8b4b8e804e9e1acb1d2db0af587703456369a10e5f5029fdac31de9f954ef96dd6e081548895492e8e5542a687bb55669da59c16aa5a1ea2175f9996356b02ae6e654cab51d46040d289aabf714f0baf3ef550da924b7187e924940501213729d80afb0caa26b64554284ce51db94d007e67d9bba67631d9517a99ca9f0b9c5f960c1536fd8ff7b68c65e8903790f9bc577f13c3762e57a48ef46017f27d8b903e635183693fc39a966ad41219abe3f4d8b83c6f19bc6c9fa2e4d909deab80013ae3fc1a1c25c5cd677c4a5a850d7ffe1f"], 0x7) (async) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000000)={0x400, [0xffffffe0, 0xcd7], 0x3}, 0x10) (async) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x1406, 0x300, 0x70bd27, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040080}, 0x4004) 14:08:01 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x12ad, [0xf0000000, 0xafc6], 0x2}, 0x10) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x2, 0x4) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:08:01 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000000)={0x4, [0x101, 0x4], 0x9}, 0x10) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SNDCTL_SEQ_TESTMIDI(0xffffffffffffffff, 0x40045108, &(0x7f0000000040)) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x6, 0x7f6b, 0x7f, 0x428, 0xffffffffffffffff, 0x79f1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x5, 0xe}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0x1, 0x58, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r3, 0x0, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r4, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x0, 0x6, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x8}, [@cb_func={0x18, 0x8, 0x4, 0x0, 0x5}, @func={0x85, 0x0, 0x1, 0x0, 0x8}]}, &(0x7f0000000640)='syzkaller\x00', 0x8, 0xd6, &(0x7f0000000680)=""/214, 0x41000, 0x1, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000000780)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000007c0)={0x4, 0x9, 0x3, 0x10001}, 0x10}, 0x80) r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000004c0)={0x0, 0x9, 0x10}, 0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000005c0)={r5, 0xad, &(0x7f0000000540)}, 0x2d) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r6, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x1d, 0x9, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000001800000000000000600000018450000050000000000000000000000181b0000ab8d67", @ANYRES32=r1, @ANYBLOB="0000000000000000186700000d00000000000000070000009500000000000000"], &(0x7f0000000180)='syzkaller\x00', 0x9, 0x8e, &(0x7f00000001c0)=""/142, 0x40f00, 0x6, '\x00', r2, 0x1b, r3, 0x8, &(0x7f0000000340)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x1, 0xf, 0x8, 0x20}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[r6]}, 0x80) socket$inet6_sctp(0xa, 0xd5b98b18a72b9c0f, 0x84) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f0000000480)={0x1, 0x5, "512af5", 0x4, 0x40}) 14:08:01 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x800448d2, &(0x7f0000000040)="4882e166360ddfd157dfb09b9d4655ef74c4235f2ab535db6b8f1b8fa940f78410bc833dc5b6315b5fdfe3ae78c1a880c6a538417b51c78147972c7748a2d0973478ddc621bb58a0a33547a3c068efd8e173600e8be711a9b2fc38a9a11a2311a95fea4bfe511f268583906773d2d2d056746c015cefb116d22d65ffef92824e6f8c86545e5a940135fe927cf133d3104e660f5533740b28e4728a0813e0ea9351d43edd0462187933dffcdd318c79d4c655f935c76575de6c5a95d1ff6e68258482cfe3b8bddf5754c5df52a9d58c6252ff162b5573cc747df20e7835c9bb37084e82b71acb57d7ac53c3640df9b838d7db76d9b5657f82295e6bc37e92331d8d86cd664830a6857b5f87305d2a69e03af5c2c0dbb5312965a824f682e2699b09b9602afaf65078ba9b6323df1a02b1cea72f9bbccba0ca753563ed5d4f54cb7f028cee9e1d35441b05c81e572c2d4523b4bf08c314f008b782fb5acfcdead447ca49eeb98de687382194dd310d417f5cb537249adf993db3dc79f8244fce148e6cfb17c9d5339e46242ecc78d840a73afb37a48a04ff68098cb0018ab5299ee31a7114c0bd5391788c6fd6e35b2b05c666773dded17b2eb92272c7bce37ffba7159063eb5df9332f2f08458aa49d018d3f4c192e603b2772bf186605e649101e21bdef7f5e9ce7376f62318080711dd3ea65bc8bbe85a6e52c3addff319c66f9a8ebe0295b8ff2e4fb16928f9082f83a087b43c7a1f105bfce241009117cb45757b88f7673340b5c35dc744f04b9a28c27c1c778a64e6bf198a2323ae26cb112f38cbbe8200fdc5dc7a20ffb9ebe7bad8daf2f380cf646128b3903daf36d75c8041af615a2e648e8681e98a025bc5f986b2974a4ef68521653b03d1d2991523be0f2fcdbcc3af91c978bf1b9ccd095b9c6ad776890567b36739b766f496f751f17c1585fe3a5a29d502f7169798d0b124428fdfbd166058db13611f0076dd465b1b2758ffef700b24a89e59a8eb4d56f1417ed539d74cc60952ff8d80df30d8d1394aa74c3627126043b099ad8f798772e76f0648a868059c17876126b13c3f211c76a1fa438b986e2096c69780662bbf3ddb2459f3afb4c79cc1500f7b6077b09eb3400a7f946ca9f20cee59673cfb46e830e0242e8b2fe6aae123e0b3cc2f10edfdc92cf7efbbfb4fcb02cf31b438d89cc412167a3383bc88a21a22fbc4c027bf3f85fde9272a69abc962e43d4a76b8ac4f6ab46cc4cf00c5ea07a0ac0c518f996246bf56723ed7a768f5720da60f96b7bafc87c96b02e7f85e9410e98509746b54b959dd57280fe91f2a29c8e9229de1f856d50ec5d2498abff3e544ed5d55b32e28be2599f27218e681e3186c9899cd64c54283cabdc2b42ad3569a342416b2be1c2873bbbf08e61a7d019b42d08c5b81faf732b6bfdd606c5bec377dab2e84237adb71bff0dc8985bd23d70da2a694fa63b9ad2f1dbf8aac650e973ad784c56c9103fd26a2b55bf57b99ef94347c72319943cce6b05e20526b42ea792f1715e026c9e291f22619c2f92af2910ac57cb6a9a18766427fa91fbe2c85914ec796af69db05a8734515b1ab12527f6547dbfba9951e35141caaac6a8abf82cff231a3a69e0522882cd81aea534ad4ceddac00ecbba6058bb8facb172c3d2ed53852764d0d859f477d08f8187008a45dd4675ed588ce4e8fdba026be61012569644d535285498d4c542314c24fbb3e640fed0d7d1f33470f2d85fac91b084c1a97c99b1198f215842681dfb7a06fe5d09efe294721802712e8b05d0f03f8ed344ca1d18025515c9bc2d48703f4ccf891edbe53e0814bda9b143da88623f12d58cdcdfdea5339a853c65de445504bfe3c28f39aa66850b32ff5a4d9864adab8757db7197dcf7adf47040ec9fffabc71ec06861c28cf31f83e09ad7ae9aa6731b2173c2ea0ed2d1fd463166fb74e82a1507ca2bb095d8aca60100675b12682ca2003fb1c0629297aef061998f5c1b7bac9a82321c7d5193509330dfbfb9e1f69e5bccb753de49b51f0db840d8a48d075f7720c748cb731195bd02f231b0444c8cc1d03ed5cceafe8a82ba5131aebbb87de15b3a817cf4a089e124e3ac56e5c0ccdfd6223ccc381721ea6967b6cc6c107e2d252c622eb03f50d8c7515e0a125695a3bf3b7732478a8370c07ea76d7fd1b7b2644f8b68eeb23a61672c86c48e21a4e551bd702062b4e4cb3fabf8bae9099b7262293407e1de77b17e1314adf847014eed71fb32a240fcc160021eb119dab44c10fa210b0862abcb7606aa6376867907029f0f79a8f32c4c78f6a9ec0b819d84711afd84e1c4adf6f0f7b6e5e896a3625e933cef6742d7fcc05821f90cac736a235946fc30fe9c90f6874dbe04ae6c1df9849ebba670b5b12f60726fe2f1a3f52636516b55addc1a9fb422a1fea2f3d8e11764f825fa45e7181da456d73aa00a808bd827b03b3f542c80f9dda7e7b8a1fb95a361ce1c225663d288e00432aea6a0e5eef62d91d3b1971bda7a9e5a64045489fc3a87a4b6216748d95e945834dc19ad9303162f883e722b65b87fd568fb889978df01c3787d92b35182787462a2b6298e6455d2a7bc2aeb3da83eabb2180b1442c3293921dfce7a8e1aac5551f03082e31434136e87c631f35d3fec1f7e6a28fc7621d11ed913e646f73200a555ed41a8243751a470260159e8fee10d796350bf311f660013d4354cbba4cb58339b09fac1fb9a41314a59bdcea493044edcbb363daa256fdd7c9686f985226ed57fbb1091db29515088defb18e2fd1317b71145243d52f30e809b280bcc14aabd0491ac3ca5ccfb464e732f0c837a3be0bc40ed6bbe5e2ca1edbcdc155853823ad31813f5f51faf5336238c6ad7a28d7b5df4c337ab4c9e8bf270c06882fed285cb9d55704b1c62b91398f81dab211a041bef797d02a0b2428fa3da2070fcb7c33609156c808aa49c603e0a3642445438c5f2f5c77c77bd1024e1b8a9b8bcd8d8446e42f2027911e9312d84a07042f9102ca7b42b9fb8832f066e9e722ff69f83cef690eb285b3286059aabd418d7e5f7125e620ad81c1de31c1ebb42f199536fa29757a01096177f26e8e34502a51946a4973b9c02f75ba233680ad6a858e01449fdc63ea056f0e5e427f9fd80ff2971748e35b9850876ca4632ca069a7f828431b59526e9eb48e405378010a16f7609514181147f7cc9bc9e6f6d3bb9f6e55f3a033d1e6a5bef22293b7be1c3c5717bbf72d4b965aad0dfb4a8926f5b7b98b4b2af6019e588673e3f1411be0a75d6b39c30967b6b91037bd6b7efd0584b2c9a90f41629b942f5dec289818207299eb259da6be488a3e1086fe91f0e69f1ebf51eb3e822584f29542cff5c56041cc02c6141a8c997b99b78320a8c19f9a51e13bdbfaaca5a27f6f65b6b271d4897f2281c46d691afa1d8c539571c23497b7a9b20a1c2b7dc7fd847cf59c6faeda4b25f83e55b81d93175e6f9b5038f9a539649c887ab70af717f22d326c549c2c8d74a3c4673e710bf2f04cc2b1f2cfd255517b21cb36c0a29789ccb9f1ac8e7a7f9e6d4f0e6b48deafe1d1952f224dcfaa212124b027caec0ae13165b3d11cfbd45c11a7040e743d9396cb9b0350103329af036d004afe3b7fb59bdafc1756d6e924fc5f7d49e6bd997e7d96820ded3b533db45496d3b4867d752ef06c3724b932ce8db7e60d588e5e3e29b9f9ed9d5896371ca6ccf600338f7172bfc53f7b0f76c49eae2eb946ff7db1bc5ec67de54d6a18cc9b6b1f4e6f973ae112b27373a13a93a02363dad6b0c6a869a368b981aff5a283132b2561c543d3904448e5f689db4408d15693f2f9990fd2887037fb7c57cf6cdc6d75efbea1aa6137e5674d19464c3f17db34b2933a085917199f440624ba640cd329c434345359f78ff3703e21c677514268b88270d94ba87e20c623a179c7e2b91f64ba5692506fc97f5caf54147a94ee805740a63e27b2031e66aafd18fbfe1afe13e34bf1e94b2adb5002da30f7f6c8989b75981418b87b55bf4eff3c4055b1dbd89b4bd9c1f5978c24d49be841cc65decb7112476c15c427d6931f266eb189cca3177080c1e1680629f460522e49e26350ad418abc0be6baf7348ac1ef94afbd01dd6351a30d7ab72542b8a3ebc5f311c85ea75496500fc808366ae3a2e1960f7ef60eb2d0f1bb893c1b8b2b3039c163bfafe5cad232452f7505393d2f37638c18e58eebcfc85de079c78f2de3775906f1796634db1a0984f19f0a721829c480d731f29fbf1b88fe18c328b68ed165fe13d1c097f8cbb9c49b37d7e3c0937cc030b616fdced8182cfb1149a9b81d9ad6a28c18b63da098c3249613f0acf55bf9776f32d36094169f4ae42fa0ed533c9bfa06d398b49b3dfabda5644552b32d993b22ff64de1a6509c03edd5c7b5ec10aba787d1d7ef127e54bcf05cd1d01f430cad66243ad2fe6e113aaff20dd72c00e0a36ae3c1bd5317849439373cf2e84e0aec062dd55a8133d81e05987115cde866aab4be0e8250b57e278807cf87299b7a845d3c644f29734713b04f8ab88eeee8dcd24287cdaef48d1d242a7d20d2fc1a74f11688a9771c03efbc9d7db4df0ba7b96974b3a9636333dd3e04bc95e96a76698a457578d9d7d363c32aaa58c049b31adda5c3317d50a9e1e65bbc9a9f6d7b357b560dc31b1b04e667bd0c527377fb9d9b5f9864f00139952e0b67615937a85543689fe2307e5dc6ad24318782a0e8cb1679bea8a236aa57fae93adb07cf0c03e6a2d80449ebe38ef7bdba6a52be62bbbfc4b0d5c4b2b2d71b8a54f346e35b5010acd8d38607484afe370620b824b7161048a05a04e5d9c10c3eb2ee870d3e15628877746a0818b23748b6a87c7105646e48b85d0fdd28c711ca9dcd338a721b6751dd68fb1202c8e50d2396e416538ba8d4fdc091a6dd7906173ba355591f60e5df619d4e1094d422470e1c460707ee8c9cd64614268f4c9bda96c8afb0297eee84a48a54d5b75f677cc11cc706ef61ded4ab7674595b3a12fd59c3b9b73913060bb5dfea101162939a5f59b1db67799228793216136b587939b1838b3405548c585b1d43f89db1880c43ddf1c84f3fb990193f7a80974d6ecfa7cdcf8f1308f5126a763783c2dde363d6513ae80d290c652f94a0929e600c34c7f23656c9c42a9cb232579363c771b60b2da0b00b1cdb7487e260b851a98a08065bdf509baa434751e1c4f9941cbb1b14e5b847aeac4eeed22a5416e36ef78d74e9810f23355abc295eaeace0169dd87f89ddde32f9ed3e41f0e650cff224b7dd43d9f1c3b9b0e2a6fc2ea3e18c6b14ee67a336fc8a43a79cb4b5d2a4cd0b5e3af66a50f40d1b62f7587aec4495e50df063b1165ade3dfd07f540d2fd40663703ebb7418a4c9d4224d4e9bc6d0b899cb6e8b2a1940b568dd863d4772d368d10ba3156cb50598f1ad2f14e1a0228f5f7ee918f32ee6fc83f01bf8077d6dbb644a12c476832da842e08f2164ee35a781927671783aaf1aeb944e8c7e164a9399ffe76beb61e887f1a294aafa479051e18863a6932f36423c301a333912992d2d918646549064e857a56b760bd7ffecdbb8f88fcc81bb22402eff3186e518e05f5f61bb4c54a944f26f31b1537a4da2cb1f7c7a7e4cbe3f90b92ed116084fba0f1cbc56c392e43a6c512c7f72f9bcd2a2ad796689107d401503cabe20864eecb1d027675e24b5f13bb1c07bdce85dc16c207b66870b56255d4c00635a2b4555f83da23ee2332c1301a650208429ae24d8a") bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001300)={&(0x7f0000001140), 0x6e, &(0x7f0000001280)=[{&(0x7f00000011c0)=""/46, 0x2e}, {&(0x7f0000001200)=""/85, 0x55}], 0x2, &(0x7f00000012c0)=[@cred={{0x1c}}], 0x20}, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) ioctl$SNDCTL_SYNTH_INFO(r1, 0xc08c5102, &(0x7f0000001080)={"f6530a4a264701cc512f180bbe62e5083f5eed0fa83b6e1a803f7ae414cb", 0x7fffffff, 0x2, 0x1, 0xc0e8, 0x1, 0x1, 0x7, 0x4, [0x5, 0x4, 0x9, 0x0, 0x8, 0x9cd, 0xaec9, 0x7b42, 0x40, 0xee, 0x1, 0x100, 0x5, 0x7, 0xb1, 0x400, 0x40000000, 0x1000, 0x40]}) ioctl$IMCLEAR_L2(0xffffffffffffffff, 0x80044946, &(0x7f0000001040)=0x3375) 14:08:01 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000000)={0x4, [0x101, 0x4], 0x9}, 0x10) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000000)={0x4, [0x101, 0x4], 0x9}, 0x10) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:08:01 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x105101) (rerun: 32) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) (async, rerun: 32) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:01 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SNDCTL_SEQ_TESTMIDI(0xffffffffffffffff, 0x40045108, &(0x7f0000000040)) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x6, 0x7f6b, 0x7f, 0x428, 0xffffffffffffffff, 0x79f1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x5, 0xe}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0x1, 0x58, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r3, 0x0, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r4, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x0, 0x6, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x8}, [@cb_func={0x18, 0x8, 0x4, 0x0, 0x5}, @func={0x85, 0x0, 0x1, 0x0, 0x8}]}, &(0x7f0000000640)='syzkaller\x00', 0x8, 0xd6, &(0x7f0000000680)=""/214, 0x41000, 0x1, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000000780)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000007c0)={0x4, 0x9, 0x3, 0x10001}, 0x10}, 0x80) r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000004c0)={0x0, 0x9, 0x10}, 0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000005c0)={r5, 0xad, &(0x7f0000000540)}, 0x2d) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r6, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x1d, 0x9, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000001800000000000000600000018450000050000000000000000000000181b0000ab8d67", @ANYRES32=r1, @ANYBLOB="0000000000000000186700000d00000000000000070000009500000000000000"], &(0x7f0000000180)='syzkaller\x00', 0x9, 0x8e, &(0x7f00000001c0)=""/142, 0x40f00, 0x6, '\x00', r2, 0x1b, r3, 0x8, &(0x7f0000000340)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x1, 0xf, 0x8, 0x20}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[r6]}, 0x80) socket$inet6_sctp(0xa, 0xd5b98b18a72b9c0f, 0x84) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f0000000480)={0x1, 0x5, "512af5", 0x4, 0x40}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SNDCTL_SEQ_TESTMIDI(0xffffffffffffffff, 0x40045108, &(0x7f0000000040)) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x6, 0x7f6b, 0x7f, 0x428, 0xffffffffffffffff, 0x79f1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x5, 0xe}, 0x48) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0x1, 0x58, &(0x7f0000000280)}, 0x10) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r3, 0x0, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r4, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x0, 0x6, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x8}, [@cb_func={0x18, 0x8, 0x4, 0x0, 0x5}, @func={0x85, 0x0, 0x1, 0x0, 0x8}]}, &(0x7f0000000640)='syzkaller\x00', 0x8, 0xd6, &(0x7f0000000680)=""/214, 0x41000, 0x1, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000000780)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000007c0)={0x4, 0x9, 0x3, 0x10001}, 0x10}, 0x80) (async) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000004c0)={0x0, 0x9, 0x10}, 0xc) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000005c0)={r5, 0xad, &(0x7f0000000540)}, 0x2d) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r6, 0x0, 0x0) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x1d, 0x9, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000001800000000000000600000018450000050000000000000000000000181b0000ab8d67", @ANYRES32=r1, @ANYBLOB="0000000000000000186700000d00000000000000070000009500000000000000"], &(0x7f0000000180)='syzkaller\x00', 0x9, 0x8e, &(0x7f00000001c0)=""/142, 0x40f00, 0x6, '\x00', r2, 0x1b, r3, 0x8, &(0x7f0000000340)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x1, 0xf, 0x8, 0x20}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[r6]}, 0x80) (async) socket$inet6_sctp(0xa, 0xd5b98b18a72b9c0f, 0x84) (async) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f0000000480)={0x1, 0x5, "512af5", 0x4, 0x40}) (async) 14:08:01 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x12ad, [0xf0000000, 0xafc6], 0x2}, 0x10) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x2, 0x4) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:08:01 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x400, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x2000000000000001) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x400) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SIOCAX25DELFWD(r2, 0x89eb, &(0x7f00000000c0)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}}) write$bt_hci(r3, &(0x7f0000000300)=ANY=[@ANYBLOB="d5162b8e00fb50ffbec4b033afaffb08523e92be183f24a4a787a7c876d8810548004d60333821fec1364a2a4ee9d139e4f4d79b1ec4997f0166c54103874c5c787b7bda0cbed1f8d1853c7ed23ec508213213528416f5275e3ff6df2786ef8d26d280528c31be34da057fa23d20f9a39611e051340a209fa919d9b23251c1afea1564ce9400791bb60b8b4b8e804e9e1acb1d2db0af587703456369a10e5f5029fdac31de9f954ef96dd6e081548895492e8e5542a687bb55669da59c16aa5a1ea2175f9996356b02ae6e654cab51d46040d289aabf714f0baf3ef550da924b7187e924940501213729d80afb0caa26b64554284ce51db94d007e67d9bba67631d9517a99ca9f0b9c5f960c1536fd8ff7b68c65e8903790f9bc577f13c3762e57a48ef46017f27d8b903e635183693fc39a966ad41219abe3f4d8b83c6f19bc6c9fa2e4d909deab80013ae3fc1a1c25c5cd677c4a5a850d7ffe1f"], 0x7) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000000)={0x400, [0xffffffe0, 0xcd7], 0x3}, 0x10) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x1406, 0x300, 0x70bd27, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040080}, 0x4004) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/binder1\x00', 0x400, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r1, 0x0, 0x0) (async) mmap$binder(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x2000000000000001) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x400) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SIOCAX25DELFWD(r2, 0x89eb, &(0x7f00000000c0)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}}) (async) write$bt_hci(r3, &(0x7f0000000300)=ANY=[@ANYBLOB="d5162b8e00fb50ffbec4b033afaffb08523e92be183f24a4a787a7c876d8810548004d60333821fec1364a2a4ee9d139e4f4d79b1ec4997f0166c54103874c5c787b7bda0cbed1f8d1853c7ed23ec508213213528416f5275e3ff6df2786ef8d26d280528c31be34da057fa23d20f9a39611e051340a209fa919d9b23251c1afea1564ce9400791bb60b8b4b8e804e9e1acb1d2db0af587703456369a10e5f5029fdac31de9f954ef96dd6e081548895492e8e5542a687bb55669da59c16aa5a1ea2175f9996356b02ae6e654cab51d46040d289aabf714f0baf3ef550da924b7187e924940501213729d80afb0caa26b64554284ce51db94d007e67d9bba67631d9517a99ca9f0b9c5f960c1536fd8ff7b68c65e8903790f9bc577f13c3762e57a48ef46017f27d8b903e635183693fc39a966ad41219abe3f4d8b83c6f19bc6c9fa2e4d909deab80013ae3fc1a1c25c5cd677c4a5a850d7ffe1f"], 0x7) (async) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000000)={0x400, [0xffffffe0, 0xcd7], 0x3}, 0x10) (async) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x1406, 0x300, 0x70bd27, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040080}, 0x4004) (async) 14:08:01 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x800448d2, &(0x7f0000000040)="4882e166360ddfd157dfb09b9d4655ef74c4235f2ab535db6b8f1b8fa940f78410bc833dc5b6315b5fdfe3ae78c1a880c6a538417b51c78147972c7748a2d0973478ddc621bb58a0a33547a3c068efd8e173600e8be711a9b2fc38a9a11a2311a95fea4bfe511f268583906773d2d2d056746c015cefb116d22d65ffef92824e6f8c86545e5a940135fe927cf133d3104e660f5533740b28e4728a0813e0ea9351d43edd0462187933dffcdd318c79d4c655f935c76575de6c5a95d1ff6e68258482cfe3b8bddf5754c5df52a9d58c6252ff162b5573cc747df20e7835c9bb37084e82b71acb57d7ac53c3640df9b838d7db76d9b5657f82295e6bc37e92331d8d86cd664830a6857b5f87305d2a69e03af5c2c0dbb5312965a824f682e2699b09b9602afaf65078ba9b6323df1a02b1cea72f9bbccba0ca753563ed5d4f54cb7f028cee9e1d35441b05c81e572c2d4523b4bf08c314f008b782fb5acfcdead447ca49eeb98de687382194dd310d417f5cb537249adf993db3dc79f8244fce148e6cfb17c9d5339e46242ecc78d840a73afb37a48a04ff68098cb0018ab5299ee31a7114c0bd5391788c6fd6e35b2b05c666773dded17b2eb92272c7bce37ffba7159063eb5df9332f2f08458aa49d018d3f4c192e603b2772bf186605e649101e21bdef7f5e9ce7376f62318080711dd3ea65bc8bbe85a6e52c3addff319c66f9a8ebe0295b8ff2e4fb16928f9082f83a087b43c7a1f105bfce241009117cb45757b88f7673340b5c35dc744f04b9a28c27c1c778a64e6bf198a2323ae26cb112f38cbbe8200fdc5dc7a20ffb9ebe7bad8daf2f380cf646128b3903daf36d75c8041af615a2e648e8681e98a025bc5f986b2974a4ef68521653b03d1d2991523be0f2fcdbcc3af91c978bf1b9ccd095b9c6ad776890567b36739b766f496f751f17c1585fe3a5a29d502f7169798d0b124428fdfbd166058db13611f0076dd465b1b2758ffef700b24a89e59a8eb4d56f1417ed539d74cc60952ff8d80df30d8d1394aa74c3627126043b099ad8f798772e76f0648a868059c17876126b13c3f211c76a1fa438b986e2096c69780662bbf3ddb2459f3afb4c79cc1500f7b6077b09eb3400a7f946ca9f20cee59673cfb46e830e0242e8b2fe6aae123e0b3cc2f10edfdc92cf7efbbfb4fcb02cf31b438d89cc412167a3383bc88a21a22fbc4c027bf3f85fde9272a69abc962e43d4a76b8ac4f6ab46cc4cf00c5ea07a0ac0c518f996246bf56723ed7a768f5720da60f96b7bafc87c96b02e7f85e9410e98509746b54b959dd57280fe91f2a29c8e9229de1f856d50ec5d2498abff3e544ed5d55b32e28be2599f27218e681e3186c9899cd64c54283cabdc2b42ad3569a342416b2be1c2873bbbf08e61a7d019b42d08c5b81faf732b6bfdd606c5bec377dab2e84237adb71bff0dc8985bd23d70da2a694fa63b9ad2f1dbf8aac650e973ad784c56c9103fd26a2b55bf57b99ef94347c72319943cce6b05e20526b42ea792f1715e026c9e291f22619c2f92af2910ac57cb6a9a18766427fa91fbe2c85914ec796af69db05a8734515b1ab12527f6547dbfba9951e35141caaac6a8abf82cff231a3a69e0522882cd81aea534ad4ceddac00ecbba6058bb8facb172c3d2ed53852764d0d859f477d08f8187008a45dd4675ed588ce4e8fdba026be61012569644d535285498d4c542314c24fbb3e640fed0d7d1f33470f2d85fac91b084c1a97c99b1198f215842681dfb7a06fe5d09efe294721802712e8b05d0f03f8ed344ca1d18025515c9bc2d48703f4ccf891edbe53e0814bda9b143da88623f12d58cdcdfdea5339a853c65de445504bfe3c28f39aa66850b32ff5a4d9864adab8757db7197dcf7adf47040ec9fffabc71ec06861c28cf31f83e09ad7ae9aa6731b2173c2ea0ed2d1fd463166fb74e82a1507ca2bb095d8aca60100675b12682ca2003fb1c0629297aef061998f5c1b7bac9a82321c7d5193509330dfbfb9e1f69e5bccb753de49b51f0db840d8a48d075f7720c748cb731195bd02f231b0444c8cc1d03ed5cceafe8a82ba5131aebbb87de15b3a817cf4a089e124e3ac56e5c0ccdfd6223ccc381721ea6967b6cc6c107e2d252c622eb03f50d8c7515e0a125695a3bf3b7732478a8370c07ea76d7fd1b7b2644f8b68eeb23a61672c86c48e21a4e551bd702062b4e4cb3fabf8bae9099b7262293407e1de77b17e1314adf847014eed71fb32a240fcc160021eb119dab44c10fa210b0862abcb7606aa6376867907029f0f79a8f32c4c78f6a9ec0b819d84711afd84e1c4adf6f0f7b6e5e896a3625e933cef6742d7fcc05821f90cac736a235946fc30fe9c90f6874dbe04ae6c1df9849ebba670b5b12f60726fe2f1a3f52636516b55addc1a9fb422a1fea2f3d8e11764f825fa45e7181da456d73aa00a808bd827b03b3f542c80f9dda7e7b8a1fb95a361ce1c225663d288e00432aea6a0e5eef62d91d3b1971bda7a9e5a64045489fc3a87a4b6216748d95e945834dc19ad9303162f883e722b65b87fd568fb889978df01c3787d92b35182787462a2b6298e6455d2a7bc2aeb3da83eabb2180b1442c3293921dfce7a8e1aac5551f03082e31434136e87c631f35d3fec1f7e6a28fc7621d11ed913e646f73200a555ed41a8243751a470260159e8fee10d796350bf311f660013d4354cbba4cb58339b09fac1fb9a41314a59bdcea493044edcbb363daa256fdd7c9686f985226ed57fbb1091db29515088defb18e2fd1317b71145243d52f30e809b280bcc14aabd0491ac3ca5ccfb464e732f0c837a3be0bc40ed6bbe5e2ca1edbcdc155853823ad31813f5f51faf5336238c6ad7a28d7b5df4c337ab4c9e8bf270c06882fed285cb9d55704b1c62b91398f81dab211a041bef797d02a0b2428fa3da2070fcb7c33609156c808aa49c603e0a3642445438c5f2f5c77c77bd1024e1b8a9b8bcd8d8446e42f2027911e9312d84a07042f9102ca7b42b9fb8832f066e9e722ff69f83cef690eb285b3286059aabd418d7e5f7125e620ad81c1de31c1ebb42f199536fa29757a01096177f26e8e34502a51946a4973b9c02f75ba233680ad6a858e01449fdc63ea056f0e5e427f9fd80ff2971748e35b9850876ca4632ca069a7f828431b59526e9eb48e405378010a16f7609514181147f7cc9bc9e6f6d3bb9f6e55f3a033d1e6a5bef22293b7be1c3c5717bbf72d4b965aad0dfb4a8926f5b7b98b4b2af6019e588673e3f1411be0a75d6b39c30967b6b91037bd6b7efd0584b2c9a90f41629b942f5dec289818207299eb259da6be488a3e1086fe91f0e69f1ebf51eb3e822584f29542cff5c56041cc02c6141a8c997b99b78320a8c19f9a51e13bdbfaaca5a27f6f65b6b271d4897f2281c46d691afa1d8c539571c23497b7a9b20a1c2b7dc7fd847cf59c6faeda4b25f83e55b81d93175e6f9b5038f9a539649c887ab70af717f22d326c549c2c8d74a3c4673e710bf2f04cc2b1f2cfd255517b21cb36c0a29789ccb9f1ac8e7a7f9e6d4f0e6b48deafe1d1952f224dcfaa212124b027caec0ae13165b3d11cfbd45c11a7040e743d9396cb9b0350103329af036d004afe3b7fb59bdafc1756d6e924fc5f7d49e6bd997e7d96820ded3b533db45496d3b4867d752ef06c3724b932ce8db7e60d588e5e3e29b9f9ed9d5896371ca6ccf600338f7172bfc53f7b0f76c49eae2eb946ff7db1bc5ec67de54d6a18cc9b6b1f4e6f973ae112b27373a13a93a02363dad6b0c6a869a368b981aff5a283132b2561c543d3904448e5f689db4408d15693f2f9990fd2887037fb7c57cf6cdc6d75efbea1aa6137e5674d19464c3f17db34b2933a085917199f440624ba640cd329c434345359f78ff3703e21c677514268b88270d94ba87e20c623a179c7e2b91f64ba5692506fc97f5caf54147a94ee805740a63e27b2031e66aafd18fbfe1afe13e34bf1e94b2adb5002da30f7f6c8989b75981418b87b55bf4eff3c4055b1dbd89b4bd9c1f5978c24d49be841cc65decb7112476c15c427d6931f266eb189cca3177080c1e1680629f460522e49e26350ad418abc0be6baf7348ac1ef94afbd01dd6351a30d7ab72542b8a3ebc5f311c85ea75496500fc808366ae3a2e1960f7ef60eb2d0f1bb893c1b8b2b3039c163bfafe5cad232452f7505393d2f37638c18e58eebcfc85de079c78f2de3775906f1796634db1a0984f19f0a721829c480d731f29fbf1b88fe18c328b68ed165fe13d1c097f8cbb9c49b37d7e3c0937cc030b616fdced8182cfb1149a9b81d9ad6a28c18b63da098c3249613f0acf55bf9776f32d36094169f4ae42fa0ed533c9bfa06d398b49b3dfabda5644552b32d993b22ff64de1a6509c03edd5c7b5ec10aba787d1d7ef127e54bcf05cd1d01f430cad66243ad2fe6e113aaff20dd72c00e0a36ae3c1bd5317849439373cf2e84e0aec062dd55a8133d81e05987115cde866aab4be0e8250b57e278807cf87299b7a845d3c644f29734713b04f8ab88eeee8dcd24287cdaef48d1d242a7d20d2fc1a74f11688a9771c03efbc9d7db4df0ba7b96974b3a9636333dd3e04bc95e96a76698a457578d9d7d363c32aaa58c049b31adda5c3317d50a9e1e65bbc9a9f6d7b357b560dc31b1b04e667bd0c527377fb9d9b5f9864f00139952e0b67615937a85543689fe2307e5dc6ad24318782a0e8cb1679bea8a236aa57fae93adb07cf0c03e6a2d80449ebe38ef7bdba6a52be62bbbfc4b0d5c4b2b2d71b8a54f346e35b5010acd8d38607484afe370620b824b7161048a05a04e5d9c10c3eb2ee870d3e15628877746a0818b23748b6a87c7105646e48b85d0fdd28c711ca9dcd338a721b6751dd68fb1202c8e50d2396e416538ba8d4fdc091a6dd7906173ba355591f60e5df619d4e1094d422470e1c460707ee8c9cd64614268f4c9bda96c8afb0297eee84a48a54d5b75f677cc11cc706ef61ded4ab7674595b3a12fd59c3b9b73913060bb5dfea101162939a5f59b1db67799228793216136b587939b1838b3405548c585b1d43f89db1880c43ddf1c84f3fb990193f7a80974d6ecfa7cdcf8f1308f5126a763783c2dde363d6513ae80d290c652f94a0929e600c34c7f23656c9c42a9cb232579363c771b60b2da0b00b1cdb7487e260b851a98a08065bdf509baa434751e1c4f9941cbb1b14e5b847aeac4eeed22a5416e36ef78d74e9810f23355abc295eaeace0169dd87f89ddde32f9ed3e41f0e650cff224b7dd43d9f1c3b9b0e2a6fc2ea3e18c6b14ee67a336fc8a43a79cb4b5d2a4cd0b5e3af66a50f40d1b62f7587aec4495e50df063b1165ade3dfd07f540d2fd40663703ebb7418a4c9d4224d4e9bc6d0b899cb6e8b2a1940b568dd863d4772d368d10ba3156cb50598f1ad2f14e1a0228f5f7ee918f32ee6fc83f01bf8077d6dbb644a12c476832da842e08f2164ee35a781927671783aaf1aeb944e8c7e164a9399ffe76beb61e887f1a294aafa479051e18863a6932f36423c301a333912992d2d918646549064e857a56b760bd7ffecdbb8f88fcc81bb22402eff3186e518e05f5f61bb4c54a944f26f31b1537a4da2cb1f7c7a7e4cbe3f90b92ed116084fba0f1cbc56c392e43a6c512c7f72f9bcd2a2ad796689107d401503cabe20864eecb1d027675e24b5f13bb1c07bdce85dc16c207b66870b56255d4c00635a2b4555f83da23ee2332c1301a650208429ae24d8a") bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001300)={&(0x7f0000001140), 0x6e, &(0x7f0000001280)=[{&(0x7f00000011c0)=""/46, 0x2e}, {&(0x7f0000001200)=""/85, 0x55}], 0x2, &(0x7f00000012c0)=[@cred={{0x1c}}], 0x20}, 0x1) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) ioctl$SNDCTL_SYNTH_INFO(r1, 0xc08c5102, &(0x7f0000001080)={"f6530a4a264701cc512f180bbe62e5083f5eed0fa83b6e1a803f7ae414cb", 0x7fffffff, 0x2, 0x1, 0xc0e8, 0x1, 0x1, 0x7, 0x4, [0x5, 0x4, 0x9, 0x0, 0x8, 0x9cd, 0xaec9, 0x7b42, 0x40, 0xee, 0x1, 0x100, 0x5, 0x7, 0xb1, 0x400, 0x40000000, 0x1000, 0x40]}) (async) ioctl$IMCLEAR_L2(0xffffffffffffffff, 0x80044946, &(0x7f0000001040)=0x3375) 14:08:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SNDCTL_SEQ_TESTMIDI(0xffffffffffffffff, 0x40045108, &(0x7f0000000040)) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x6, 0x7f6b, 0x7f, 0x428, 0xffffffffffffffff, 0x79f1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x5, 0xe}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0x1, 0x58, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r3, 0x0, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r4, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x0, 0x6, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x8}, [@cb_func={0x18, 0x8, 0x4, 0x0, 0x5}, @func={0x85, 0x0, 0x1, 0x0, 0x8}]}, &(0x7f0000000640)='syzkaller\x00', 0x8, 0xd6, &(0x7f0000000680)=""/214, 0x41000, 0x1, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000000780)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000007c0)={0x4, 0x9, 0x3, 0x10001}, 0x10}, 0x80) r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000004c0)={0x0, 0x9, 0x10}, 0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000005c0)={r5, 0xad, &(0x7f0000000540)}, 0x2d) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r6, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x1d, 0x9, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000001800000000000000600000018450000050000000000000000000000181b0000ab8d67", @ANYRES32=r1, @ANYBLOB="0000000000000000186700000d00000000000000070000009500000000000000"], &(0x7f0000000180)='syzkaller\x00', 0x9, 0x8e, &(0x7f00000001c0)=""/142, 0x40f00, 0x6, '\x00', r2, 0x1b, r3, 0x8, &(0x7f0000000340)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x1, 0xf, 0x8, 0x20}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[r6]}, 0x80) socket$inet6_sctp(0xa, 0xd5b98b18a72b9c0f, 0x84) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f0000000480)={0x1, 0x5, "512af5", 0x4, 0x40}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SNDCTL_SEQ_TESTMIDI(0xffffffffffffffff, 0x40045108, &(0x7f0000000040)) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter={0x1e, 0x6, 0x7f6b, 0x7f, 0x428, 0xffffffffffffffff, 0x79f1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x5, 0xe}, 0x48) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0x1, 0x58, &(0x7f0000000280)}, 0x10) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r3, 0x0, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r4, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x0, 0x6, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x8}, [@cb_func={0x18, 0x8, 0x4, 0x0, 0x5}, @func={0x85, 0x0, 0x1, 0x0, 0x8}]}, &(0x7f0000000640)='syzkaller\x00', 0x8, 0xd6, &(0x7f0000000680)=""/214, 0x41000, 0x1, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000000780)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000007c0)={0x4, 0x9, 0x3, 0x10001}, 0x10}, 0x80) (async) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000004c0)={0x0, 0x9, 0x10}, 0xc) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000005c0)={r5, 0xad, &(0x7f0000000540)}, 0x2d) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r6, 0x0, 0x0) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x1d, 0x9, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000001800000000000000600000018450000050000000000000000000000181b0000ab8d67", @ANYRES32=r1, @ANYBLOB="0000000000000000186700000d00000000000000070000009500000000000000"], &(0x7f0000000180)='syzkaller\x00', 0x9, 0x8e, &(0x7f00000001c0)=""/142, 0x40f00, 0x6, '\x00', r2, 0x1b, r3, 0x8, &(0x7f0000000340)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x1, 0xf, 0x8, 0x20}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[r6]}, 0x80) (async) socket$inet6_sctp(0xa, 0xd5b98b18a72b9c0f, 0x84) (async) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f0000000480)={0x1, 0x5, "512af5", 0x4, 0x40}) (async) 14:08:02 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x12ad, [0xf0000000, 0xafc6], 0x2}, 0x10) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x2, 0x4) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:08:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000000)={0x4, [0x101, 0x4], 0x9}, 0x10) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:02 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x3}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0x2, 0x1}, 0x6) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:02 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x800448d2, &(0x7f0000000040)="4882e166360ddfd157dfb09b9d4655ef74c4235f2ab535db6b8f1b8fa940f78410bc833dc5b6315b5fdfe3ae78c1a880c6a538417b51c78147972c7748a2d0973478ddc621bb58a0a33547a3c068efd8e173600e8be711a9b2fc38a9a11a2311a95fea4bfe511f268583906773d2d2d056746c015cefb116d22d65ffef92824e6f8c86545e5a940135fe927cf133d3104e660f5533740b28e4728a0813e0ea9351d43edd0462187933dffcdd318c79d4c655f935c76575de6c5a95d1ff6e68258482cfe3b8bddf5754c5df52a9d58c6252ff162b5573cc747df20e7835c9bb37084e82b71acb57d7ac53c3640df9b838d7db76d9b5657f82295e6bc37e92331d8d86cd664830a6857b5f87305d2a69e03af5c2c0dbb5312965a824f682e2699b09b9602afaf65078ba9b6323df1a02b1cea72f9bbccba0ca753563ed5d4f54cb7f028cee9e1d35441b05c81e572c2d4523b4bf08c314f008b782fb5acfcdead447ca49eeb98de687382194dd310d417f5cb537249adf993db3dc79f8244fce148e6cfb17c9d5339e46242ecc78d840a73afb37a48a04ff68098cb0018ab5299ee31a7114c0bd5391788c6fd6e35b2b05c666773dded17b2eb92272c7bce37ffba7159063eb5df9332f2f08458aa49d018d3f4c192e603b2772bf186605e649101e21bdef7f5e9ce7376f62318080711dd3ea65bc8bbe85a6e52c3addff319c66f9a8ebe0295b8ff2e4fb16928f9082f83a087b43c7a1f105bfce241009117cb45757b88f7673340b5c35dc744f04b9a28c27c1c778a64e6bf198a2323ae26cb112f38cbbe8200fdc5dc7a20ffb9ebe7bad8daf2f380cf646128b3903daf36d75c8041af615a2e648e8681e98a025bc5f986b2974a4ef68521653b03d1d2991523be0f2fcdbcc3af91c978bf1b9ccd095b9c6ad776890567b36739b766f496f751f17c1585fe3a5a29d502f7169798d0b124428fdfbd166058db13611f0076dd465b1b2758ffef700b24a89e59a8eb4d56f1417ed539d74cc60952ff8d80df30d8d1394aa74c3627126043b099ad8f798772e76f0648a868059c17876126b13c3f211c76a1fa438b986e2096c69780662bbf3ddb2459f3afb4c79cc1500f7b6077b09eb3400a7f946ca9f20cee59673cfb46e830e0242e8b2fe6aae123e0b3cc2f10edfdc92cf7efbbfb4fcb02cf31b438d89cc412167a3383bc88a21a22fbc4c027bf3f85fde9272a69abc962e43d4a76b8ac4f6ab46cc4cf00c5ea07a0ac0c518f996246bf56723ed7a768f5720da60f96b7bafc87c96b02e7f85e9410e98509746b54b959dd57280fe91f2a29c8e9229de1f856d50ec5d2498abff3e544ed5d55b32e28be2599f27218e681e3186c9899cd64c54283cabdc2b42ad3569a342416b2be1c2873bbbf08e61a7d019b42d08c5b81faf732b6bfdd606c5bec377dab2e84237adb71bff0dc8985bd23d70da2a694fa63b9ad2f1dbf8aac650e973ad784c56c9103fd26a2b55bf57b99ef94347c72319943cce6b05e20526b42ea792f1715e026c9e291f22619c2f92af2910ac57cb6a9a18766427fa91fbe2c85914ec796af69db05a8734515b1ab12527f6547dbfba9951e35141caaac6a8abf82cff231a3a69e0522882cd81aea534ad4ceddac00ecbba6058bb8facb172c3d2ed53852764d0d859f477d08f8187008a45dd4675ed588ce4e8fdba026be61012569644d535285498d4c542314c24fbb3e640fed0d7d1f33470f2d85fac91b084c1a97c99b1198f215842681dfb7a06fe5d09efe294721802712e8b05d0f03f8ed344ca1d18025515c9bc2d48703f4ccf891edbe53e0814bda9b143da88623f12d58cdcdfdea5339a853c65de445504bfe3c28f39aa66850b32ff5a4d9864adab8757db7197dcf7adf47040ec9fffabc71ec06861c28cf31f83e09ad7ae9aa6731b2173c2ea0ed2d1fd463166fb74e82a1507ca2bb095d8aca60100675b12682ca2003fb1c0629297aef061998f5c1b7bac9a82321c7d5193509330dfbfb9e1f69e5bccb753de49b51f0db840d8a48d075f7720c748cb731195bd02f231b0444c8cc1d03ed5cceafe8a82ba5131aebbb87de15b3a817cf4a089e124e3ac56e5c0ccdfd6223ccc381721ea6967b6cc6c107e2d252c622eb03f50d8c7515e0a125695a3bf3b7732478a8370c07ea76d7fd1b7b2644f8b68eeb23a61672c86c48e21a4e551bd702062b4e4cb3fabf8bae9099b7262293407e1de77b17e1314adf847014eed71fb32a240fcc160021eb119dab44c10fa210b0862abcb7606aa6376867907029f0f79a8f32c4c78f6a9ec0b819d84711afd84e1c4adf6f0f7b6e5e896a3625e933cef6742d7fcc05821f90cac736a235946fc30fe9c90f6874dbe04ae6c1df9849ebba670b5b12f60726fe2f1a3f52636516b55addc1a9fb422a1fea2f3d8e11764f825fa45e7181da456d73aa00a808bd827b03b3f542c80f9dda7e7b8a1fb95a361ce1c225663d288e00432aea6a0e5eef62d91d3b1971bda7a9e5a64045489fc3a87a4b6216748d95e945834dc19ad9303162f883e722b65b87fd568fb889978df01c3787d92b35182787462a2b6298e6455d2a7bc2aeb3da83eabb2180b1442c3293921dfce7a8e1aac5551f03082e31434136e87c631f35d3fec1f7e6a28fc7621d11ed913e646f73200a555ed41a8243751a470260159e8fee10d796350bf311f660013d4354cbba4cb58339b09fac1fb9a41314a59bdcea493044edcbb363daa256fdd7c9686f985226ed57fbb1091db29515088defb18e2fd1317b71145243d52f30e809b280bcc14aabd0491ac3ca5ccfb464e732f0c837a3be0bc40ed6bbe5e2ca1edbcdc155853823ad31813f5f51faf5336238c6ad7a28d7b5df4c337ab4c9e8bf270c06882fed285cb9d55704b1c62b91398f81dab211a041bef797d02a0b2428fa3da2070fcb7c33609156c808aa49c603e0a3642445438c5f2f5c77c77bd1024e1b8a9b8bcd8d8446e42f2027911e9312d84a07042f9102ca7b42b9fb8832f066e9e722ff69f83cef690eb285b3286059aabd418d7e5f7125e620ad81c1de31c1ebb42f199536fa29757a01096177f26e8e34502a51946a4973b9c02f75ba233680ad6a858e01449fdc63ea056f0e5e427f9fd80ff2971748e35b9850876ca4632ca069a7f828431b59526e9eb48e405378010a16f7609514181147f7cc9bc9e6f6d3bb9f6e55f3a033d1e6a5bef22293b7be1c3c5717bbf72d4b965aad0dfb4a8926f5b7b98b4b2af6019e588673e3f1411be0a75d6b39c30967b6b91037bd6b7efd0584b2c9a90f41629b942f5dec289818207299eb259da6be488a3e1086fe91f0e69f1ebf51eb3e822584f29542cff5c56041cc02c6141a8c997b99b78320a8c19f9a51e13bdbfaaca5a27f6f65b6b271d4897f2281c46d691afa1d8c539571c23497b7a9b20a1c2b7dc7fd847cf59c6faeda4b25f83e55b81d93175e6f9b5038f9a539649c887ab70af717f22d326c549c2c8d74a3c4673e710bf2f04cc2b1f2cfd255517b21cb36c0a29789ccb9f1ac8e7a7f9e6d4f0e6b48deafe1d1952f224dcfaa212124b027caec0ae13165b3d11cfbd45c11a7040e743d9396cb9b0350103329af036d004afe3b7fb59bdafc1756d6e924fc5f7d49e6bd997e7d96820ded3b533db45496d3b4867d752ef06c3724b932ce8db7e60d588e5e3e29b9f9ed9d5896371ca6ccf600338f7172bfc53f7b0f76c49eae2eb946ff7db1bc5ec67de54d6a18cc9b6b1f4e6f973ae112b27373a13a93a02363dad6b0c6a869a368b981aff5a283132b2561c543d3904448e5f689db4408d15693f2f9990fd2887037fb7c57cf6cdc6d75efbea1aa6137e5674d19464c3f17db34b2933a085917199f440624ba640cd329c434345359f78ff3703e21c677514268b88270d94ba87e20c623a179c7e2b91f64ba5692506fc97f5caf54147a94ee805740a63e27b2031e66aafd18fbfe1afe13e34bf1e94b2adb5002da30f7f6c8989b75981418b87b55bf4eff3c4055b1dbd89b4bd9c1f5978c24d49be841cc65decb7112476c15c427d6931f266eb189cca3177080c1e1680629f460522e49e26350ad418abc0be6baf7348ac1ef94afbd01dd6351a30d7ab72542b8a3ebc5f311c85ea75496500fc808366ae3a2e1960f7ef60eb2d0f1bb893c1b8b2b3039c163bfafe5cad232452f7505393d2f37638c18e58eebcfc85de079c78f2de3775906f1796634db1a0984f19f0a721829c480d731f29fbf1b88fe18c328b68ed165fe13d1c097f8cbb9c49b37d7e3c0937cc030b616fdced8182cfb1149a9b81d9ad6a28c18b63da098c3249613f0acf55bf9776f32d36094169f4ae42fa0ed533c9bfa06d398b49b3dfabda5644552b32d993b22ff64de1a6509c03edd5c7b5ec10aba787d1d7ef127e54bcf05cd1d01f430cad66243ad2fe6e113aaff20dd72c00e0a36ae3c1bd5317849439373cf2e84e0aec062dd55a8133d81e05987115cde866aab4be0e8250b57e278807cf87299b7a845d3c644f29734713b04f8ab88eeee8dcd24287cdaef48d1d242a7d20d2fc1a74f11688a9771c03efbc9d7db4df0ba7b96974b3a9636333dd3e04bc95e96a76698a457578d9d7d363c32aaa58c049b31adda5c3317d50a9e1e65bbc9a9f6d7b357b560dc31b1b04e667bd0c527377fb9d9b5f9864f00139952e0b67615937a85543689fe2307e5dc6ad24318782a0e8cb1679bea8a236aa57fae93adb07cf0c03e6a2d80449ebe38ef7bdba6a52be62bbbfc4b0d5c4b2b2d71b8a54f346e35b5010acd8d38607484afe370620b824b7161048a05a04e5d9c10c3eb2ee870d3e15628877746a0818b23748b6a87c7105646e48b85d0fdd28c711ca9dcd338a721b6751dd68fb1202c8e50d2396e416538ba8d4fdc091a6dd7906173ba355591f60e5df619d4e1094d422470e1c460707ee8c9cd64614268f4c9bda96c8afb0297eee84a48a54d5b75f677cc11cc706ef61ded4ab7674595b3a12fd59c3b9b73913060bb5dfea101162939a5f59b1db67799228793216136b587939b1838b3405548c585b1d43f89db1880c43ddf1c84f3fb990193f7a80974d6ecfa7cdcf8f1308f5126a763783c2dde363d6513ae80d290c652f94a0929e600c34c7f23656c9c42a9cb232579363c771b60b2da0b00b1cdb7487e260b851a98a08065bdf509baa434751e1c4f9941cbb1b14e5b847aeac4eeed22a5416e36ef78d74e9810f23355abc295eaeace0169dd87f89ddde32f9ed3e41f0e650cff224b7dd43d9f1c3b9b0e2a6fc2ea3e18c6b14ee67a336fc8a43a79cb4b5d2a4cd0b5e3af66a50f40d1b62f7587aec4495e50df063b1165ade3dfd07f540d2fd40663703ebb7418a4c9d4224d4e9bc6d0b899cb6e8b2a1940b568dd863d4772d368d10ba3156cb50598f1ad2f14e1a0228f5f7ee918f32ee6fc83f01bf8077d6dbb644a12c476832da842e08f2164ee35a781927671783aaf1aeb944e8c7e164a9399ffe76beb61e887f1a294aafa479051e18863a6932f36423c301a333912992d2d918646549064e857a56b760bd7ffecdbb8f88fcc81bb22402eff3186e518e05f5f61bb4c54a944f26f31b1537a4da2cb1f7c7a7e4cbe3f90b92ed116084fba0f1cbc56c392e43a6c512c7f72f9bcd2a2ad796689107d401503cabe20864eecb1d027675e24b5f13bb1c07bdce85dc16c207b66870b56255d4c00635a2b4555f83da23ee2332c1301a650208429ae24d8a") (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) recvmsg$unix(0xffffffffffffffff, &(0x7f0000001300)={&(0x7f0000001140), 0x6e, &(0x7f0000001280)=[{&(0x7f00000011c0)=""/46, 0x2e}, {&(0x7f0000001200)=""/85, 0x55}], 0x2, &(0x7f00000012c0)=[@cred={{0x1c}}], 0x20}, 0x1) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async, rerun: 64) ioctl$SNDCTL_SYNTH_INFO(r1, 0xc08c5102, &(0x7f0000001080)={"f6530a4a264701cc512f180bbe62e5083f5eed0fa83b6e1a803f7ae414cb", 0x7fffffff, 0x2, 0x1, 0xc0e8, 0x1, 0x1, 0x7, 0x4, [0x5, 0x4, 0x9, 0x0, 0x8, 0x9cd, 0xaec9, 0x7b42, 0x40, 0xee, 0x1, 0x100, 0x5, 0x7, 0xb1, 0x400, 0x40000000, 0x1000, 0x40]}) (async, rerun: 64) ioctl$IMCLEAR_L2(0xffffffffffffffff, 0x80044946, &(0x7f0000001040)=0x3375) 14:08:02 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x2, 0x4}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x7) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x4}, 0x6) 14:08:02 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:08:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) ioctl$SNDCTL_SEQ_GETTIME(r2, 0x80045113, &(0x7f0000000080)) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x3, 0x1}, 0x6) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r4, 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r4, 0xc0045103, &(0x7f0000000140)=0x8) write$bt_hci(r3, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0x1, 0x3}, 0x6) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) 14:08:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x2, 0x4}, 0x6) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x7) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x4}, 0x6) 14:08:02 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x3}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0x2, 0x1}, 0x6) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r0, 0x0, 0x0) (async) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x3}) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0x2, 0x1}, 0x6) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:08:02 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:08:02 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x1411, 0x400, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000015}, 0x0) 14:08:02 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x1411, 0x400, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000015}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r1, 0x0, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x1411, 0x400, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000015}, 0x0) (async) 14:08:02 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r0, 0x0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x3}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0x2, 0x1}, 0x6) (async) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) ioctl$SNDCTL_SEQ_GETTIME(r2, 0x80045113, &(0x7f0000000080)) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x3, 0x1}, 0x6) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r4, 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r4, 0xc0045103, &(0x7f0000000140)=0x8) (async) write$bt_hci(r3, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0x1, 0x3}, 0x6) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) 14:08:02 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:08:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x2, 0x4}, 0x6) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x7) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x4}, 0x6) 14:08:02 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:08:02 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, 0x1411, 0x400, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000015}, 0x0) 14:08:02 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x40, 0x4) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) ioctl$SNDCTL_SEQ_GETTIME(r2, 0x80045113, &(0x7f0000000080)) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x3, 0x1}, 0x6) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r4, 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r4, 0xc0045103, &(0x7f0000000140)=0x8) write$bt_hci(r3, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0x1, 0x3}, 0x6) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) (async) ioctl$SNDCTL_SEQ_GETTIME(r2, 0x80045113, &(0x7f0000000080)) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x3, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r4, 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_CTRLRATE(r4, 0xc0045103, &(0x7f0000000140)=0x8) (async) write$bt_hci(r3, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0x1, 0x3}, 0x6) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/binder1\x00', 0x800, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) (async) 14:08:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) 14:08:02 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) 14:08:02 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$MEDIA_REQUEST_IOC_REINIT(r2, 0x7c81, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) getpeername$unix(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000000)=0x6e) 14:08:02 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0xf0) connect$ax25(r1, &(0x7f0000000080)={{0x3, @null, 0x3}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48) bind$bt_hci(r0, &(0x7f0000000040), 0xffffffffffffff12) 14:08:02 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x40, 0x4) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:02 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$MEDIA_REQUEST_IOC_REINIT(r2, 0x7c81, 0x0) (async, rerun: 64) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (rerun: 64) getpeername$unix(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000000)=0x6e) 14:08:02 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x40, 0x4) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x40, 0x4) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:08:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) 14:08:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0x2, 0x2}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) 14:08:02 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448df, &(0x7f0000000140)="690956b81a5e35034d7ad000007099b56a9b3f2e88ff835bc97c8edeceaf7f67929367e27fdae5630700bf973491607195b07f8d4d89f33fd60000000000000000000071a7947e9cd022437e3b85b84603630d09d86289859819cd0f7fa1aec013e92ec602e2b4402d18bd6488becf8caa2491f492448839f020803369c273405f3871ff90b0009fe527ea1d0408c78897df1cac74") setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000200), 0x4) ioctl$sock_bt_hci(r0, 0x800448c7, &(0x7f0000000080)="6be75fda9c0173b10d413ba8f0e214f6d383ac8d755a71416bcad704375590f6ccce9c1636211911be1a5de98e59b85f2a91acdd443c8e7c1758bbbfbc1af9c7626d14d6883c290edcbbe04d649d98843c605987c09f5a7c16b10ead9e8d95680b9733880a9f0fc175e4d58bd5666b4ad08d59affa67ae62be653750f5703d8e2cb152b135d5a6ffede0db357ac3f4b2a78367388bc7bdba3c334345ac") r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x80) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x1, 0x3}, 0x6) 14:08:02 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0xf0) connect$ax25(r1, &(0x7f0000000080)={{0x3, @null, 0x3}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48) bind$bt_hci(r0, &(0x7f0000000040), 0xffffffffffffff12) 14:08:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0x2, 0x2}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0x2, 0x2}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) (async) [ 2836.579402] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de 14:08:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) 14:08:02 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448df, &(0x7f0000000140)="690956b81a5e35034d7ad000007099b56a9b3f2e88ff835bc97c8edeceaf7f67929367e27fdae5630700bf973491607195b07f8d4d89f33fd60000000000000000000071a7947e9cd022437e3b85b84603630d09d86289859819cd0f7fa1aec013e92ec602e2b4402d18bd6488becf8caa2491f492448839f020803369c273405f3871ff90b0009fe527ea1d0408c78897df1cac74") (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000200), 0x4) (async) ioctl$sock_bt_hci(r0, 0x800448c7, &(0x7f0000000080)="6be75fda9c0173b10d413ba8f0e214f6d383ac8d755a71416bcad704375590f6ccce9c1636211911be1a5de98e59b85f2a91acdd443c8e7c1758bbbfbc1af9c7626d14d6883c290edcbbe04d649d98843c605987c09f5a7c16b10ead9e8d95680b9733880a9f0fc175e4d58bd5666b4ad08d59affa67ae62be653750f5703d8e2cb152b135d5a6ffede0db357ac3f4b2a78367388bc7bdba3c334345ac") (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x80) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x1, 0x3}, 0x6) 14:08:02 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$MEDIA_REQUEST_IOC_REINIT(r2, 0x7c81, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) getpeername$unix(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000000)=0x6e) 14:08:02 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x4, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x9, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0x2, 0x2}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x4}, 0x6) 14:08:02 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0xf0) connect$ax25(r1, &(0x7f0000000080)={{0x3, @null, 0x3}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48) bind$bt_hci(r0, &(0x7f0000000040), 0xffffffffffffff12) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$ax25(0x3, 0x3, 0xf0) (async) connect$ax25(r1, &(0x7f0000000080)={{0x3, @null, 0x3}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48) (async) bind$bt_hci(r0, &(0x7f0000000040), 0xffffffffffffff12) (async) 14:08:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SIOCX25SCUDMATCHLEN(0xffffffffffffffff, 0x89e7, &(0x7f0000000140)={0x67}) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x140f, 0x800, 0x70bd2a, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x9, 0x45, 'umad\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x0) [ 2836.681385] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de 14:08:02 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448df, &(0x7f0000000140)="690956b81a5e35034d7ad000007099b56a9b3f2e88ff835bc97c8edeceaf7f67929367e27fdae5630700bf973491607195b07f8d4d89f33fd60000000000000000000071a7947e9cd022437e3b85b84603630d09d86289859819cd0f7fa1aec013e92ec602e2b4402d18bd6488becf8caa2491f492448839f020803369c273405f3871ff90b0009fe527ea1d0408c78897df1cac74") setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000200), 0x4) ioctl$sock_bt_hci(r0, 0x800448c7, &(0x7f0000000080)="6be75fda9c0173b10d413ba8f0e214f6d383ac8d755a71416bcad704375590f6ccce9c1636211911be1a5de98e59b85f2a91acdd443c8e7c1758bbbfbc1af9c7626d14d6883c290edcbbe04d649d98843c605987c09f5a7c16b10ead9e8d95680b9733880a9f0fc175e4d58bd5666b4ad08d59affa67ae62be653750f5703d8e2cb152b135d5a6ffede0db357ac3f4b2a78367388bc7bdba3c334345ac") r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x80) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x1, 0x3}, 0x6) 14:08:02 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x4, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x9, 0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:02 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0), 0x2e) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x400040, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r3, 0x80045105, &(0x7f0000000140)) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000080)=0x5, 0x4) ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000000)=0x1d1) 14:08:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SIOCX25SCUDMATCHLEN(0xffffffffffffffff, 0x89e7, &(0x7f0000000140)={0x67}) (async, rerun: 32) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x140f, 0x800, 0x70bd2a, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x9, 0x45, 'umad\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x0) (rerun: 32) 14:08:02 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x4, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000000)=0x9, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:02 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000080)=0x7, 0x4) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x8002, 0x0) ioctl$SNDCTL_FM_4OP_ENABLE(r1, 0x4004510f, &(0x7f0000000040)=0x5) 14:08:02 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0), 0x2e) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x400040, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r3, 0x80045105, &(0x7f0000000140)) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000080)=0x5, 0x4) ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000000)=0x1d1) [ 2836.783224] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de [ 2836.822119] ax25_connect(): syz-executor.0 uses autobind, please contact jreuter@yaina.de 14:08:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$SIOCX25SCUDMATCHLEN(0xffffffffffffffff, 0x89e7, &(0x7f0000000140)={0x67}) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x140f, 0x800, 0x70bd2a, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x9, 0x45, 'umad\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) ioctl$SIOCX25SCUDMATCHLEN(0xffffffffffffffff, 0x89e7, &(0x7f0000000140)={0x67}) (async) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x140f, 0x800, 0x70bd2a, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x9, 0x45, 'umad\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) 14:08:02 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x20201, 0x0) ioctl$IMCTRLREQ(r1, 0x80044945, &(0x7f0000000080)={0x4, 0x80000001, 0x7, 0x5}) 14:08:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x6, 0x4) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:02 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) sendto$ax25(0xffffffffffffffff, &(0x7f0000000080)="fadd65d3821e444be6ad039f14751df10a381014104417ff67d1b1efe685dc8248af1aa3821fd395eb2f485967b9e719f41ef46d98a4067a2cb3eab859ff0ea9124db32d5056134d1c655c7df2ebd751ad3429f2fff1aac54ecac1e99bcdef59cae9f99c6e61eebcf4287b6b3cbed01353d3b9618f9dee1465bfa52a4a4f0526eabf9d3ac809e0b922ec7463c5b2593d706a148ef86addfcc32555d0b27c54f296429a78cae5eee88cc0d7", 0xab, 0x800, &(0x7f0000000140)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x3}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}, 0x48) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000000)=0x7fff, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000200)=0x9, 0x4) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r3, 0x0, 0x0) setsockopt$MISDN_TIME_STAMP(r3, 0x0, 0x1, &(0x7f00000001c0)=0x1, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 14:08:02 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x20201, 0x0) ioctl$IMCTRLREQ(r1, 0x80044945, &(0x7f0000000080)={0x4, 0x80000001, 0x7, 0x5}) 14:08:02 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0), 0x2e) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x400040, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r3, 0x80045105, &(0x7f0000000140)) (async, rerun: 32) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000080)=0x5, 0x4) (async, rerun: 32) ioctl$SNDCTL_TMR_TIMEBASE(0xffffffffffffffff, 0xc0045401, &(0x7f0000000000)=0x1d1) 14:08:02 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000080)=0x7, 0x4) (async) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x8002, 0x0) ioctl$SNDCTL_FM_4OP_ENABLE(r1, 0x4004510f, &(0x7f0000000040)=0x5) 14:08:02 executing program 5: ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000080)) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x98900, 0x0) write$P9_RWALK(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="3d0000006f0200040002030000000600000000000000020100000002000000000000001004000000020000000000000001040000000500000000000000802679407941842bea6ff9bd35e0914fda11ccf9d8bdb3ba75b2110603876f18fc6dc6217ab2cabe2c32061d3ed6c04312cb48b05bc3780f9343967f5945e2c3c4f1dd28eda192c7a55170b20bc4d582addbe01b4fb113845b3244b436ceebf5df4355ad7ef11e68310ac16cde309276ea0832d3ecd5"], 0x3d) 14:08:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 64) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x6, 0x4) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:02 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) sendto$ax25(0xffffffffffffffff, &(0x7f0000000080)="fadd65d3821e444be6ad039f14751df10a381014104417ff67d1b1efe685dc8248af1aa3821fd395eb2f485967b9e719f41ef46d98a4067a2cb3eab859ff0ea9124db32d5056134d1c655c7df2ebd751ad3429f2fff1aac54ecac1e99bcdef59cae9f99c6e61eebcf4287b6b3cbed01353d3b9618f9dee1465bfa52a4a4f0526eabf9d3ac809e0b922ec7463c5b2593d706a148ef86addfcc32555d0b27c54f296429a78cae5eee88cc0d7", 0xab, 0x800, &(0x7f0000000140)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x3}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}, 0x48) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000000)=0x7fff, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000200)=0x9, 0x4) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r3, 0x0, 0x0) setsockopt$MISDN_TIME_STAMP(r3, 0x0, 0x1, &(0x7f00000001c0)=0x1, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) sendto$ax25(0xffffffffffffffff, &(0x7f0000000080)="fadd65d3821e444be6ad039f14751df10a381014104417ff67d1b1efe685dc8248af1aa3821fd395eb2f485967b9e719f41ef46d98a4067a2cb3eab859ff0ea9124db32d5056134d1c655c7df2ebd751ad3429f2fff1aac54ecac1e99bcdef59cae9f99c6e61eebcf4287b6b3cbed01353d3b9618f9dee1465bfa52a4a4f0526eabf9d3ac809e0b922ec7463c5b2593d706a148ef86addfcc32555d0b27c54f296429a78cae5eee88cc0d7", 0xab, 0x800, &(0x7f0000000140)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x3}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}, 0x48) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x7) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000000)=0x7fff, 0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000200)=0x9, 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r3, 0x0, 0x0) (async) setsockopt$MISDN_TIME_STAMP(r3, 0x0, 0x1, &(0x7f00000001c0)=0x1, 0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:08:02 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x20201, 0x0) ioctl$IMCTRLREQ(r1, 0x80044945, &(0x7f0000000080)={0x4, 0x80000001, 0x7, 0x5}) 14:08:02 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x7b3875f8, 0x4) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:02 executing program 5: ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000080)) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x98900, 0x0) write$P9_RWALK(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="3d0000006f0200040002030000000600000000000000020100000002000000000000001004000000020000000000000001040000000500000000000000802679407941842bea6ff9bd35e0914fda11ccf9d8bdb3ba75b2110603876f18fc6dc6217ab2cabe2c32061d3ed6c04312cb48b05bc3780f9343967f5945e2c3c4f1dd28eda192c7a55170b20bc4d582addbe01b4fb113845b3244b436ceebf5df4355ad7ef11e68310ac16cde309276ea0832d3ecd5"], 0x3d) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000080)) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x98900, 0x0) (async) write$P9_RWALK(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="3d0000006f0200040002030000000600000000000000020100000002000000000000001004000000020000000000000001040000000500000000000000802679407941842bea6ff9bd35e0914fda11ccf9d8bdb3ba75b2110603876f18fc6dc6217ab2cabe2c32061d3ed6c04312cb48b05bc3780f9343967f5945e2c3c4f1dd28eda192c7a55170b20bc4d582addbe01b4fb113845b3244b436ceebf5df4355ad7ef11e68310ac16cde309276ea0832d3ecd5"], 0x3d) (async) 14:08:02 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000080)=0x7, 0x4) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x8002, 0x0) ioctl$SNDCTL_FM_4OP_ENABLE(r1, 0x4004510f, &(0x7f0000000040)=0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000080)=0x7, 0x4) (async) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x8002, 0x0) (async) ioctl$SNDCTL_FM_4OP_ENABLE(r1, 0x4004510f, &(0x7f0000000040)=0x5) (async) 14:08:02 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x8) getsockopt$ax25_int(r1, 0x101, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000080)=0xfffffeff) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid\x00') getpeername$ax25(r1, &(0x7f0000000140)={{0x3, @rose}, [@bcast, @rose, @remote, @bcast, @default, @bcast, @netrom, @rose]}, &(0x7f00000001c0)=0x48) 14:08:02 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x7b3875f8, 0x4) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x7b3875f8, 0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:08:02 executing program 5: ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000080)) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x98900, 0x0) write$P9_RWALK(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="3d0000006f0200040002030000000600000000000000020100000002000000000000001004000000020000000000000001040000000500000000000000802679407941842bea6ff9bd35e0914fda11ccf9d8bdb3ba75b2110603876f18fc6dc6217ab2cabe2c32061d3ed6c04312cb48b05bc3780f9343967f5945e2c3c4f1dd28eda192c7a55170b20bc4d582addbe01b4fb113845b3244b436ceebf5df4355ad7ef11e68310ac16cde309276ea0832d3ecd5"], 0x3d) ioctl$BINDER_GET_FROZEN_INFO(0xffffffffffffffff, 0xc00c620f, &(0x7f0000000080)) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x98900, 0x0) (async) write$P9_RWALK(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="3d0000006f0200040002030000000600000000000000020100000002000000000000001004000000020000000000000001040000000500000000000000802679407941842bea6ff9bd35e0914fda11ccf9d8bdb3ba75b2110603876f18fc6dc6217ab2cabe2c32061d3ed6c04312cb48b05bc3780f9343967f5945e2c3c4f1dd28eda192c7a55170b20bc4d582addbe01b4fb113845b3244b436ceebf5df4355ad7ef11e68310ac16cde309276ea0832d3ecd5"], 0x3d) (async) 14:08:02 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) sendto$ax25(0xffffffffffffffff, &(0x7f0000000080)="fadd65d3821e444be6ad039f14751df10a381014104417ff67d1b1efe685dc8248af1aa3821fd395eb2f485967b9e719f41ef46d98a4067a2cb3eab859ff0ea9124db32d5056134d1c655c7df2ebd751ad3429f2fff1aac54ecac1e99bcdef59cae9f99c6e61eebcf4287b6b3cbed01353d3b9618f9dee1465bfa52a4a4f0526eabf9d3ac809e0b922ec7463c5b2593d706a148ef86addfcc32555d0b27c54f296429a78cae5eee88cc0d7", 0xab, 0x800, &(0x7f0000000140)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x3}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}, 0x48) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x7) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000000)=0x7fff, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000200)=0x9, 0x4) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r3, 0x0, 0x0) setsockopt$MISDN_TIME_STAMP(r3, 0x0, 0x1, &(0x7f00000001c0)=0x1, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) sendto$ax25(0xffffffffffffffff, &(0x7f0000000080)="fadd65d3821e444be6ad039f14751df10a381014104417ff67d1b1efe685dc8248af1aa3821fd395eb2f485967b9e719f41ef46d98a4067a2cb3eab859ff0ea9124db32d5056134d1c655c7df2ebd751ad3429f2fff1aac54ecac1e99bcdef59cae9f99c6e61eebcf4287b6b3cbed01353d3b9618f9dee1465bfa52a4a4f0526eabf9d3ac809e0b922ec7463c5b2593d706a148ef86addfcc32555d0b27c54f296429a78cae5eee88cc0d7", 0xab, 0x800, &(0x7f0000000140)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x3}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}, 0x48) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x7) (async) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000000)=0x7fff, 0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000200)=0x9, 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r3, 0x0, 0x0) (async) setsockopt$MISDN_TIME_STAMP(r3, 0x0, 0x1, &(0x7f00000001c0)=0x1, 0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) 14:08:03 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x6, 0x4) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async, rerun: 32) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (rerun: 32) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:03 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x6e844f6032ffc43f) ioctl$sock_bt_hci(r1, 0x400448de, &(0x7f0000000040)="6584ff9243e36e62877cbb5bfe0cd9f3d821f5aa39eca0631014a8f33000f31a81317c149c2ef8b9f73dfaab5f6995bbdcff798204107e88848366f531de5d0841547bcbaea0e8452002ecaff2f6e82f3bfff804346d51a61eea70adcdbd5c024de0ec7c0c988f1eee327399e0430914b03cfcaec440f3d0a964628ea114d823635ebbcaec527611abfee7644878fa60e8f4cd57e7676721a95d73c3a6a3b8ed9fbfe58aa5d927a86d50cb0ccb0f0dc62ed18726743946d2fbfddbe02da6576b6fb4aed3d363201d4a624e568c45ccc2eb107a08255e78c6649bde5f0890ba4a045346f615a104cbaf951b318453592d82fed03001c0a558a9beffdef968eaf0ade94561d5042bdc87c6ec912e15d8e0c4fcb7879ce2f22fd86b524730647723c3657ba4a5a19b0222754bf9e9a03d814733842d4a72d5f8a7d7193025235d47626066b20ecbcd38c5b8c7aca1a7e7e5d5352e1ae3c261f408c5e7d593f5417a0b195298b73dca6980447f27070cd58528a962bc3ec242524830bf6c94e6b56d4e04b80da9f1fcfaa9c0c7916c43c399364c8c81cdcf06b63ec3bb4cec0647860b0c85c1ea2cf0a111c9dda72c6816f84cd830e41a55dac68e953be811d3d7955d0dee339ba81289f10a646a010a05521830c99ec05f7705379f2ba8c5120b843ee72becfa5a1a253d154f1b4860bfd9b6353dc05386c6f2740365f732ad164254ced6080322ae61f8e2fbc2216e041bf2f3474d10b0e3c253da1bdccdfa341abfb6eaf4e7518974b04de589491c3f39bddd36e01af439d862943d84584fc1cf3da0ab09a8943fd817376de5829194e6323c75cc826e3ce216a9484fef19604c69d4c871fe5124e871c320e6e16ce8199b00c38c8558a1da7d2838af28fb2756b7a4bdffeb377c3a9042dc1ed629a1916cc787bd1d287a817d10b5f970c94c04edb2183b21b51527b92b73ad42d43583850311b92e3bd20e8c8277aa64896b64d938543d7caa74c9f9012f1c2b1ae788d259bcb2748e79bbee5499067fda2d68b0d3fab5f0367023031f037320bf73f3780b3e1254627bc483b0d9f6bf004d5f989cbfe39a7a2f34433f1030073f734514dcf54a424af4a95fd4c2296978d973d0a1c71ab130ce2e24a130a72199bd1f2a3abe0f535f18ee0f8faded190367448c04d44b811fc0e86d7dc6c1d8b17c44cd0ed0adca4dede8961715674d6d8241d0779e4bd0ae4bc4a8033a7765c8f92548215b6554f181fd54c30a514b5890ac7e16a5682d205ac34fc8212250667d6e893bd10871c02f2312aa730141337103f2d3799588ea613f3945bc57a057ae213a1bcdfbfd83aa1deca10006a3834e419cd89cc8f7f9a453530ba97fb7390e930d3cf59300bffcbcf9b86ec302e087368d8b6666a37188237bb5e60549427364b43d54c785f7edafe6bf6bef7a67457f00fecd283f44038d8e6057065fd6f89a37c980da387441bdca7e282103dfd5d153031090f355d3e6b4c43ec4336ecaf1a3993f8879283605cd504af6ba2c1efb065526b8696e8555035faaf54ed9dd1d7acac527d2481234ecd275f86eeef4d112a317d4cf78afe6cb92da36d55289743517c5aefcb3719e9ec4df07719ae3b8db321642b7dd65324b394c536d8b924d89b4f7c05c66f8bc588d4d7a711135bb0e35447a9db099475b7f8ff693d51aa440689ffc03c5cc77e98195ac7001a418f5028dcc4d226b1be10d87e2738b9dea425f64212198d3217b8cbad27ade90c637cb3be0ca7cfa8dffd6d644eda472f4fd1448838e1ef3053331af57cf95466117cd78767d9a1ea7da5a6daec4b0eacb8211b8fc641253900f050bbc8fca3ad2d38b07fd84ad3d3abff99b533beb67a72b0fb5851e6d10c13a4dcabd9e61d67bc59e4e30bfe94b3924d1c46ab52d20960745687b1ae5320906dd5569f69c3875b939ad5fa1017c5573fc027c37e23409ad08ee5a1ec4210eba8dbc43afaec65916fc3177dfcae19640cf6b00a12fb90ef2994269a2cfcb75c1f8276657d4cf1f525d0079e01c4e653a1e4e252ced5503c9dfe30ec88a98305f71e7dd631517eb1cdeb36faa4e8a757b23f9fa756926ec395168e1bdcf1fc0dfeb5fd33b03381b01e8c891427b5c23ea9dae0b38f74c1a0108d3aca0faa00c3772d718785fa765c777a9d16eef5d2c4bf0884fae7eb7807de4c976f927b80b48db61103113f187a31edaaff50865a79bb984c2f69e5d470ec81e08bd816937f32dbd9e34c321f433917659f6a6908b772052140011c58bb91966d427ac9932f88fc13ed1faad2094d46ea7bf1e72c06a5de3b43fef36703f3a14e6d4e3bf46d49b1d065c0cb3870cbd98e1aff2aad6d2f951efb179a06af35685aba016cfafe68ac5252dbf2ac0641851acd82825cfd46bee754034f249e91784d2c1f2513b38b016bd1421bf68a6e0b3b387777164c239a8bc2fed8a4c02e18daf231cec29395a2b6b955821021f4f941fbe23016afa2c3ecd5ecd51c1d0f8a825f73b38b4b037171f1c6db25b504683705c3a42fb8cc7686aee9303e8cd6774ac963b6746aee09cf9515296ac830ab0169865429919d0bdd59ccffe33e70740fb48c82ae033568bffa18764941249a8e985b70e680dca72ab42a7b81f087b150477e9acc3bd267722aa4673dc593290e36e4654738d663d86eebcc52f324cd0d2ba13ae82c6751a727e7ac109fc47379893121d7f406fef59f2c3b4de97c242b64ebfb4e5239cb7f05188f5650842864495eb4ff380aaf47b534e563106cc946c910a312bac2ad5e41279aaab83977726d43d48c5373a2d4ea0482a6c70953ad277a8852bf17e7d576bf547a04934596d7a05b22df8a55bcc9a4f67139b61b936ef8999c263219295a12eeca31ed072894246a073d2ff5d440d72707c3a34544bfaf56aa16c73a4cc7f057e1fc680d71ffb20b0e26aa7db1262783fd0fdebeb6ee6b726218478a4f8d8d4eaff1baf998277a4eb147ee261c3f7eda2669de5f549e425c446dae5e2ea0aea0c7f97b24c84f3d516f7b4467626a061c7f0c122a8890b26529c4eef766f99e043694e0cfcc5db1fba4a3b4b381011dbc1cfd21b4ff519fc4a11adfd0d241d13b8e7700d1b395ddf4b2c0676b1b7021614ae7f6e16aef12e1e488342e9c675016feb057574548b04cb9b898fde15d448e9e9e5977d4b0993841d605541895b53cf372a0876eac5227e5824436e2fd10b5f3af6cedff98349b598b7becb898cc410cb2ced0e925f14596e2e5197d3ca9477d5bba3a3337c9382d923e9bd7265cdda175deee7dbc26b592cdb142fd3b90a5280015430fa3be749ea3d9512706b847b5e20910ba992e721204dc34502c52a95bbf8c4d491bdb0589c4c96027e31aa48f2ac205552832620500d434fd17e0dd2d9e70c5ee3bf5b1bc4d7513fc879370d4afa723940ef4dc06b6d0bc4123e98142a718e07448e0500eea0c64ad9977670d3197b04d4ac286558db1fa850cbd533c1638611922209a208537d985bfd75f36de00f5284f445a1abafc1c8d8833b30a138d6482e6739869111a3025d8f9552e5301d2f115d2713c58c50af334c0f3267f96dbfc5a97907a2f5db33bfb8c671687c7d1374e5d33d3643ac391fd7e3f61698c15a9f9c914005980436a94d743ffb6c32c97871c558ba1350375dba90394bac98c15f8447974bab596c9bc900aa9cb55ac2aa00ed15428f9962acbfd29816c0dac8fb332ca98442e059e731b1cdb48b6a4e17d85e232b9baada10f0a2268327006b5047edc78dc3b10fcfd7fc2c995abe2b5904703d866cb263a141b8080b36e5e01ff7156f44e411049ce629982fda0a117fe8791a7ed1028a42c639dc0db90fc5e8f9706e3f3dbe0ab33ad855cb73af0a05673801574ec9a439bcc465b48f88995dab47e1f09a253162b8c7a57eae349c234d2284c1dc49b31439516525008012490ea738c0c29a75cc4704f6a37414a61ca4f5a50d19a69235d6cc74f1d7922b04a2031cc1782c73af2047cefb8c0c15e5a3682dc99577190af2375e2592ea7dd30cf6e2b91055da92b18ac864542382868103a0bc8f19883da6293ba16b945445f4b586cd015a22ef71cf9dc504ce6c27108c9ad8d6dab4237ba88789572f9ecaaa5a374714581c3fddcbb984710edc2dbca11aa3a2f385c8da297d2eed8bb966414e5a7b1b7f23ce26bc17289d418f73061936bd082a13c9c67be491f4af9bcf2f41156714d380bbec0f2c882d0f61480e1ac07b828d8f88c00cb13cd7d193ca6083fdd8a88e921d70ca0f6026c8c989ab6bb24ffb5f3870faccf2160db5782a294d11248827224b8aa9257ea00554bf7173ff14df6bea41a27bc6592985a7c82647fdf88bb10290abc939550129171f4944afcb824004f6eb50e906d2d43b7c1f29f93e6c97d5a9a0451d8f43c2fbdbfb1fbb6e0abf8826a2e3f1c1d114e92b0089a59598c3d940031892b71e7e09391931ebc9793b79fad267e636865e6e09b9509233dc0c840198bba3f4bb21a70f8f03144b984cb5d7d01717661c326d617554ecc5fc0e8e4ec984c53289af36b9545690e9157e2be2a1bed3d803653dc39fb09e789e6112447b943070fc42c6742e536cb112eee3705d139253899860a936d6a8842c925d6684eda50cfa022b973a9e096a8b0b2fd3d679d6454507e8c09f1bb0976000fb1e9992fccc211f3561a444cce227126ae98567b6de8e65ee4d30e0b33dd2ea1e2519f7463909348a0e01279e4cc230ebbe55107ec9de9a86c3672b344af0b4a3bdbd90cf973b6ef8899fa3ebd68720ab0efb056a1e0f560b0a8334df7d097f8ccf2b998665d677308d20a697bf3b2af9b00d7809694a4982ab3c35f364f6edea9942a16372429b431271e61a27abf6177638f6e136df39f5b30571bd24a072de6661987b6b8a9eb8ef6415107cdf844b3578042631c7ddf52a6fda249244376d9db13f84d7a6708d4d503a89745253858eed031d87a09a0d71ce669b81092e2ec03c1798036266c61d4b50794a77b25a3790011b9398b3696de5941a25e9afda5690eea27387d57befd9d5d9b8c274c9c29a7e23f17cbdef64a3baace0b5a7ce57f9b2f0e3eef0aefc68f05b36ca6172de31cb331d0b9cfeeb91ff0046da554e5c896470a592a724322f197a30a929249d8ab0a7dd4cb49822d7b0c873feaa6c36b820840a2363157d7d8348bee8f4c02e4af1f3b0eb7d4057d41e9e23703dbba47a46cd0a926269ccefec0075a4fbe3d6ea2ba835467e18633b6b2486be809fb7bb558524f8db14f0d2c0e0c7e32999814a53594c7f73cab8780aaaa83fb9c54e4d0abc44afd0160f5c5ba49dcdbe32400498750a361579469de26d6581d6541d4991f7d9a947a99c75e2b234cdbf05fed7537eb436cfc73c7138167559060124bc5634a542ce6dbec4767e2fa315917b1463c6a5d9c5991b9f784d7719d4b94557caef1f3342311db80f6bbece99182c6b8b067a7c4e99e4d3107588c828c8f7ccd6d82e20363438899b6a8c520a2825d55faab6ac7a67c34ddfb1da30a547be2f877cc8fc82163d67a392ef866894f19e6eff127011b1455d31c01aa90719da26912afce4768c427e736b61535cfc10b5f810aca51925d0f82436f12a48b8a166b9c2e3a33f07b7062741aca76a8f9bbd2673957a04e59724b23eea4770f9c51ad1b930c3b001eb5e10c9e6d33869d2c75774078e327c53444fbf9a8bb75774e1670ab8a67a27eb2cb70a195b984d8d132ac8d6129efbaf0e320752a6ab26679753bf08") ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:08:03 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x400d40, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080), 0x4) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x1, 0x2}, 0x6) 14:08:03 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x8) getsockopt$ax25_int(r1, 0x101, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000080)=0xfffffeff) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid\x00') (async) getpeername$ax25(r1, &(0x7f0000000140)={{0x3, @rose}, [@bcast, @rose, @remote, @bcast, @default, @bcast, @netrom, @rose]}, &(0x7f00000001c0)=0x48) 14:08:03 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x7b3875f8, 0x4) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:03 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x400d40, 0x0) (async, rerun: 32) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080), 0x4) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x1, 0x2}, 0x6) 14:08:03 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="a6000000290100ff0700000804000000070000000000000081000000000000000107002e2f66696c6530d103000000030000000000000009000000000000120407002e2f66696c6530000300000006000000000000000337c8622f7878bcc3f5d08ff5bee4cd3c000000000000007f07002e2f66696c65300002000000020000000000000006000000000000000907002e2f66696c653004030000000000000000000000df00"], 0xa6) 14:08:03 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x8) getsockopt$ax25_int(r1, 0x101, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000080)=0xfffffeff) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid\x00') getpeername$ax25(r1, &(0x7f0000000140)={{0x3, @rose}, [@bcast, @rose, @remote, @bcast, @default, @bcast, @netrom, @rose]}, &(0x7f00000001c0)=0x48) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$ax25(0x3, 0x5, 0x8) (async) getsockopt$ax25_int(r1, 0x101, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000080)=0xfffffeff) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid\x00') (async) getpeername$ax25(r1, &(0x7f0000000140)={{0x3, @rose}, [@bcast, @rose, @remote, @bcast, @default, @bcast, @netrom, @rose]}, &(0x7f00000001c0)=0x48) (async) 14:08:03 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000180)={0x1, @le_ext_create_conn={{0x2043, 0x94}, {0x0, 0x81, 0x3, @none, 0x7, "3fbbc8b37b39d6698437223c4327794c381fcde01ba5c3a4fd72c64baba37ada7f2ba23ff73212b6b1a58085a13b99bc64605b18a5f96408d819cd5c6f657353426f873bf6b3c5f0108b74a12a448ec51c493dca509ef5b0680c8471a89e077c19215ba69b29a61dada76818760e993bbe9de342ca92d62e015c528d9d1e642f180028329dae70042b4d"}}}, 0x98) getsockname$ax25(0xffffffffffffffff, &(0x7f00000003c0)={{0x3, @netrom}, [@null, @remote, @null, @remote, @netrom, @bcast, @netrom, @bcast]}, &(0x7f0000000440)=0x48) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)=0x8, 0x4) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) connect$ax25(r2, &(0x7f0000000240)={{0x3, @bcast}, [@default, @bcast, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast]}, 0x48) write$bt_hci(r1, &(0x7f0000000380)={0x1, @inquiry={{0x401, 0x5}, {"825535", 0x5, 0x48}}}, 0x9) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000340)={'gre0\x00', &(0x7f00000002c0)={'ip_vti0\x00', 0x0, 0xff01, 0x7800, 0x7, 0x6, {{0xc, 0x4, 0x3, 0x35, 0x30, 0x67, 0x0, 0x5, 0x29, 0x0, @rand_addr=0x64010101, @remote, {[@timestamp={0x44, 0x8, 0xa7, 0x0, 0x5, [0x7f]}, @end, @generic={0x89, 0x11, "c73872dc02473776d1278aa6dac863"}]}}}}}) socket$vsock_stream(0x28, 0x1, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:03 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x6e844f6032ffc43f) ioctl$sock_bt_hci(r1, 0x400448de, &(0x7f0000000040)="6584ff9243e36e62877cbb5bfe0cd9f3d821f5aa39eca0631014a8f33000f31a81317c149c2ef8b9f73dfaab5f6995bbdcff798204107e88848366f531de5d0841547bcbaea0e8452002ecaff2f6e82f3bfff804346d51a61eea70adcdbd5c024de0ec7c0c988f1eee327399e0430914b03cfcaec440f3d0a964628ea114d823635ebbcaec527611abfee7644878fa60e8f4cd57e7676721a95d73c3a6a3b8ed9fbfe58aa5d927a86d50cb0ccb0f0dc62ed18726743946d2fbfddbe02da6576b6fb4aed3d363201d4a624e568c45ccc2eb107a08255e78c6649bde5f0890ba4a045346f615a104cbaf951b318453592d82fed03001c0a558a9beffdef968eaf0ade94561d5042bdc87c6ec912e15d8e0c4fcb7879ce2f22fd86b524730647723c3657ba4a5a19b0222754bf9e9a03d814733842d4a72d5f8a7d7193025235d47626066b20ecbcd38c5b8c7aca1a7e7e5d5352e1ae3c261f408c5e7d593f5417a0b195298b73dca6980447f27070cd58528a962bc3ec242524830bf6c94e6b56d4e04b80da9f1fcfaa9c0c7916c43c399364c8c81cdcf06b63ec3bb4cec0647860b0c85c1ea2cf0a111c9dda72c6816f84cd830e41a55dac68e953be811d3d7955d0dee339ba81289f10a646a010a05521830c99ec05f7705379f2ba8c5120b843ee72becfa5a1a253d154f1b4860bfd9b6353dc05386c6f2740365f732ad164254ced6080322ae61f8e2fbc2216e041bf2f3474d10b0e3c253da1bdccdfa341abfb6eaf4e7518974b04de589491c3f39bddd36e01af439d862943d84584fc1cf3da0ab09a8943fd817376de5829194e6323c75cc826e3ce216a9484fef19604c69d4c871fe5124e871c320e6e16ce8199b00c38c8558a1da7d2838af28fb2756b7a4bdffeb377c3a9042dc1ed629a1916cc787bd1d287a817d10b5f970c94c04edb2183b21b51527b92b73ad42d43583850311b92e3bd20e8c8277aa64896b64d938543d7caa74c9f9012f1c2b1ae788d259bcb2748e79bbee5499067fda2d68b0d3fab5f0367023031f037320bf73f3780b3e1254627bc483b0d9f6bf004d5f989cbfe39a7a2f34433f1030073f734514dcf54a424af4a95fd4c2296978d973d0a1c71ab130ce2e24a130a72199bd1f2a3abe0f535f18ee0f8faded190367448c04d44b811fc0e86d7dc6c1d8b17c44cd0ed0adca4dede8961715674d6d8241d0779e4bd0ae4bc4a8033a7765c8f92548215b6554f181fd54c30a514b5890ac7e16a5682d205ac34fc8212250667d6e893bd10871c02f2312aa730141337103f2d3799588ea613f3945bc57a057ae213a1bcdfbfd83aa1deca10006a3834e419cd89cc8f7f9a453530ba97fb7390e930d3cf59300bffcbcf9b86ec302e087368d8b6666a37188237bb5e60549427364b43d54c785f7edafe6bf6bef7a67457f00fecd283f44038d8e6057065fd6f89a37c980da387441bdca7e282103dfd5d153031090f355d3e6b4c43ec4336ecaf1a3993f8879283605cd504af6ba2c1efb065526b8696e8555035faaf54ed9dd1d7acac527d2481234ecd275f86eeef4d112a317d4cf78afe6cb92da36d55289743517c5aefcb3719e9ec4df07719ae3b8db321642b7dd65324b394c536d8b924d89b4f7c05c66f8bc588d4d7a711135bb0e35447a9db099475b7f8ff693d51aa440689ffc03c5cc77e98195ac7001a418f5028dcc4d226b1be10d87e2738b9dea425f64212198d3217b8cbad27ade90c637cb3be0ca7cfa8dffd6d644eda472f4fd1448838e1ef3053331af57cf95466117cd78767d9a1ea7da5a6daec4b0eacb8211b8fc641253900f050bbc8fca3ad2d38b07fd84ad3d3abff99b533beb67a72b0fb5851e6d10c13a4dcabd9e61d67bc59e4e30bfe94b3924d1c46ab52d20960745687b1ae5320906dd5569f69c3875b939ad5fa1017c5573fc027c37e23409ad08ee5a1ec4210eba8dbc43afaec65916fc3177dfcae19640cf6b00a12fb90ef2994269a2cfcb75c1f8276657d4cf1f525d0079e01c4e653a1e4e252ced5503c9dfe30ec88a98305f71e7dd631517eb1cdeb36faa4e8a757b23f9fa756926ec395168e1bdcf1fc0dfeb5fd33b03381b01e8c891427b5c23ea9dae0b38f74c1a0108d3aca0faa00c3772d718785fa765c777a9d16eef5d2c4bf0884fae7eb7807de4c976f927b80b48db61103113f187a31edaaff50865a79bb984c2f69e5d470ec81e08bd816937f32dbd9e34c321f433917659f6a6908b772052140011c58bb91966d427ac9932f88fc13ed1faad2094d46ea7bf1e72c06a5de3b43fef36703f3a14e6d4e3bf46d49b1d065c0cb3870cbd98e1aff2aad6d2f951efb179a06af35685aba016cfafe68ac5252dbf2ac0641851acd82825cfd46bee754034f249e91784d2c1f2513b38b016bd1421bf68a6e0b3b387777164c239a8bc2fed8a4c02e18daf231cec29395a2b6b955821021f4f941fbe23016afa2c3ecd5ecd51c1d0f8a825f73b38b4b037171f1c6db25b504683705c3a42fb8cc7686aee9303e8cd6774ac963b6746aee09cf9515296ac830ab0169865429919d0bdd59ccffe33e70740fb48c82ae033568bffa18764941249a8e985b70e680dca72ab42a7b81f087b150477e9acc3bd267722aa4673dc593290e36e4654738d663d86eebcc52f324cd0d2ba13ae82c6751a727e7ac109fc47379893121d7f406fef59f2c3b4de97c242b64ebfb4e5239cb7f05188f5650842864495eb4ff380aaf47b534e563106cc946c910a312bac2ad5e41279aaab83977726d43d48c5373a2d4ea0482a6c70953ad277a8852bf17e7d576bf547a04934596d7a05b22df8a55bcc9a4f67139b61b936ef8999c263219295a12eeca31ed072894246a073d2ff5d440d72707c3a34544bfaf56aa16c73a4cc7f057e1fc680d71ffb20b0e26aa7db1262783fd0fdebeb6ee6b726218478a4f8d8d4eaff1baf998277a4eb147ee261c3f7eda2669de5f549e425c446dae5e2ea0aea0c7f97b24c84f3d516f7b4467626a061c7f0c122a8890b26529c4eef766f99e043694e0cfcc5db1fba4a3b4b381011dbc1cfd21b4ff519fc4a11adfd0d241d13b8e7700d1b395ddf4b2c0676b1b7021614ae7f6e16aef12e1e488342e9c675016feb057574548b04cb9b898fde15d448e9e9e5977d4b0993841d605541895b53cf372a0876eac5227e5824436e2fd10b5f3af6cedff98349b598b7becb898cc410cb2ced0e925f14596e2e5197d3ca9477d5bba3a3337c9382d923e9bd7265cdda175deee7dbc26b592cdb142fd3b90a5280015430fa3be749ea3d9512706b847b5e20910ba992e721204dc34502c52a95bbf8c4d491bdb0589c4c96027e31aa48f2ac205552832620500d434fd17e0dd2d9e70c5ee3bf5b1bc4d7513fc879370d4afa723940ef4dc06b6d0bc4123e98142a718e07448e0500eea0c64ad9977670d3197b04d4ac286558db1fa850cbd533c1638611922209a208537d985bfd75f36de00f5284f445a1abafc1c8d8833b30a138d6482e6739869111a3025d8f9552e5301d2f115d2713c58c50af334c0f3267f96dbfc5a97907a2f5db33bfb8c671687c7d1374e5d33d3643ac391fd7e3f61698c15a9f9c914005980436a94d743ffb6c32c97871c558ba1350375dba90394bac98c15f8447974bab596c9bc900aa9cb55ac2aa00ed15428f9962acbfd29816c0dac8fb332ca98442e059e731b1cdb48b6a4e17d85e232b9baada10f0a2268327006b5047edc78dc3b10fcfd7fc2c995abe2b5904703d866cb263a141b8080b36e5e01ff7156f44e411049ce629982fda0a117fe8791a7ed1028a42c639dc0db90fc5e8f9706e3f3dbe0ab33ad855cb73af0a05673801574ec9a439bcc465b48f88995dab47e1f09a253162b8c7a57eae349c234d2284c1dc49b31439516525008012490ea738c0c29a75cc4704f6a37414a61ca4f5a50d19a69235d6cc74f1d7922b04a2031cc1782c73af2047cefb8c0c15e5a3682dc99577190af2375e2592ea7dd30cf6e2b91055da92b18ac864542382868103a0bc8f19883da6293ba16b945445f4b586cd015a22ef71cf9dc504ce6c27108c9ad8d6dab4237ba88789572f9ecaaa5a374714581c3fddcbb984710edc2dbca11aa3a2f385c8da297d2eed8bb966414e5a7b1b7f23ce26bc17289d418f73061936bd082a13c9c67be491f4af9bcf2f41156714d380bbec0f2c882d0f61480e1ac07b828d8f88c00cb13cd7d193ca6083fdd8a88e921d70ca0f6026c8c989ab6bb24ffb5f3870faccf2160db5782a294d11248827224b8aa9257ea00554bf7173ff14df6bea41a27bc6592985a7c82647fdf88bb10290abc939550129171f4944afcb824004f6eb50e906d2d43b7c1f29f93e6c97d5a9a0451d8f43c2fbdbfb1fbb6e0abf8826a2e3f1c1d114e92b0089a59598c3d940031892b71e7e09391931ebc9793b79fad267e636865e6e09b9509233dc0c840198bba3f4bb21a70f8f03144b984cb5d7d01717661c326d617554ecc5fc0e8e4ec984c53289af36b9545690e9157e2be2a1bed3d803653dc39fb09e789e6112447b943070fc42c6742e536cb112eee3705d139253899860a936d6a8842c925d6684eda50cfa022b973a9e096a8b0b2fd3d679d6454507e8c09f1bb0976000fb1e9992fccc211f3561a444cce227126ae98567b6de8e65ee4d30e0b33dd2ea1e2519f7463909348a0e01279e4cc230ebbe55107ec9de9a86c3672b344af0b4a3bdbd90cf973b6ef8899fa3ebd68720ab0efb056a1e0f560b0a8334df7d097f8ccf2b998665d677308d20a697bf3b2af9b00d7809694a4982ab3c35f364f6edea9942a16372429b431271e61a27abf6177638f6e136df39f5b30571bd24a072de6661987b6b8a9eb8ef6415107cdf844b3578042631c7ddf52a6fda249244376d9db13f84d7a6708d4d503a89745253858eed031d87a09a0d71ce669b81092e2ec03c1798036266c61d4b50794a77b25a3790011b9398b3696de5941a25e9afda5690eea27387d57befd9d5d9b8c274c9c29a7e23f17cbdef64a3baace0b5a7ce57f9b2f0e3eef0aefc68f05b36ca6172de31cb331d0b9cfeeb91ff0046da554e5c896470a592a724322f197a30a929249d8ab0a7dd4cb49822d7b0c873feaa6c36b820840a2363157d7d8348bee8f4c02e4af1f3b0eb7d4057d41e9e23703dbba47a46cd0a926269ccefec0075a4fbe3d6ea2ba835467e18633b6b2486be809fb7bb558524f8db14f0d2c0e0c7e32999814a53594c7f73cab8780aaaa83fb9c54e4d0abc44afd0160f5c5ba49dcdbe32400498750a361579469de26d6581d6541d4991f7d9a947a99c75e2b234cdbf05fed7537eb436cfc73c7138167559060124bc5634a542ce6dbec4767e2fa315917b1463c6a5d9c5991b9f784d7719d4b94557caef1f3342311db80f6bbece99182c6b8b067a7c4e99e4d3107588c828c8f7ccd6d82e20363438899b6a8c520a2825d55faab6ac7a67c34ddfb1da30a547be2f877cc8fc82163d67a392ef866894f19e6eff127011b1455d31c01aa90719da26912afce4768c427e736b61535cfc10b5f810aca51925d0f82436f12a48b8a166b9c2e3a33f07b7062741aca76a8f9bbd2673957a04e59724b23eea4770f9c51ad1b930c3b001eb5e10c9e6d33869d2c75774078e327c53444fbf9a8bb75774e1670ab8a67a27eb2cb70a195b984d8d132ac8d6129efbaf0e320752a6ab26679753bf08") ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x6e844f6032ffc43f) (async) ioctl$sock_bt_hci(r1, 0x400448de, &(0x7f0000000040)="6584ff9243e36e62877cbb5bfe0cd9f3d821f5aa39eca0631014a8f33000f31a81317c149c2ef8b9f73dfaab5f6995bbdcff798204107e88848366f531de5d0841547bcbaea0e8452002ecaff2f6e82f3bfff804346d51a61eea70adcdbd5c024de0ec7c0c988f1eee327399e0430914b03cfcaec440f3d0a964628ea114d823635ebbcaec527611abfee7644878fa60e8f4cd57e7676721a95d73c3a6a3b8ed9fbfe58aa5d927a86d50cb0ccb0f0dc62ed18726743946d2fbfddbe02da6576b6fb4aed3d363201d4a624e568c45ccc2eb107a08255e78c6649bde5f0890ba4a045346f615a104cbaf951b318453592d82fed03001c0a558a9beffdef968eaf0ade94561d5042bdc87c6ec912e15d8e0c4fcb7879ce2f22fd86b524730647723c3657ba4a5a19b0222754bf9e9a03d814733842d4a72d5f8a7d7193025235d47626066b20ecbcd38c5b8c7aca1a7e7e5d5352e1ae3c261f408c5e7d593f5417a0b195298b73dca6980447f27070cd58528a962bc3ec242524830bf6c94e6b56d4e04b80da9f1fcfaa9c0c7916c43c399364c8c81cdcf06b63ec3bb4cec0647860b0c85c1ea2cf0a111c9dda72c6816f84cd830e41a55dac68e953be811d3d7955d0dee339ba81289f10a646a010a05521830c99ec05f7705379f2ba8c5120b843ee72becfa5a1a253d154f1b4860bfd9b6353dc05386c6f2740365f732ad164254ced6080322ae61f8e2fbc2216e041bf2f3474d10b0e3c253da1bdccdfa341abfb6eaf4e7518974b04de589491c3f39bddd36e01af439d862943d84584fc1cf3da0ab09a8943fd817376de5829194e6323c75cc826e3ce216a9484fef19604c69d4c871fe5124e871c320e6e16ce8199b00c38c8558a1da7d2838af28fb2756b7a4bdffeb377c3a9042dc1ed629a1916cc787bd1d287a817d10b5f970c94c04edb2183b21b51527b92b73ad42d43583850311b92e3bd20e8c8277aa64896b64d938543d7caa74c9f9012f1c2b1ae788d259bcb2748e79bbee5499067fda2d68b0d3fab5f0367023031f037320bf73f3780b3e1254627bc483b0d9f6bf004d5f989cbfe39a7a2f34433f1030073f734514dcf54a424af4a95fd4c2296978d973d0a1c71ab130ce2e24a130a72199bd1f2a3abe0f535f18ee0f8faded190367448c04d44b811fc0e86d7dc6c1d8b17c44cd0ed0adca4dede8961715674d6d8241d0779e4bd0ae4bc4a8033a7765c8f92548215b6554f181fd54c30a514b5890ac7e16a5682d205ac34fc8212250667d6e893bd10871c02f2312aa730141337103f2d3799588ea613f3945bc57a057ae213a1bcdfbfd83aa1deca10006a3834e419cd89cc8f7f9a453530ba97fb7390e930d3cf59300bffcbcf9b86ec302e087368d8b6666a37188237bb5e60549427364b43d54c785f7edafe6bf6bef7a67457f00fecd283f44038d8e6057065fd6f89a37c980da387441bdca7e282103dfd5d153031090f355d3e6b4c43ec4336ecaf1a3993f8879283605cd504af6ba2c1efb065526b8696e8555035faaf54ed9dd1d7acac527d2481234ecd275f86eeef4d112a317d4cf78afe6cb92da36d55289743517c5aefcb3719e9ec4df07719ae3b8db321642b7dd65324b394c536d8b924d89b4f7c05c66f8bc588d4d7a711135bb0e35447a9db099475b7f8ff693d51aa440689ffc03c5cc77e98195ac7001a418f5028dcc4d226b1be10d87e2738b9dea425f64212198d3217b8cbad27ade90c637cb3be0ca7cfa8dffd6d644eda472f4fd1448838e1ef3053331af57cf95466117cd78767d9a1ea7da5a6daec4b0eacb8211b8fc641253900f050bbc8fca3ad2d38b07fd84ad3d3abff99b533beb67a72b0fb5851e6d10c13a4dcabd9e61d67bc59e4e30bfe94b3924d1c46ab52d20960745687b1ae5320906dd5569f69c3875b939ad5fa1017c5573fc027c37e23409ad08ee5a1ec4210eba8dbc43afaec65916fc3177dfcae19640cf6b00a12fb90ef2994269a2cfcb75c1f8276657d4cf1f525d0079e01c4e653a1e4e252ced5503c9dfe30ec88a98305f71e7dd631517eb1cdeb36faa4e8a757b23f9fa756926ec395168e1bdcf1fc0dfeb5fd33b03381b01e8c891427b5c23ea9dae0b38f74c1a0108d3aca0faa00c3772d718785fa765c777a9d16eef5d2c4bf0884fae7eb7807de4c976f927b80b48db61103113f187a31edaaff50865a79bb984c2f69e5d470ec81e08bd816937f32dbd9e34c321f433917659f6a6908b772052140011c58bb91966d427ac9932f88fc13ed1faad2094d46ea7bf1e72c06a5de3b43fef36703f3a14e6d4e3bf46d49b1d065c0cb3870cbd98e1aff2aad6d2f951efb179a06af35685aba016cfafe68ac5252dbf2ac0641851acd82825cfd46bee754034f249e91784d2c1f2513b38b016bd1421bf68a6e0b3b387777164c239a8bc2fed8a4c02e18daf231cec29395a2b6b955821021f4f941fbe23016afa2c3ecd5ecd51c1d0f8a825f73b38b4b037171f1c6db25b504683705c3a42fb8cc7686aee9303e8cd6774ac963b6746aee09cf9515296ac830ab0169865429919d0bdd59ccffe33e70740fb48c82ae033568bffa18764941249a8e985b70e680dca72ab42a7b81f087b150477e9acc3bd267722aa4673dc593290e36e4654738d663d86eebcc52f324cd0d2ba13ae82c6751a727e7ac109fc47379893121d7f406fef59f2c3b4de97c242b64ebfb4e5239cb7f05188f5650842864495eb4ff380aaf47b534e563106cc946c910a312bac2ad5e41279aaab83977726d43d48c5373a2d4ea0482a6c70953ad277a8852bf17e7d576bf547a04934596d7a05b22df8a55bcc9a4f67139b61b936ef8999c263219295a12eeca31ed072894246a073d2ff5d440d72707c3a34544bfaf56aa16c73a4cc7f057e1fc680d71ffb20b0e26aa7db1262783fd0fdebeb6ee6b726218478a4f8d8d4eaff1baf998277a4eb147ee261c3f7eda2669de5f549e425c446dae5e2ea0aea0c7f97b24c84f3d516f7b4467626a061c7f0c122a8890b26529c4eef766f99e043694e0cfcc5db1fba4a3b4b381011dbc1cfd21b4ff519fc4a11adfd0d241d13b8e7700d1b395ddf4b2c0676b1b7021614ae7f6e16aef12e1e488342e9c675016feb057574548b04cb9b898fde15d448e9e9e5977d4b0993841d605541895b53cf372a0876eac5227e5824436e2fd10b5f3af6cedff98349b598b7becb898cc410cb2ced0e925f14596e2e5197d3ca9477d5bba3a3337c9382d923e9bd7265cdda175deee7dbc26b592cdb142fd3b90a5280015430fa3be749ea3d9512706b847b5e20910ba992e721204dc34502c52a95bbf8c4d491bdb0589c4c96027e31aa48f2ac205552832620500d434fd17e0dd2d9e70c5ee3bf5b1bc4d7513fc879370d4afa723940ef4dc06b6d0bc4123e98142a718e07448e0500eea0c64ad9977670d3197b04d4ac286558db1fa850cbd533c1638611922209a208537d985bfd75f36de00f5284f445a1abafc1c8d8833b30a138d6482e6739869111a3025d8f9552e5301d2f115d2713c58c50af334c0f3267f96dbfc5a97907a2f5db33bfb8c671687c7d1374e5d33d3643ac391fd7e3f61698c15a9f9c914005980436a94d743ffb6c32c97871c558ba1350375dba90394bac98c15f8447974bab596c9bc900aa9cb55ac2aa00ed15428f9962acbfd29816c0dac8fb332ca98442e059e731b1cdb48b6a4e17d85e232b9baada10f0a2268327006b5047edc78dc3b10fcfd7fc2c995abe2b5904703d866cb263a141b8080b36e5e01ff7156f44e411049ce629982fda0a117fe8791a7ed1028a42c639dc0db90fc5e8f9706e3f3dbe0ab33ad855cb73af0a05673801574ec9a439bcc465b48f88995dab47e1f09a253162b8c7a57eae349c234d2284c1dc49b31439516525008012490ea738c0c29a75cc4704f6a37414a61ca4f5a50d19a69235d6cc74f1d7922b04a2031cc1782c73af2047cefb8c0c15e5a3682dc99577190af2375e2592ea7dd30cf6e2b91055da92b18ac864542382868103a0bc8f19883da6293ba16b945445f4b586cd015a22ef71cf9dc504ce6c27108c9ad8d6dab4237ba88789572f9ecaaa5a374714581c3fddcbb984710edc2dbca11aa3a2f385c8da297d2eed8bb966414e5a7b1b7f23ce26bc17289d418f73061936bd082a13c9c67be491f4af9bcf2f41156714d380bbec0f2c882d0f61480e1ac07b828d8f88c00cb13cd7d193ca6083fdd8a88e921d70ca0f6026c8c989ab6bb24ffb5f3870faccf2160db5782a294d11248827224b8aa9257ea00554bf7173ff14df6bea41a27bc6592985a7c82647fdf88bb10290abc939550129171f4944afcb824004f6eb50e906d2d43b7c1f29f93e6c97d5a9a0451d8f43c2fbdbfb1fbb6e0abf8826a2e3f1c1d114e92b0089a59598c3d940031892b71e7e09391931ebc9793b79fad267e636865e6e09b9509233dc0c840198bba3f4bb21a70f8f03144b984cb5d7d01717661c326d617554ecc5fc0e8e4ec984c53289af36b9545690e9157e2be2a1bed3d803653dc39fb09e789e6112447b943070fc42c6742e536cb112eee3705d139253899860a936d6a8842c925d6684eda50cfa022b973a9e096a8b0b2fd3d679d6454507e8c09f1bb0976000fb1e9992fccc211f3561a444cce227126ae98567b6de8e65ee4d30e0b33dd2ea1e2519f7463909348a0e01279e4cc230ebbe55107ec9de9a86c3672b344af0b4a3bdbd90cf973b6ef8899fa3ebd68720ab0efb056a1e0f560b0a8334df7d097f8ccf2b998665d677308d20a697bf3b2af9b00d7809694a4982ab3c35f364f6edea9942a16372429b431271e61a27abf6177638f6e136df39f5b30571bd24a072de6661987b6b8a9eb8ef6415107cdf844b3578042631c7ddf52a6fda249244376d9db13f84d7a6708d4d503a89745253858eed031d87a09a0d71ce669b81092e2ec03c1798036266c61d4b50794a77b25a3790011b9398b3696de5941a25e9afda5690eea27387d57befd9d5d9b8c274c9c29a7e23f17cbdef64a3baace0b5a7ce57f9b2f0e3eef0aefc68f05b36ca6172de31cb331d0b9cfeeb91ff0046da554e5c896470a592a724322f197a30a929249d8ab0a7dd4cb49822d7b0c873feaa6c36b820840a2363157d7d8348bee8f4c02e4af1f3b0eb7d4057d41e9e23703dbba47a46cd0a926269ccefec0075a4fbe3d6ea2ba835467e18633b6b2486be809fb7bb558524f8db14f0d2c0e0c7e32999814a53594c7f73cab8780aaaa83fb9c54e4d0abc44afd0160f5c5ba49dcdbe32400498750a361579469de26d6581d6541d4991f7d9a947a99c75e2b234cdbf05fed7537eb436cfc73c7138167559060124bc5634a542ce6dbec4767e2fa315917b1463c6a5d9c5991b9f784d7719d4b94557caef1f3342311db80f6bbece99182c6b8b067a7c4e99e4d3107588c828c8f7ccd6d82e20363438899b6a8c520a2825d55faab6ac7a67c34ddfb1da30a547be2f877cc8fc82163d67a392ef866894f19e6eff127011b1455d31c01aa90719da26912afce4768c427e736b61535cfc10b5f810aca51925d0f82436f12a48b8a166b9c2e3a33f07b7062741aca76a8f9bbd2673957a04e59724b23eea4770f9c51ad1b930c3b001eb5e10c9e6d33869d2c75774078e327c53444fbf9a8bb75774e1670ab8a67a27eb2cb70a195b984d8d132ac8d6129efbaf0e320752a6ab26679753bf08") (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) 14:08:03 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x3, 0x4) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0x3, 0x4}, 0x6) 14:08:03 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async, rerun: 32) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="a6000000290100ff0700000804000000070000000000000081000000000000000107002e2f66696c6530d103000000030000000000000009000000000000120407002e2f66696c6530000300000006000000000000000337c8622f7878bcc3f5d08ff5bee4cd3c000000000000007f07002e2f66696c65300002000000020000000000000006000000000000000907002e2f66696c653004030000000000000000000000df00"], 0xa6) 14:08:03 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x400d40, 0x0) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080), 0x4) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0x1, 0x2}, 0x6) 14:08:03 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 64) write$bt_hci(r0, &(0x7f0000000180)={0x1, @le_ext_create_conn={{0x2043, 0x94}, {0x0, 0x81, 0x3, @none, 0x7, "3fbbc8b37b39d6698437223c4327794c381fcde01ba5c3a4fd72c64baba37ada7f2ba23ff73212b6b1a58085a13b99bc64605b18a5f96408d819cd5c6f657353426f873bf6b3c5f0108b74a12a448ec51c493dca509ef5b0680c8471a89e077c19215ba69b29a61dada76818760e993bbe9de342ca92d62e015c528d9d1e642f180028329dae70042b4d"}}}, 0x98) getsockname$ax25(0xffffffffffffffff, &(0x7f00000003c0)={{0x3, @netrom}, [@null, @remote, @null, @remote, @netrom, @bcast, @netrom, @bcast]}, &(0x7f0000000440)=0x48) (async, rerun: 32) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (rerun: 32) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)=0x8, 0x4) (async) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) connect$ax25(r2, &(0x7f0000000240)={{0x3, @bcast}, [@default, @bcast, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast]}, 0x48) (async, rerun: 32) write$bt_hci(r1, &(0x7f0000000380)={0x1, @inquiry={{0x401, 0x5}, {"825535", 0x5, 0x48}}}, 0x9) (async, rerun: 32) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000340)={'gre0\x00', &(0x7f00000002c0)={'ip_vti0\x00', 0x0, 0xff01, 0x7800, 0x7, 0x6, {{0xc, 0x4, 0x3, 0x35, 0x30, 0x67, 0x0, 0x5, 0x29, 0x0, @rand_addr=0x64010101, @remote, {[@timestamp={0x44, 0x8, 0xa7, 0x0, 0x5, [0x7f]}, @end, @generic={0x89, 0x11, "c73872dc02473776d1278aa6dac863"}]}}}}}) (async, rerun: 32) socket$vsock_stream(0x28, 0x1, 0x0) (rerun: 32) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)) (async, rerun: 64) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (rerun: 64) 14:08:03 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$sock_bt_hci(r1, 0x12, &(0x7f0000000040)="e9c75aec354fd5ff022df9951ebc03aaed1c7d0ab986af75040c402ebeaed13047d765bfcc78a915126643ad1e5c4e011fe58956c143be2f2b8b") 14:08:03 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x3, 0x4) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0x3, 0x4}, 0x6) [ 2837.317857] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de 14:08:03 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x6e844f6032ffc43f) ioctl$sock_bt_hci(r1, 0x400448de, &(0x7f0000000040)="6584ff9243e36e62877cbb5bfe0cd9f3d821f5aa39eca0631014a8f33000f31a81317c149c2ef8b9f73dfaab5f6995bbdcff798204107e88848366f531de5d0841547bcbaea0e8452002ecaff2f6e82f3bfff804346d51a61eea70adcdbd5c024de0ec7c0c988f1eee327399e0430914b03cfcaec440f3d0a964628ea114d823635ebbcaec527611abfee7644878fa60e8f4cd57e7676721a95d73c3a6a3b8ed9fbfe58aa5d927a86d50cb0ccb0f0dc62ed18726743946d2fbfddbe02da6576b6fb4aed3d363201d4a624e568c45ccc2eb107a08255e78c6649bde5f0890ba4a045346f615a104cbaf951b318453592d82fed03001c0a558a9beffdef968eaf0ade94561d5042bdc87c6ec912e15d8e0c4fcb7879ce2f22fd86b524730647723c3657ba4a5a19b0222754bf9e9a03d814733842d4a72d5f8a7d7193025235d47626066b20ecbcd38c5b8c7aca1a7e7e5d5352e1ae3c261f408c5e7d593f5417a0b195298b73dca6980447f27070cd58528a962bc3ec242524830bf6c94e6b56d4e04b80da9f1fcfaa9c0c7916c43c399364c8c81cdcf06b63ec3bb4cec0647860b0c85c1ea2cf0a111c9dda72c6816f84cd830e41a55dac68e953be811d3d7955d0dee339ba81289f10a646a010a05521830c99ec05f7705379f2ba8c5120b843ee72becfa5a1a253d154f1b4860bfd9b6353dc05386c6f2740365f732ad164254ced6080322ae61f8e2fbc2216e041bf2f3474d10b0e3c253da1bdccdfa341abfb6eaf4e7518974b04de589491c3f39bddd36e01af439d862943d84584fc1cf3da0ab09a8943fd817376de5829194e6323c75cc826e3ce216a9484fef19604c69d4c871fe5124e871c320e6e16ce8199b00c38c8558a1da7d2838af28fb2756b7a4bdffeb377c3a9042dc1ed629a1916cc787bd1d287a817d10b5f970c94c04edb2183b21b51527b92b73ad42d43583850311b92e3bd20e8c8277aa64896b64d938543d7caa74c9f9012f1c2b1ae788d259bcb2748e79bbee5499067fda2d68b0d3fab5f0367023031f037320bf73f3780b3e1254627bc483b0d9f6bf004d5f989cbfe39a7a2f34433f1030073f734514dcf54a424af4a95fd4c2296978d973d0a1c71ab130ce2e24a130a72199bd1f2a3abe0f535f18ee0f8faded190367448c04d44b811fc0e86d7dc6c1d8b17c44cd0ed0adca4dede8961715674d6d8241d0779e4bd0ae4bc4a8033a7765c8f92548215b6554f181fd54c30a514b5890ac7e16a5682d205ac34fc8212250667d6e893bd10871c02f2312aa730141337103f2d3799588ea613f3945bc57a057ae213a1bcdfbfd83aa1deca10006a3834e419cd89cc8f7f9a453530ba97fb7390e930d3cf59300bffcbcf9b86ec302e087368d8b6666a37188237bb5e60549427364b43d54c785f7edafe6bf6bef7a67457f00fecd283f44038d8e6057065fd6f89a37c980da387441bdca7e282103dfd5d153031090f355d3e6b4c43ec4336ecaf1a3993f8879283605cd504af6ba2c1efb065526b8696e8555035faaf54ed9dd1d7acac527d2481234ecd275f86eeef4d112a317d4cf78afe6cb92da36d55289743517c5aefcb3719e9ec4df07719ae3b8db321642b7dd65324b394c536d8b924d89b4f7c05c66f8bc588d4d7a711135bb0e35447a9db099475b7f8ff693d51aa440689ffc03c5cc77e98195ac7001a418f5028dcc4d226b1be10d87e2738b9dea425f64212198d3217b8cbad27ade90c637cb3be0ca7cfa8dffd6d644eda472f4fd1448838e1ef3053331af57cf95466117cd78767d9a1ea7da5a6daec4b0eacb8211b8fc641253900f050bbc8fca3ad2d38b07fd84ad3d3abff99b533beb67a72b0fb5851e6d10c13a4dcabd9e61d67bc59e4e30bfe94b3924d1c46ab52d20960745687b1ae5320906dd5569f69c3875b939ad5fa1017c5573fc027c37e23409ad08ee5a1ec4210eba8dbc43afaec65916fc3177dfcae19640cf6b00a12fb90ef2994269a2cfcb75c1f8276657d4cf1f525d0079e01c4e653a1e4e252ced5503c9dfe30ec88a98305f71e7dd631517eb1cdeb36faa4e8a757b23f9fa756926ec395168e1bdcf1fc0dfeb5fd33b03381b01e8c891427b5c23ea9dae0b38f74c1a0108d3aca0faa00c3772d718785fa765c777a9d16eef5d2c4bf0884fae7eb7807de4c976f927b80b48db61103113f187a31edaaff50865a79bb984c2f69e5d470ec81e08bd816937f32dbd9e34c321f433917659f6a6908b772052140011c58bb91966d427ac9932f88fc13ed1faad2094d46ea7bf1e72c06a5de3b43fef36703f3a14e6d4e3bf46d49b1d065c0cb3870cbd98e1aff2aad6d2f951efb179a06af35685aba016cfafe68ac5252dbf2ac0641851acd82825cfd46bee754034f249e91784d2c1f2513b38b016bd1421bf68a6e0b3b387777164c239a8bc2fed8a4c02e18daf231cec29395a2b6b955821021f4f941fbe23016afa2c3ecd5ecd51c1d0f8a825f73b38b4b037171f1c6db25b504683705c3a42fb8cc7686aee9303e8cd6774ac963b6746aee09cf9515296ac830ab0169865429919d0bdd59ccffe33e70740fb48c82ae033568bffa18764941249a8e985b70e680dca72ab42a7b81f087b150477e9acc3bd267722aa4673dc593290e36e4654738d663d86eebcc52f324cd0d2ba13ae82c6751a727e7ac109fc47379893121d7f406fef59f2c3b4de97c242b64ebfb4e5239cb7f05188f5650842864495eb4ff380aaf47b534e563106cc946c910a312bac2ad5e41279aaab83977726d43d48c5373a2d4ea0482a6c70953ad277a8852bf17e7d576bf547a04934596d7a05b22df8a55bcc9a4f67139b61b936ef8999c263219295a12eeca31ed072894246a073d2ff5d440d72707c3a34544bfaf56aa16c73a4cc7f057e1fc680d71ffb20b0e26aa7db1262783fd0fdebeb6ee6b726218478a4f8d8d4eaff1baf998277a4eb147ee261c3f7eda2669de5f549e425c446dae5e2ea0aea0c7f97b24c84f3d516f7b4467626a061c7f0c122a8890b26529c4eef766f99e043694e0cfcc5db1fba4a3b4b381011dbc1cfd21b4ff519fc4a11adfd0d241d13b8e7700d1b395ddf4b2c0676b1b7021614ae7f6e16aef12e1e488342e9c675016feb057574548b04cb9b898fde15d448e9e9e5977d4b0993841d605541895b53cf372a0876eac5227e5824436e2fd10b5f3af6cedff98349b598b7becb898cc410cb2ced0e925f14596e2e5197d3ca9477d5bba3a3337c9382d923e9bd7265cdda175deee7dbc26b592cdb142fd3b90a5280015430fa3be749ea3d9512706b847b5e20910ba992e721204dc34502c52a95bbf8c4d491bdb0589c4c96027e31aa48f2ac205552832620500d434fd17e0dd2d9e70c5ee3bf5b1bc4d7513fc879370d4afa723940ef4dc06b6d0bc4123e98142a718e07448e0500eea0c64ad9977670d3197b04d4ac286558db1fa850cbd533c1638611922209a208537d985bfd75f36de00f5284f445a1abafc1c8d8833b30a138d6482e6739869111a3025d8f9552e5301d2f115d2713c58c50af334c0f3267f96dbfc5a97907a2f5db33bfb8c671687c7d1374e5d33d3643ac391fd7e3f61698c15a9f9c914005980436a94d743ffb6c32c97871c558ba1350375dba90394bac98c15f8447974bab596c9bc900aa9cb55ac2aa00ed15428f9962acbfd29816c0dac8fb332ca98442e059e731b1cdb48b6a4e17d85e232b9baada10f0a2268327006b5047edc78dc3b10fcfd7fc2c995abe2b5904703d866cb263a141b8080b36e5e01ff7156f44e411049ce629982fda0a117fe8791a7ed1028a42c639dc0db90fc5e8f9706e3f3dbe0ab33ad855cb73af0a05673801574ec9a439bcc465b48f88995dab47e1f09a253162b8c7a57eae349c234d2284c1dc49b31439516525008012490ea738c0c29a75cc4704f6a37414a61ca4f5a50d19a69235d6cc74f1d7922b04a2031cc1782c73af2047cefb8c0c15e5a3682dc99577190af2375e2592ea7dd30cf6e2b91055da92b18ac864542382868103a0bc8f19883da6293ba16b945445f4b586cd015a22ef71cf9dc504ce6c27108c9ad8d6dab4237ba88789572f9ecaaa5a374714581c3fddcbb984710edc2dbca11aa3a2f385c8da297d2eed8bb966414e5a7b1b7f23ce26bc17289d418f73061936bd082a13c9c67be491f4af9bcf2f41156714d380bbec0f2c882d0f61480e1ac07b828d8f88c00cb13cd7d193ca6083fdd8a88e921d70ca0f6026c8c989ab6bb24ffb5f3870faccf2160db5782a294d11248827224b8aa9257ea00554bf7173ff14df6bea41a27bc6592985a7c82647fdf88bb10290abc939550129171f4944afcb824004f6eb50e906d2d43b7c1f29f93e6c97d5a9a0451d8f43c2fbdbfb1fbb6e0abf8826a2e3f1c1d114e92b0089a59598c3d940031892b71e7e09391931ebc9793b79fad267e636865e6e09b9509233dc0c840198bba3f4bb21a70f8f03144b984cb5d7d01717661c326d617554ecc5fc0e8e4ec984c53289af36b9545690e9157e2be2a1bed3d803653dc39fb09e789e6112447b943070fc42c6742e536cb112eee3705d139253899860a936d6a8842c925d6684eda50cfa022b973a9e096a8b0b2fd3d679d6454507e8c09f1bb0976000fb1e9992fccc211f3561a444cce227126ae98567b6de8e65ee4d30e0b33dd2ea1e2519f7463909348a0e01279e4cc230ebbe55107ec9de9a86c3672b344af0b4a3bdbd90cf973b6ef8899fa3ebd68720ab0efb056a1e0f560b0a8334df7d097f8ccf2b998665d677308d20a697bf3b2af9b00d7809694a4982ab3c35f364f6edea9942a16372429b431271e61a27abf6177638f6e136df39f5b30571bd24a072de6661987b6b8a9eb8ef6415107cdf844b3578042631c7ddf52a6fda249244376d9db13f84d7a6708d4d503a89745253858eed031d87a09a0d71ce669b81092e2ec03c1798036266c61d4b50794a77b25a3790011b9398b3696de5941a25e9afda5690eea27387d57befd9d5d9b8c274c9c29a7e23f17cbdef64a3baace0b5a7ce57f9b2f0e3eef0aefc68f05b36ca6172de31cb331d0b9cfeeb91ff0046da554e5c896470a592a724322f197a30a929249d8ab0a7dd4cb49822d7b0c873feaa6c36b820840a2363157d7d8348bee8f4c02e4af1f3b0eb7d4057d41e9e23703dbba47a46cd0a926269ccefec0075a4fbe3d6ea2ba835467e18633b6b2486be809fb7bb558524f8db14f0d2c0e0c7e32999814a53594c7f73cab8780aaaa83fb9c54e4d0abc44afd0160f5c5ba49dcdbe32400498750a361579469de26d6581d6541d4991f7d9a947a99c75e2b234cdbf05fed7537eb436cfc73c7138167559060124bc5634a542ce6dbec4767e2fa315917b1463c6a5d9c5991b9f784d7719d4b94557caef1f3342311db80f6bbece99182c6b8b067a7c4e99e4d3107588c828c8f7ccd6d82e20363438899b6a8c520a2825d55faab6ac7a67c34ddfb1da30a547be2f877cc8fc82163d67a392ef866894f19e6eff127011b1455d31c01aa90719da26912afce4768c427e736b61535cfc10b5f810aca51925d0f82436f12a48b8a166b9c2e3a33f07b7062741aca76a8f9bbd2673957a04e59724b23eea4770f9c51ad1b930c3b001eb5e10c9e6d33869d2c75774078e327c53444fbf9a8bb75774e1670ab8a67a27eb2cb70a195b984d8d132ac8d6129efbaf0e320752a6ab26679753bf08") ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) 14:08:03 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000040)=0x6, 0x4) 14:08:03 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$sock_bt_hci(r1, 0x12, &(0x7f0000000040)="e9c75aec354fd5ff022df9951ebc03aaed1c7d0ab986af75040c402ebeaed13047d765bfcc78a915126643ad1e5c4e011fe58956c143be2f2b8b") syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) ioctl$sock_bt_hci(r1, 0x12, &(0x7f0000000040)="e9c75aec354fd5ff022df9951ebc03aaed1c7d0ab986af75040c402ebeaed13047d765bfcc78a915126643ad1e5c4e011fe58956c143be2f2b8b") (async) 14:08:03 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="a6000000290100ff0700000804000000070000000000000081000000000000000107002e2f66696c6530d103000000030000000000000009000000000000120407002e2f66696c6530000300000006000000000000000337c8622f7878bcc3f5d08ff5bee4cd3c000000000000007f07002e2f66696c65300002000000020000000000000006000000000000000907002e2f66696c653004030000000000000000000000df00"], 0xa6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="a6000000290100ff0700000804000000070000000000000081000000000000000107002e2f66696c6530d103000000030000000000000009000000000000120407002e2f66696c6530000300000006000000000000000337c8622f7878bcc3f5d08ff5bee4cd3c000000000000007f07002e2f66696c65300002000000020000000000000006000000000000000907002e2f66696c653004030000000000000000000000df00"], 0xa6) (async) 14:08:03 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x3, 0x4) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r2, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0x3, 0x4}, 0x6) 14:08:03 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1300000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x68, 0x1411, 0x800, 0x70bd28, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x3}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x3}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x2}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x2f}]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x4000) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) write$bt_hci(r0, &(0x7f0000000000)={0x1, @write_local_name={{0xc13, 0xf8}, {"08c36711b243ba993a6d156712e95529ec9fca9f62a64875528fb941b4ff83539175edfd5a5443038f68e0436ce5354c5bed3a235f58f9e86970e18aa319cda4c0533b2d60b81377d3328c286941982697734efa67e23d5378f885ece6b9f71383489754c08da38e52ed031e0e1936b9678b7c1be64ba559ae3599e2611d417eba46b6a1b88675259da253c94b54ea7254df1a4ee543510e970f983c61de67cf9a405713a148bb413197f89082631b6d7127de089f44b60d81a4ad0307d60afd333a238fdde3199461066af7ff6b3f45c564956e8e429f8a9c5136bedd6356513ec999fb5008e3994fc1b1268ece70eef9eb7c402d70bbf1"}}}, 0xfc) 14:08:03 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async, rerun: 32) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) ioctl$sock_bt_hci(r1, 0x12, &(0x7f0000000040)="e9c75aec354fd5ff022df9951ebc03aaed1c7d0ab986af75040c402ebeaed13047d765bfcc78a915126643ad1e5c4e011fe58956c143be2f2b8b") [ 2837.462897] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.479978] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de 14:08:03 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000040)=0x6, 0x4) 14:08:03 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x501400, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0xea48, 0x6, 0x1f, 0x6, 0x5, "ad8362d6eb24f710"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) [ 2837.512091] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.537935] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.558114] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.577533] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.592824] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.605190] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.613673] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.622163] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.630544] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.638907] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.647302] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.655675] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.664041] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.672348] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.680829] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.689209] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.697576] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.705947] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.714311] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.722613] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.731515] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.739880] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.748257] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.756605] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.765112] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.773421] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.781771] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.790150] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.798503] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de 14:08:03 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 32) write$bt_hci(r0, &(0x7f0000000180)={0x1, @le_ext_create_conn={{0x2043, 0x94}, {0x0, 0x81, 0x3, @none, 0x7, "3fbbc8b37b39d6698437223c4327794c381fcde01ba5c3a4fd72c64baba37ada7f2ba23ff73212b6b1a58085a13b99bc64605b18a5f96408d819cd5c6f657353426f873bf6b3c5f0108b74a12a448ec51c493dca509ef5b0680c8471a89e077c19215ba69b29a61dada76818760e993bbe9de342ca92d62e015c528d9d1e642f180028329dae70042b4d"}}}, 0x98) (async) getsockname$ax25(0xffffffffffffffff, &(0x7f00000003c0)={{0x3, @netrom}, [@null, @remote, @null, @remote, @netrom, @bcast, @netrom, @bcast]}, &(0x7f0000000440)=0x48) (async, rerun: 32) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async, rerun: 32) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)=0x8, 0x4) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) connect$ax25(r2, &(0x7f0000000240)={{0x3, @bcast}, [@default, @bcast, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast]}, 0x48) (async) write$bt_hci(r1, &(0x7f0000000380)={0x1, @inquiry={{0x401, 0x5}, {"825535", 0x5, 0x48}}}, 0x9) (async, rerun: 32) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000340)={'gre0\x00', &(0x7f00000002c0)={'ip_vti0\x00', 0x0, 0xff01, 0x7800, 0x7, 0x6, {{0xc, 0x4, 0x3, 0x35, 0x30, 0x67, 0x0, 0x5, 0x29, 0x0, @rand_addr=0x64010101, @remote, {[@timestamp={0x44, 0x8, 0xa7, 0x0, 0x5, [0x7f]}, @end, @generic={0x89, 0x11, "c73872dc02473776d1278aa6dac863"}]}}}}}) (async, rerun: 32) socket$vsock_stream(0x28, 0x1, 0x0) (async, rerun: 64) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000100)) (async, rerun: 64) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:03 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000140), 0x101000) write$bt_hci(r1, &(0x7f0000000080)={0x1, @le_set_ext_adv_enable={{0x2039, 0xa1}, {0x7, 0x0, "db136e75444a5392c645166f5116e3c92c61421d3900d18e6d5a390ab339cf7524542ec2bb8a7828c6e816cedacf89131c4eec49a5e35dd5e94cc0c2bdeb2f44516dc1b57a52b1c9a03324103c994afe50ee25ff63ef60bfdeaaee9e8d20c1bc961bfffd00b596e09a94ca820d6b83193fa988279051209c5594ed8a6603dfa8b9e3725c8bfd657fa178e990887984cc8fe8be9bd2e314fe9025f13add3e31"}}}, 0xa5) 14:08:03 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1300000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x68, 0x1411, 0x800, 0x70bd28, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x3}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x3}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x2}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x2f}]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x4000) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) write$bt_hci(r0, &(0x7f0000000000)={0x1, @write_local_name={{0xc13, 0xf8}, {"08c36711b243ba993a6d156712e95529ec9fca9f62a64875528fb941b4ff83539175edfd5a5443038f68e0436ce5354c5bed3a235f58f9e86970e18aa319cda4c0533b2d60b81377d3328c286941982697734efa67e23d5378f885ece6b9f71383489754c08da38e52ed031e0e1936b9678b7c1be64ba559ae3599e2611d417eba46b6a1b88675259da253c94b54ea7254df1a4ee543510e970f983c61de67cf9a405713a148bb413197f89082631b6d7127de089f44b60d81a4ad0307d60afd333a238fdde3199461066af7ff6b3f45c564956e8e429f8a9c5136bedd6356513ec999fb5008e3994fc1b1268ece70eef9eb7c402d70bbf1"}}}, 0xfc) 14:08:03 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000040)=0x6, 0x4) 14:08:03 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x501400, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0xea48, 0x6, 0x1f, 0x6, 0x5, "ad8362d6eb24f710"}) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) 14:08:03 executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$x25(0x9, 0x5, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x3, 0x1}, 0x6) [ 2837.806924] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 2837.815298] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de 14:08:03 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async, rerun: 32) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000140), 0x101000) write$bt_hci(r1, &(0x7f0000000080)={0x1, @le_set_ext_adv_enable={{0x2039, 0xa1}, {0x7, 0x0, "db136e75444a5392c645166f5116e3c92c61421d3900d18e6d5a390ab339cf7524542ec2bb8a7828c6e816cedacf89131c4eec49a5e35dd5e94cc0c2bdeb2f44516dc1b57a52b1c9a03324103c994afe50ee25ff63ef60bfdeaaee9e8d20c1bc961bfffd00b596e09a94ca820d6b83193fa988279051209c5594ed8a6603dfa8b9e3725c8bfd657fa178e990887984cc8fe8be9bd2e314fe9025f13add3e31"}}}, 0xa5) 14:08:03 executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$x25(0x9, 0x5, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x3, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x3, 0x1}, 0x6) (async) 14:08:03 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x501400, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0xea48, 0x6, 0x1f, 0x6, 0x5, "ad8362d6eb24f710"}) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x3, 0x1}, 0x6) 14:08:03 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x12000, 0x0) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) 14:08:03 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r1, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1300000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x68, 0x1411, 0x800, 0x70bd28, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x3}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x3}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x2}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x2f}]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x4000) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) write$bt_hci(r0, &(0x7f0000000000)={0x1, @write_local_name={{0xc13, 0xf8}, {"08c36711b243ba993a6d156712e95529ec9fca9f62a64875528fb941b4ff83539175edfd5a5443038f68e0436ce5354c5bed3a235f58f9e86970e18aa319cda4c0533b2d60b81377d3328c286941982697734efa67e23d5378f885ece6b9f71383489754c08da38e52ed031e0e1936b9678b7c1be64ba559ae3599e2611d417eba46b6a1b88675259da253c94b54ea7254df1a4ee543510e970f983c61de67cf9a405713a148bb413197f89082631b6d7127de089f44b60d81a4ad0307d60afd333a238fdde3199461066af7ff6b3f45c564956e8e429f8a9c5136bedd6356513ec999fb5008e3994fc1b1268ece70eef9eb7c402d70bbf1"}}}, 0xfc) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r1, 0x0, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1300000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x68, 0x1411, 0x800, 0x70bd28, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x3}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x3}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x2}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x2f}]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x4000) (async) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) write$bt_hci(r0, &(0x7f0000000000)={0x1, @write_local_name={{0xc13, 0xf8}, {"08c36711b243ba993a6d156712e95529ec9fca9f62a64875528fb941b4ff83539175edfd5a5443038f68e0436ce5354c5bed3a235f58f9e86970e18aa319cda4c0533b2d60b81377d3328c286941982697734efa67e23d5378f885ece6b9f71383489754c08da38e52ed031e0e1936b9678b7c1be64ba559ae3599e2611d417eba46b6a1b88675259da253c94b54ea7254df1a4ee543510e970f983c61de67cf9a405713a148bb413197f89082631b6d7127de089f44b60d81a4ad0307d60afd333a238fdde3199461066af7ff6b3f45c564956e8e429f8a9c5136bedd6356513ec999fb5008e3994fc1b1268ece70eef9eb7c402d70bbf1"}}}, 0xfc) (async) 14:08:03 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000080)=@bpq0, 0x10) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000180)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[r2, r3], &(0x7f0000000240)=[0x2800000000000000, 0xdb, 0x3, 0x8, 0x9, 0x2, 0x7ff], 0x2}) accept$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @default}, [@remote, @default, @default, @netrom, @netrom, @null, @remote, @null]}, &(0x7f0000000000)=0x48) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:03 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x12000, 0x0) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) [ 2837.938600] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de 14:08:03 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x4, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:03 executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x3, 0x1}, 0x6) 14:08:03 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000140), 0x101000) write$bt_hci(r1, &(0x7f0000000080)={0x1, @le_set_ext_adv_enable={{0x2039, 0xa1}, {0x7, 0x0, "db136e75444a5392c645166f5116e3c92c61421d3900d18e6d5a390ab339cf7524542ec2bb8a7828c6e816cedacf89131c4eec49a5e35dd5e94cc0c2bdeb2f44516dc1b57a52b1c9a03324103c994afe50ee25ff63ef60bfdeaaee9e8d20c1bc961bfffd00b596e09a94ca820d6b83193fa988279051209c5594ed8a6603dfa8b9e3725c8bfd657fa178e990887984cc8fe8be9bd2e314fe9025f13add3e31"}}}, 0xa5) 14:08:03 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x4) 14:08:03 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x12000, 0x0) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) 14:08:03 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000080)=@bpq0, 0x10) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000180)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[r2, r3], &(0x7f0000000240)=[0x2800000000000000, 0xdb, 0x3, 0x8, 0x9, 0x2, 0x7ff], 0x2}) (async) accept$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @default}, [@remote, @default, @default, @netrom, @netrom, @null, @remote, @null]}, &(0x7f0000000000)=0x48) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:03 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x4, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x4, 0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:08:03 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000100)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x6, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) bind$bt_hci(r0, &(0x7f0000000180)={0x1f, 0x1, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r2, 0x80045105, &(0x7f0000000000)) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x446181, 0x0) write$P9_RWALK(r3, &(0x7f00000000c0)={0x30, 0x6f, 0x2, {0x3, [{0x4, 0x2, 0x1}, {0x14, 0x4}, {0x8, 0x2, 0x1}]}}, 0x30) ioctl$SNDCTL_TMR_STOP(r3, 0x5403) 14:08:03 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000000214020039000000000800010000000000"], 0x24}, 0x1, 0x0, 0x0, 0x4c001}, 0x8000) write$P9_RLERROR(0xffffffffffffffff, &(0x7f0000000140)={0xe, 0x7, 0x1, {0x5, 'syz1\x00'}}, 0xe) 14:08:03 executing program 0: ioctl$SNDCTL_SEQ_SYNC(0xffffffffffffffff, 0x5101) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:08:04 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x4) 14:08:04 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000100)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x6, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) bind$bt_hci(r0, &(0x7f0000000180)={0x1f, 0x1, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r2, 0x80045105, &(0x7f0000000000)) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x446181, 0x0) write$P9_RWALK(r3, &(0x7f00000000c0)={0x30, 0x6f, 0x2, {0x3, [{0x4, 0x2, 0x1}, {0x14, 0x4}, {0x8, 0x2, 0x1}]}}, 0x30) ioctl$SNDCTL_TMR_STOP(r3, 0x5403) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$ax25(0x3, 0x3, 0x0) (async) getpeername$ax25(r1, 0x0, 0x0) (async) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000100)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x6, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) (async) bind$bt_hci(r0, &(0x7f0000000180)={0x1f, 0x1, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r2, 0x0, 0x0) (async) ioctl$SNDCTL_SEQ_GETINCOUNT(r2, 0x80045105, &(0x7f0000000000)) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x446181, 0x0) (async) write$P9_RWALK(r3, &(0x7f00000000c0)={0x30, 0x6f, 0x2, {0x3, [{0x4, 0x2, 0x1}, {0x14, 0x4}, {0x8, 0x2, 0x1}]}}, 0x30) (async) ioctl$SNDCTL_TMR_STOP(r3, 0x5403) (async) 14:08:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000080)=@bpq0, 0x10) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000180)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[r2, r3], &(0x7f0000000240)=[0x2800000000000000, 0xdb, 0x3, 0x8, 0x9, 0x2, 0x7ff], 0x2}) accept$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @default}, [@remote, @default, @default, @netrom, @netrom, @null, @remote, @null]}, &(0x7f0000000000)=0x48) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000080)=@bpq0, 0x10) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000180)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000001c0)) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000280)={&(0x7f0000000200)=[r2, r3], &(0x7f0000000240)=[0x2800000000000000, 0xdb, 0x3, 0x8, 0x9, 0x2, 0x7ff], 0x2}) (async) accept$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @default}, [@remote, @default, @default, @netrom, @netrom, @null, @remote, @null]}, &(0x7f0000000000)=0x48) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:08:04 executing program 0: ioctl$SNDCTL_SEQ_SYNC(0xffffffffffffffff, 0x5101) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) ioctl$SNDCTL_SEQ_SYNC(0xffffffffffffffff, 0x5101) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async) 14:08:04 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000000214020039000000000800010000000000"], 0x24}, 0x1, 0x0, 0x0, 0x4c001}, 0x8000) write$P9_RLERROR(0xffffffffffffffff, &(0x7f0000000140)={0xe, 0x7, 0x1, {0x5, 'syz1\x00'}}, 0xe) 14:08:04 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x4, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x4, 0x4) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) 14:08:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000fef000/0xf000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0xf000}) 14:08:04 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async, rerun: 32) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x4) (rerun: 32) 14:08:04 executing program 0: ioctl$SNDCTL_SEQ_SYNC(0xffffffffffffffff, 0x5101) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 14:08:04 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) (async, rerun: 64) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000100)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x6, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) (rerun: 64) bind$bt_hci(r0, &(0x7f0000000180)={0x1f, 0x1, 0x1}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r2, 0x80045105, &(0x7f0000000000)) (async) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x446181, 0x0) write$P9_RWALK(r3, &(0x7f00000000c0)={0x30, 0x6f, 0x2, {0x3, [{0x4, 0x2, 0x1}, {0x14, 0x4}, {0x8, 0x2, 0x1}]}}, 0x30) ioctl$SNDCTL_TMR_STOP(r3, 0x5403) 14:08:04 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) (async) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000000214020039000000000800010000000000"], 0x24}, 0x1, 0x0, 0x0, 0x4c001}, 0x8000) (async) write$P9_RLERROR(0xffffffffffffffff, &(0x7f0000000140)={0xe, 0x7, 0x1, {0x5, 'syz1\x00'}}, 0xe) 14:08:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000fef000/0xf000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0xf000}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) (async) write$apparmor_current(r2, 0x0, 0x0) (async) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000fef000/0xf000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0xf000}) (async) 14:08:04 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000040)={0x0, 0x1, r1, 0x200, 0x80000}) write$bt_hci(r1, &(0x7f0000000080)={0x1, @disconn_logical_link={{0x43a, 0x2}, {0xfffd}}}, 0x6) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x2}, 0x6) 14:08:04 executing program 4: bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RFLUSH(0xffffffffffffffff, &(0x7f0000000280)={0x7, 0x6d, 0x1}, 0x7) ioctl$sock_bt_hci(r0, 0xc000003b, &(0x7f0000000200)="61b761da02f590e2fecd8c784b584ccaa50eb2004e034c24d93e81d5a8afe07d5252e70765f0a539dac961834398d4ffd95e913dec9d07eb4148d5f9619f93839b24021a351d003e42a167c79c87241d") bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="011333bf6c3b607f2564fff8b5e400"], 0x7) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0x20800, 0x0) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f00000001c0)={0x9, [0x81, 0x4], 0x4}, 0x10) ioctl$sock_bt_hci(r1, 0x400448e3, &(0x7f0000000000)="0718ddfc25586ba0780187") getpeername$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @default}, [@netrom, @bcast, @null, @netrom, @remote, @rose, @rose, @bcast]}, &(0x7f0000000080)=0x48) 14:08:04 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) getpeername$ax25(r1, 0x0, 0x0) ioctl$SIOCAX25GETINFO(r1, 0x89ed, &(0x7f0000000040)) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) sendto$isdn(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0xa66, "c5eb176e3ceca2dd4881b50d272507a8c35e51674e6571231b464e06d8743863049421e47b32f0b6605d7ed2fa5807e8c4da8f60fd4d5d0fc8ccea57a92bd7002367fb26e5def3b6accd"}, 0x52, 0x40088c0, &(0x7f0000000140)={0x22, 0x3, 0x8, 0x80, 0xf8}, 0x6) 14:08:04 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) 14:08:04 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="01128e27aaaa16b7aaaa1106afd9099234dd83e402b78be7dbb3b5516bdddcc2b3288d3ec9213b27c82102a81e8f665af623584159bc733cc351fc4874f323d50eb9871a0aa2a63e06defc69526a58038aabecc1f060e80e3c8bb2a76c4fefee2f8f15e9c1dbbfc23ba77e27ead031aedcd1f920b1d0809ee418ae7fd0d0e918f5c86d5abd73e0fa16c37038b33e72d61738d4cc990e3d10430f59b88af122e2fabe19d5dad168cf26c98c9c51ab06f0dda658582e5a717c8f5725e46ef76a3e027f24764e27a335c1802fc8fcdaae77f2c6eed911ca4162ce8203d3d337d65269f04297"], 0xb) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80) write$P9_RWALK(r2, &(0x7f00000000c0)={0x30, 0x6f, 0x1, {0x3, [{0x0, 0x2, 0x8}, {0x8, 0x2, 0x6}, {0x2, 0x3, 0x6}]}}, 0x30) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x2, 0x1}, 0x6) 14:08:04 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000040)={0x0, 0x1, r1, 0x200, 0x80000}) write$bt_hci(r1, &(0x7f0000000080)={0x1, @disconn_logical_link={{0x43a, 0x2}, {0xfffd}}}, 0x6) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x2}, 0x6) 14:08:04 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) (rerun: 64) getpeername$ax25(r1, 0x0, 0x0) (async) ioctl$SIOCAX25GETINFO(r1, 0x89ed, &(0x7f0000000040)) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) (async, rerun: 64) sendto$isdn(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0xa66, "c5eb176e3ceca2dd4881b50d272507a8c35e51674e6571231b464e06d8743863049421e47b32f0b6605d7ed2fa5807e8c4da8f60fd4d5d0fc8ccea57a92bd7002367fb26e5def3b6accd"}, 0x52, 0x40088c0, &(0x7f0000000140)={0x22, 0x3, 0x8, 0x80, 0xf8}, 0x6) (rerun: 64) 14:08:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000500), 0x20000, 0x0) write$apparmor_current(r2, 0x0, 0x0) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000fef000/0xf000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0xf000}) 14:08:04 executing program 4: bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RFLUSH(0xffffffffffffffff, &(0x7f0000000280)={0x7, 0x6d, 0x1}, 0x7) ioctl$sock_bt_hci(r0, 0xc000003b, &(0x7f0000000200)="61b761da02f590e2fecd8c784b584ccaa50eb2004e034c24d93e81d5a8afe07d5252e70765f0a539dac961834398d4ffd95e913dec9d07eb4148d5f9619f93839b24021a351d003e42a167c79c87241d") bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="011333bf6c3b607f2564fff8b5e400"], 0x7) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0x20800, 0x0) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f00000001c0)={0x9, [0x81, 0x4], 0x4}, 0x10) ioctl$sock_bt_hci(r1, 0x400448e3, &(0x7f0000000000)="0718ddfc25586ba0780187") getpeername$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @default}, [@netrom, @bcast, @null, @netrom, @remote, @rose, @rose, @bcast]}, &(0x7f0000000080)=0x48) bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$P9_RFLUSH(0xffffffffffffffff, &(0x7f0000000280)={0x7, 0x6d, 0x1}, 0x7) (async) ioctl$sock_bt_hci(r0, 0xc000003b, &(0x7f0000000200)="61b761da02f590e2fecd8c784b584ccaa50eb2004e034c24d93e81d5a8afe07d5252e70765f0a539dac961834398d4ffd95e913dec9d07eb4148d5f9619f93839b24021a351d003e42a167c79c87241d") (async) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="011333bf6c3b607f2564fff8b5e400"], 0x7) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0x20800, 0x0) (async) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f00000001c0)={0x9, [0x81, 0x4], 0x4}, 0x10) (async) ioctl$sock_bt_hci(r1, 0x400448e3, &(0x7f0000000000)="0718ddfc25586ba0780187") (async) getpeername$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @default}, [@netrom, @bcast, @null, @netrom, @remote, @rose, @rose, @bcast]}, &(0x7f0000000080)=0x48) (async) 14:08:04 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) write$bt_hci(r0, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) (async) 14:08:04 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="01128e27aaaa16b7aaaa1106afd9099234dd83e402b78be7dbb3b5516bdddcc2b3288d3ec9213b27c82102a81e8f665af623584159bc733cc351fc4874f323d50eb9871a0aa2a63e06defc69526a58038aabecc1f060e80e3c8bb2a76c4fefee2f8f15e9c1dbbfc23ba77e27ead031aedcd1f920b1d0809ee418ae7fd0d0e918f5c86d5abd73e0fa16c37038b33e72d61738d4cc990e3d10430f59b88af122e2fabe19d5dad168cf26c98c9c51ab06f0dda658582e5a717c8f5725e46ef76a3e027f24764e27a335c1802fc8fcdaae77f2c6eed911ca4162ce8203d3d337d65269f04297"], 0xb) (async) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, 0x0, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 64) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (rerun: 64) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) (async) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80) write$P9_RWALK(r2, &(0x7f00000000c0)={0x30, 0x6f, 0x1, {0x3, [{0x0, 0x2, 0x8}, {0x8, 0x2, 0x6}, {0x2, 0x3, 0x6}]}}, 0x30) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x2, 0x1}, 0x6) 14:08:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000000)=0x2, 0x4) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000200)={0x5, [0x8, 0x7], 0x7fff}, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448ca, &(0x7f0000000100)="c90b6d7ca7b36ed13f53a729aa3c4cb86b623dbb6aa6607b92e9f5770a4d6cd1cb5707d70e95e5232fa364b5bcebaea3d761c751d38dc812ba4f9e1018a5aaeda5c768b9eb0a525356ef5a194a837ea801a1a5c61027bd70cbea49b7b6083a36b314506bbaffa5fc20247450ae26b513de0afe7eb9327356aef3a092122dd31ca954caea6c0f148eea7b9f345d26c97c9c8da7c4fdd56742dae51b72c4ae461791201396ebc9d9a0ceb7c13c5ff202ce4cae3d195c70ab") bind$bt_hci(r2, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f00000001c0)={0x7, [0x7, 0x400], 0x4}, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f0000000080)={0x1, @user_passkey_reply={{0x42e, 0xa}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x380000}}}, 0xe) ioctl$HCIINQUIRY(r3, 0x800448f0, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) 14:08:04 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f0000000400)={0x1, @set_conn_encrypt={{0x413, 0x3}}}, 0x7) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000040)={0x0, 0x1, r1, 0x200, 0x80000}) write$bt_hci(r1, &(0x7f0000000080)={0x1, @disconn_logical_link={{0x43a, 0x2}, {0xfffd}}}, 0x6) (async) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0x2}, 0x6) 14:08:04 executing program 4: bind$bt_hci(0xffffffffffffffff, &(0x7f00000000c0)={0x1f, 0xffffffffffffffff}, 0x6) (async) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RFLUSH(0xffffffffffffffff, &(0x7f0000000280)={0x7, 0x6d, 0x1}, 0x7) (async) ioctl$sock_bt_hci(r0, 0xc000003b, &(0x7f0000000200)="61b761da02f590e2fecd8c784b584ccaa50eb2004e034c24d93e81d5a8afe07d5252e70765f0a539dac961834398d4ffd95e913dec9d07eb4148d5f9619f93839b24021a351d003e42a167c79c87241d") (async) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="011333bf6c3b607f2564fff8b5e400"], 0x7) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0x20800, 0x0) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f00000001c0)={0x9, [0x81, 0x4], 0x4}, 0x10) ioctl$sock_bt_hci(r1, 0x400448e3, &(0x7f0000000000)="0718ddfc25586ba0780187") (async) getpeername$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @default}, [@netrom, @bcast, @null, @netrom, @remote, @rose, @rose, @bcast]}, &(0x7f0000000080)=0x48) [ 2864.041549] watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [syz-executor.2:20178] [ 2864.049449] Modules linked in: [ 2864.052627] irq event stamp: 12106 [ 2864.056152] hardirqs last enabled at (12105): [] kvm_wait+0x14b/0x240 [ 2864.064385] hardirqs last disabled at (12106): [] apic_timer_interrupt+0x8e/0xa0 [ 2864.073466] softirqs last enabled at (2050): [] __do_softirq+0x68b/0x9ff [ 2864.081939] softirqs last disabled at (1951): [] irq_exit+0x193/0x240 [ 2864.090061] CPU: 0 PID: 20178 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2864.098789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2864.108125] task: ffff888095064680 task.stack: ffff88809b8a8000 [ 2864.114165] RIP: 0010:native_safe_halt+0xe/0x10 [ 2864.118812] RSP: 0018:ffff88809b8afb20 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 [ 2864.126499] RAX: 1ffffffff11e1314 RBX: ffffffff89ddb5ac RCX: 1ffff11012a0c9ef [ 2864.133751] RDX: dffffc0000000000 RSI: ffff888095064f58 RDI: ffff888095064f04 [ 2864.141016] RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000 [ 2864.148270] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000286 [ 2864.155522] R13: dffffc0000000000 R14: ffffffff89ddb5ad R15: ffffed10174869e8 [ 2864.162775] FS: 00007fd0c35ce700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000 [ 2864.170984] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2864.176848] CR2: 0000000000000000 CR3: 00000000a9773000 CR4: 00000000003406f0 [ 2864.184103] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2864.191351] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2864.198603] Call Trace: [ 2864.201204] kvm_wait+0x179/0x240 [ 2864.204644] __pv_queued_spin_lock_slowpath+0x722/0x910 [ 2864.209994] ? hci_send_to_channel+0x3c/0x200 [ 2864.214470] queued_read_lock_slowpath+0x150/0x190 [ 2864.219381] hci_send_to_channel+0x3c/0x200 [ 2864.223684] hci_send_monitor_ctrl_event+0x3dd/0x500 [ 2864.228771] mgmt_send_event+0x2b3/0x330 [ 2864.232816] mgmt_index_removed+0x200/0x240 [ 2864.237118] ? mgmt_index_added+0x210/0x210 [ 2864.241424] ? _raw_read_unlock+0x29/0x40 [ 2864.245556] ? hci_dev_get+0xe6/0x190 [ 2864.249334] hci_sock_bind+0xe00/0x12b0 [ 2864.253288] ? hci_sock_ioctl+0x6c0/0x6c0 [ 2864.257418] ? security_socket_bind+0x83/0xb0 [ 2864.261899] SyS_bind+0x174/0x1f0 [ 2864.265334] ? SyS_socketpair+0x480/0x480 [ 2864.269464] ? SyS_futex+0x1e3/0x290 [ 2864.273161] ? do_futex+0x1570/0x1570 [ 2864.276943] ? security_file_ioctl+0x83/0xb0 [ 2864.281331] ? fput_many+0xe/0x140 [ 2864.284852] ? do_syscall_64+0x4c/0x640 [ 2864.288807] ? SyS_socketpair+0x480/0x480 [ 2864.292934] do_syscall_64+0x1d5/0x640 [ 2864.296816] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2864.301985] RIP: 0033:0x7fd0c4c590e9 [ 2864.305677] RSP: 002b:00007fd0c35ce168 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 2864.313365] RAX: ffffffffffffffda RBX: 00007fd0c4d6bf60 RCX: 00007fd0c4c590e9 [ 2864.320617] RDX: 0000000000000006 RSI: 0000000020000040 RDI: 0000000000000004 [ 2864.327867] RBP: 00007fd0c4cb308d R08: 0000000000000000 R09: 0000000000000000 [ 2864.335117] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2864.342369] R13: 00007ffe2ba7ca1f R14: 00007fd0c35ce300 R15: 0000000000022000 [ 2864.349622] Code: 8b 5a fa e9 4f ff ff ff 48 89 ef e8 4d 8b 5a fa eb 93 90 90 90 90 90 90 90 90 90 90 90 e9 07 00 00 00 0f 00 2d b4 19 63 00 fb f4 90 e9 07 00 00 00 0f 00 2d a4 19 63 00 f4 c3 90 90 41 55 41 [ 2864.368769] Sending NMI from CPU 0 to CPUs 1: [ 2864.373622] NMI backtrace for cpu 1 [ 2864.373626] CPU: 1 PID: 20170 Comm: syz-executor.0 Not tainted 4.14.277-syzkaller #0 [ 2864.373630] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2864.373633] task: ffff8880ac2ca640 task.stack: ffff888093c40000 [ 2864.373636] RIP: 0010:queued_write_lock_slowpath+0xcb/0x1d0 [ 2864.373638] RSP: 0018:ffff888093c47950 EFLAGS: 00000206 [ 2864.373643] RAX: 0000000000000101 RBX: ffffffff89ddb5a8 RCX: 00000000000005f7 [ 2864.373646] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff89ddb5a8 [ 2864.373649] RBP: ffffffff89ddb5ac R08: ffffffff8b9a8a78 R09: 0000000000040590 [ 2864.373652] R10: ffff8880ac2caf18 R11: ffff8880ac2ca640 R12: 0000000000000003 [ 2864.373655] R13: fffffbfff13bb6b5 R14: 00000000000000ff R15: ffff8880a7c4dc90 [ 2864.373659] FS: 0000000000000000(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 [ 2864.373662] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2864.373665] CR2: 00007f66aacc3f64 CR3: 0000000008e6a000 CR4: 00000000003406e0 [ 2864.373668] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2864.373671] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2864.373673] Call Trace: [ 2864.373675] do_raw_write_lock+0xc2/0x1d0 [ 2864.373677] bt_sock_unlink+0x1d/0x170 [ 2864.373679] hci_sock_release+0xc1/0x4c0 [ 2864.373681] __sock_release+0xcd/0x2b0 [ 2864.373684] ? __sock_release+0x2b0/0x2b0 [ 2864.373686] sock_close+0x15/0x20 [ 2864.373687] __fput+0x25f/0x7a0 [ 2864.373690] task_work_run+0x11f/0x190 [ 2864.373692] do_exit+0xa44/0x2850 [ 2864.373694] ? wake_up_q+0x82/0xd0 [ 2864.373696] ? mm_update_next_owner+0x5b0/0x5b0 [ 2864.373698] ? get_signal+0x323/0x1ca0 [ 2864.373700] ? lock_acquire+0x170/0x3f0 [ 2864.373702] ? lock_downgrade+0x740/0x740 [ 2864.373705] do_group_exit+0x100/0x2e0 [ 2864.373707] get_signal+0x38d/0x1ca0 [ 2864.373709] ? do_futex+0x127/0x1570 [ 2864.373711] ? __fget+0x265/0x3e0 [ 2864.373713] do_signal+0x7c/0x1550 [ 2864.373715] ? sockfd_lookup_light+0xb2/0x160 [ 2864.373717] ? SyS_sendto+0x1e7/0x2c0 [ 2864.373719] ? setup_sigcontext+0x820/0x820 [ 2864.373722] ? finish_task_switch+0x178/0x610 [ 2864.373724] ? SyS_futex+0x1da/0x290 [ 2864.373726] ? SyS_futex+0x1e3/0x290 [ 2864.373728] ? exit_to_usermode_loop+0x41/0x200 [ 2864.373731] exit_to_usermode_loop+0x160/0x200 [ 2864.373733] do_syscall_64+0x4a3/0x640 [ 2864.373735] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2864.373737] RIP: 0033:0x7ff7eed620e9 [ 2864.373740] RSP: 002b:00007ff7ed632218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 2864.373746] RAX: fffffffffffffe00 RBX: 00007ff7eee75378 RCX: 00007ff7eed620e9 [ 2864.373749] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007ff7eee75378 [ 2864.373752] RBP: 00007ff7eee75370 R08: 0000000000000000 R09: 0000000000000000 [ 2864.373755] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff7eee7537c [ 2864.373758] R13: 00007ffcada76a5f R14: 00007ff7ed632300 R15: 0000000000022000 [ 2864.373760] Code: 75 dc 49 89 dd 49 89 dc 41 be ff 00 00 00 49 c1 ed 03 41 83 e4 07 48 b8 00 00 00 00 00 fc ff df 49 01 c5 41 83 c4 03 eb 02 f3 90 <41> 0f b6 45 00 41 38 c4 7c 08 84 c0 0f 85 9e 00 00 00 8b 03 83 [ 2864.374249] Kernel panic - not syncing: softlockup: hung tasks [ 2864.673550] CPU: 0 PID: 20178 Comm: syz-executor.2 Tainted: G L 4.14.277-syzkaller #0 [ 2864.682624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2864.691956] Call Trace: [ 2864.694520] [ 2864.696659] dump_stack+0x1b2/0x281 [ 2864.700268] panic+0x1f9/0x42d [ 2864.703440] ? add_taint.cold+0x16/0x16 [ 2864.707398] ? printk_safe_flush+0xa9/0x110 [ 2864.711705] watchdog_timer_fn.cold+0x16/0x25 [ 2864.716183] __hrtimer_run_queues+0x30b/0xc80 [ 2864.720663] ? watchdog+0x50/0x50 [ 2864.724097] ? retrigger_next_event+0x310/0x310 [ 2864.728745] ? ktime_get_update_offsets_now+0x272/0x3f0 [ 2864.734089] hrtimer_interrupt+0x1e6/0x5e0 [ 2864.738312] smp_apic_timer_interrupt+0x117/0x5e0 [ 2864.743137] apic_timer_interrupt+0x93/0xa0 [ 2864.747438] [ 2864.749657] RIP: 0010:native_safe_halt+0xe/0x10 [ 2864.754301] RSP: 0018:ffff88809b8afb20 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 [ 2864.761990] RAX: 1ffffffff11e1314 RBX: ffffffff89ddb5ac RCX: 1ffff11012a0c9ef [ 2864.769240] RDX: dffffc0000000000 RSI: ffff888095064f58 RDI: ffff888095064f04 [ 2864.776491] RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000 [ 2864.783742] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000286 [ 2864.790993] R13: dffffc0000000000 R14: ffffffff89ddb5ad R15: ffffed10174869e8 [ 2864.798255] kvm_wait+0x179/0x240 [ 2864.801707] __pv_queued_spin_lock_slowpath+0x722/0x910 [ 2864.807056] ? hci_send_to_channel+0x3c/0x200 [ 2864.811531] queued_read_lock_slowpath+0x150/0x190 [ 2864.816440] hci_send_to_channel+0x3c/0x200 [ 2864.820748] hci_send_monitor_ctrl_event+0x3dd/0x500 [ 2864.825836] mgmt_send_event+0x2b3/0x330 [ 2864.829886] mgmt_index_removed+0x200/0x240 [ 2864.834190] ? mgmt_index_added+0x210/0x210 [ 2864.838495] ? _raw_read_unlock+0x29/0x40 [ 2864.842623] ? hci_dev_get+0xe6/0x190 [ 2864.846406] hci_sock_bind+0xe00/0x12b0 [ 2864.850360] ? hci_sock_ioctl+0x6c0/0x6c0 [ 2864.854491] ? security_socket_bind+0x83/0xb0 [ 2864.858983] SyS_bind+0x174/0x1f0 [ 2864.862417] ? SyS_socketpair+0x480/0x480 [ 2864.866548] ? SyS_futex+0x1e3/0x290 [ 2864.870242] ? do_futex+0x1570/0x1570 [ 2864.874024] ? security_file_ioctl+0x83/0xb0 [ 2864.878412] ? fput_many+0xe/0x140 [ 2864.881936] ? do_syscall_64+0x4c/0x640 [ 2864.885896] ? SyS_socketpair+0x480/0x480 [ 2864.890200] do_syscall_64+0x1d5/0x640 [ 2864.894117] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2864.899285] RIP: 0033:0x7fd0c4c590e9 [ 2864.902976] RSP: 002b:00007fd0c35ce168 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 2864.910664] RAX: ffffffffffffffda RBX: 00007fd0c4d6bf60 RCX: 00007fd0c4c590e9 [ 2864.917915] RDX: 0000000000000006 RSI: 0000000020000040 RDI: 0000000000000004 [ 2864.925167] RBP: 00007fd0c4cb308d R08: 0000000000000000 R09: 0000000000000000 [ 2864.932417] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2864.939668] R13: 00007ffe2ba7ca1f R14: 00007fd0c35ce300 R15: 0000000000022000 [ 2864.947262] Kernel Offset: disabled [ 2864.950881] Rebooting in 86400 seconds..