./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor471597392

<...>
Warning: Permanently added '10.128.0.28' (ECDSA) to the list of known hosts.
execve("./syz-executor471597392", ["./syz-executor471597392"], 0x7ffc7bb9eb80 /* 10 vars */) = 0
brk(NULL)                               = 0x555555b80000
brk(0x555555b80c40)                     = 0x555555b80c40
arch_prctl(ARCH_SET_FS, 0x555555b80300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
set_tid_address(0x555555b805d0)         = 4998
set_robust_list(0x555555b805e0, 24)     = 0
rt_sigaction(SIGRTMIN, {sa_handler=0x7f3c5044f440, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f3c5044fb10}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=0x7f3c5044f4e0, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f3c5044fb10}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor471597392", 4096) = 27
brk(0x555555ba1c40)                     = 0x555555ba1c40
brk(0x555555ba2000)                     = 0x555555ba2000
mprotect(0x7f3c50511000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
getpid()                                = 4998
openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3
write(3, "10000000000", 11)             = 11
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3
write(3, "20", 2)                       = 2
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3
write(3, "100", 3)                      = 3
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3
write(3, "7 4 1 3", 7)                  = 7
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3
write(3, "1", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1)                        = 1
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3
write(3, "4998", 4)                     = 4
close(3)                                = 0
mount(NULL, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, NULL) = -1 EBUSY (Device or resource busy)
openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3
write(3, "\x3a\x73\x79\x7a\x30\x3a\x4d\x3a\x30\x3a\x01\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a", 21) = 21
close(3)                                = 0
openat(AT_FDCWD, "/proc/sys/fs/binfmt_misc/register", O_WRONLY|O_CLOEXEC) = 3
write(3, "\x3a\x73\x79\x7a\x31\x3a\x4d\x3a\x31\x3a\x02\x3a\x3a\x2e\x2f\x66\x69\x6c\x65\x30\x3a\x50\x4f\x43", 24) = 24
close(3)                                = 0
socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
sendto(4, [{nlmsg_len=36, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36
recvfrom(4, [{nlmsg_len=784, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=4998}, "\x01\x02\x00\x00\x0d\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x35\x34\x00\x00\x00\x00\x06\x00\x01\x00\x1d\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x2e\x00\x00\x00\x98\x02\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x05\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x03\x00"...], 4096, 0, NULL, NULL) = 784
recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=4998}, {error=0, msg={nlmsg_len=36, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
access("/proc/net", R_OK)               = 0
access("/proc/net/unix", R_OK)          = 0
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0
close(5)                                = 0
sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x06\x00\x0a\x00\xa0\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36
recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=4998}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
ioctl(5, SIOCGIFINDEX, {ifr_name="wpan0", ifr_ifindex=11}) = 0
close(5)                                = 0
sendto(3, [{nlmsg_len=44, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x0c\x00\x01\x00\x02\x00\xaa\xaa\xaa\xaa\xaa\xaa"], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44
recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=4998}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
sendto(3, [{nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=0, ifi_flags=0, ifi_change=0}, [[{nla_len=11, nla_type=IFLA_IFNAME}, "lowpan0"...], [{nla_len=16, nla_type=IFLA_LINKINFO}, [{nla_len=10, nla_type=IFLA_INFO_KIND}, "lowpan"...]], [{nla_len=8, nla_type=IFLA_LINK}, 11]]], 68, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 68
recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=4998}, {error=0, msg={nlmsg_len=68, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK|NLM_F_EXCL|NLM_F_CREATE, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0
close(5)                                = 0
sendto(4, [{nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x0b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x06\x00\x0a\x00\xa1\xaa\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36
recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=4998}, {error=0, msg={nlmsg_len=36, nlmsg_type=nl802154, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
ioctl(5, SIOCGIFINDEX, {ifr_name="wpan1", ifr_ifindex=12}) = 0
close(5)                                = 0
sendto(3, [{nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, {ifi_family=AF_UNSPEC, ifi_type=ARPHRD_NETROM, ifi_index=if_nametoindex("wpan1"), ifi_flags=IFF_UP, ifi_change=0x1}, [{nla_len=12, nla_type=IFLA_ADDRESS}, 02:01:aa:aa:aa:aa:aa]], 44, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 44
recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=4998}, {error=0, msg={nlmsg_len=44, nlmsg_type=RTM_NEWLINK, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
close(3)                                = 0
close(4)                                = 0
unshare(CLONE_NEWPID)                   = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5001 attached
, child_tidptr=0x555555b805d0) = 5001
[pid  5001] set_robust_list(0x555555b805e0, 24) = 0
[pid  5001] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy)
[pid  5001] socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI) = 3
[pid  5001] openat(AT_FDCWD, "/dev/vhci", O_RDWR) = 4
[pid  5001] dup2(4, 202)                = 202
[pid  5001] close(4)                    = 0
[pid  5001] write(202, "\xff\x00", 2)   = 2
[pid  5001] read(202, "\xff\x00\x00\x00", 4) = 4
[pid  5001] mmap(NULL, 8392704, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f3c4fc3d000
[pid  5001] mprotect(0x7f3c4fc3e000, 8388608, PROT_READ|PROT_WRITE) = 0
[pid  5001] clone(child_stack=0x7f3c5043d3f0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID./strace-static-x86_64: Process 5003 attached
 <unfinished ...>
[pid  5003] set_robust_list(0x7f3c5043d9e0, 24) = 0
[pid  5003] read(202, "\x01\x03\x0c\x00", 1024) = 4
[pid  5003] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5001] <... clone resumed>, parent_tid=[2], tls=0x7f3c5043d700, child_tidptr=0x7f3c5043d9d0) = 2
[pid  5003] read(202,  <unfinished ...>
[pid  5001] ioctl(3, HCIDEVUP <unfinished ...>
[pid  5003] <... read resumed>"\x01\x03\x10\x00", 1024) = 4
[pid  5003] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x03\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5003] read(202, "\x01\x01\x10\x00", 1024) = 4
[pid  5003] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x01\x10", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5003] read(202, "\x01\x09\x10\x00", 1024) = 4
[pid  5003] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0a", iov_len=2}, {iov_base="\x01\x09\x10", iov_len=3}, {iov_base="\x00\xaa\xaa\xaa\xaa\xaa\xaa", iov_len=7}], 4) = 13
[pid  5003] read(202, "\x01\x05\x10\x00", 1024) = 4
[pid  5003] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x0b", iov_len=2}, {iov_base="\x01\x05\x10", iov_len=3}, {iov_base="\x00\xfd\x03\x60\x04\x00\x06\x00", iov_len=8}], 4) = 14
[pid  5003] read(202, "\x01\x23\x0c\x00", 1024) = 4
[pid  5003] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x23\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5003] read(202, "\x01\x14\x0c\x00", 1024) = 4
[pid  5003] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x14\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5003] read(202, "\x01\x25\x0c\x00", 1024) = 4
[pid  5003] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x25\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5003] read(202, "\x01\x38\x0c\x00", 1024) = 4
syzkaller login: [   43.799411][ T5002] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   43.808526][ T5002] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   43.817148][ T5002] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   43.827863][ T5002] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   43.836423][ T5002] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[pid  5003] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x38\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5003] read(202, "\x01\x39\x0c\x00", 1024) = 4
[pid  5003] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x39\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5003] read(202, "\x01\x16\x0c\x02\x00\x7d", 1024) = 6
[pid  5003] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\xfc", iov_len=2}, {iov_base="\x01\x16\x0c", iov_len=3}, {iov_base="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., iov_len=249}], 4) = 255
[pid  5003] read(202,  <unfinished ...>
[pid  5001] <... ioctl resumed>, 0)     = -1 EALREADY (Operation already in progress)
[pid  5001] ioctl(3, HCISETSCAN <unfinished ...>
[pid  5003] <... read resumed>"\x01\x1a\x0c\x01\x02", 1024) = 5
[pid  5003] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x0e\x04", iov_len=2}, {iov_base="\x01\x1a\x0c", iov_len=3}, {iov_base="\x00", iov_len=1}], 4) = 7
[pid  5003] madvise(0x7f3c4fc3d000, 8372224, MADV_DONTNEED) = 0
[pid  5001] <... ioctl resumed>, 0x7ffde7302890) = 0
[pid  5003] exit(0)                     = ?
[pid  5001] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x04\x0a", iov_len=2}, {iov_base="\xaa\xaa\xaa\xaa\xaa\x10\x00\x00\x00\x01", iov_len=10}], 3) = 13
[pid  5001] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x03\x0b", iov_len=2}, {iov_base="\x00\xc8\x00\xaa\xaa\xaa\xaa\xaa\x10\x01\x00", iov_len=11}], 3) = 14
[pid  5001] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\v\v", iov_len=2}, {iov_base="\x00\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=11}], 3) = 14
[pid  5001] writev(202, [{iov_base="\x04", iov_len=1}, {iov_base="\x3e\x13", iov_len=2}, {iov_base="\x01\x00\xc9\x00\x01\x00\xaa\xaa\xaa\xaa\xaa\x11\x00\x00\x00\x00\x00\x00\x00", iov_len=19}], 3) = 22
[pid  5001] close(3)                    = 0
[pid  5001] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5001] setsid()                    = 1
[pid  5001] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0
[pid  5001] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0
[pid  5001] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0
[pid  5001] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0
[pid  5001] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0
[pid  5001] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0
[pid  5001] unshare(CLONE_NEWNS)        = 0
[pid  5001] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0
[pid  5001] unshare(CLONE_NEWIPC)       = 0
[pid  5001] unshare(CLONE_NEWCGROUP)    = 0
[pid  5001] unshare(CLONE_NEWUTS)       = 0
[pid  5001] unshare(CLONE_SYSVSEM)      = 0
[pid  5001] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5001] write(3, "16777216", 8 <unfinished ...>
[pid  5003] +++ exited with 0 +++
[pid  5001] <... write resumed>)        = 8
[pid  5001] close(3)                    = 0
[pid  5001] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3
[pid  5001] write(3, "536870912", 9)    = 9
[pid  5001] close(3)                    = 0
[pid  5001] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5001] write(3, "1024", 4)         = 4
[pid  5001] close(3)                    = 0
[pid  5001] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3
[pid  5001] write(3, "8192", 4)         = 4
[pid  5001] close(3)                    = 0
[pid  5001] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3
[pid  5001] write(3, "1024", 4)         = 4
[pid  5001] close(3)                    = 0
[pid  5001] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3
[pid  5001] write(3, "1024", 4)         = 4
[pid  5001] close(3)                    = 0
[pid  5001] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3
[pid  5001] write(3, "1024 1048576 500 1024", 21) = 21
[pid  5001] close(3)                    = 0
[pid  5001] getpid()                    = 1
[pid  5001] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[pid  5001] capset({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND|1<<CAP_AUDIT_READ|1<<CAP_PERFMON|1<<CAP_BPF|1<<CAP_CHECKPOINT_RESTORE, inheritable=0}) = 0
[   43.843989][ T5002] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[pid  5001] unshare(CLONE_NEWNET)       = 0
[pid  5001] openat(AT_FDCWD, "/proc/sys/net/ipv4/ping_group_range", O_WRONLY|O_CLOEXEC) = 3
[pid  5001] write(3, "0 65535", 7)      = 7
[pid  5001] close(3)                    = 0
[pid  5001] openat(AT_FDCWD, "/dev/rfkill", O_RDWR) = 3
[pid  5001] write(3, "\x00\x00\x00\x00\x00\x03\x00\x00", 8) = 8
[pid  5001] close(3)                    = 0
[pid  5001] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3
[pid  5001] sendto(3, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 40
[pid  5001] recvfrom(3, [{nlmsg_len=244, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00\x06\x00\x01\x00\x29\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x1c\x00\x00\x00\x90\x00\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00"...], 4096, 0, NULL, NULL) = 244
[pid  5001] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  5001] sendto(3, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid  5001] recvfrom(3, [{nlmsg_len=2496, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x45\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid  5001] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  5001] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36
[pid  5001] recvfrom(3, [{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=2, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x00\x00\x00"]}], 4096, 0, NULL, NULL) = 56
[pid  5001] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid  5001] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0", ifr_ifindex=11}) = 0
[pid  5001] close(4)                    = 0
[pid  5001] sendto(3, [{nlmsg_len=36, nlmsg_type=0x23 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36
[pid  5001] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x23 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  5001] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
[pid  5001] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan0", ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0
[pid  5001] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan0", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST}) = 0
[pid  5001] close(4)                    = 0
[pid  5001] sendto(3, [{nlmsg_len=64, nlmsg_type=0x23 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0b\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 64
[pid  5001] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x23 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  5001] sendto(3, [{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36
[pid  5001] recvfrom(3, [{nlmsg_len=56, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, {error=3, msg=[{nlmsg_len=36, nlmsg_type=0x29 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x04\x00\x00\x00\x04\x00\x0e\x00\x0a\x00\x16\x00\x08\x02\x11\x00\x00\x01\x00\x00"]}], 4096, 0, NULL, NULL) = 56
[pid  5001] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid  5001] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=12}) = 0
[pid  5001] close(4)                    = 0
[pid  5001] sendto(3, [{nlmsg_len=36, nlmsg_type=0x23 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x06\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00"], 36, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 36
[pid  5001] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=36, nlmsg_type=0x23 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  5001] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
[pid  5001] ioctl(4, SIOCGIFFLAGS, {ifr_name="wlan1", ifr_flags=IFF_BROADCAST|IFF_MULTICAST}) = 0
[pid  5001] ioctl(4, SIOCSIFFLAGS, {ifr_name="wlan1", ifr_flags=IFF_UP|IFF_BROADCAST|IFF_MULTICAST}) = 0
[pid  5001] close(4)                    = 0
[pid  5001] sendto(3, [{nlmsg_len=64, nlmsg_type=0x23 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x2b\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x0a\x00\x34\x00\x10\x10\x10\x10\x10\x10\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00\x0a\x00\x06\x00\x50\x50\x50\x50\x50\x50\x00\x00\x04\x00\x3c\x00"], 64, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 64
[pid  5001] recvfrom(3, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=1}, {error=0, msg={nlmsg_len=64, nlmsg_type=0x23 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid  5001] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid  5001] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan0", ifr_ifindex=11}) = 0
[pid  5001] close(4)                    = 0
[   43.929993][   T52] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   43.938185][   T52] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   43.949336][  T896] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[pid  5001] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4
[pid  5001] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid  5001] recvfrom(4, [{nlmsg_len=1444, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0b\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x30\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x3d\x00\x00\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1444
[pid  5001] close(4)                    = 0
[pid  5001] socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 4
[pid  5001] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=12}) = 0
[pid  5001] close(4)                    = 0
[pid  5001] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4
[pid  5001] sendto(4, [{nlmsg_len=32, nlmsg_type=0x12 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid  5001] recvfrom(4, [{nlmsg_len=1444, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=1}, "\x00\x00\x01\x00\x0c\x00\x00\x00\x43\x10\x01\x00\x00\x00\x00\x00\x0a\x00\x03\x00\x77\x6c\x61\x6e\x31\x00\x00\x00\x08\x00\x0d\x00\xe8\x03\x00\x00\x05\x00\x10\x00\x06\x00\x00\x00\x05\x00\x11\x00\x00\x00\x00\x00\x08\x00\x04\x00\xdc\x05\x00\x00\x08\x00\x32\x00\x00\x01\x00\x00\x08\x00\x33\x00\x00\x09\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x08\x00\x1e\x00\x00\x00\x00\x00\x08\x00\x3d\x00\x00\x00\x00\x00"...], 4096, 0, NULL, NULL) = 1444
[pid  5001] close(4)                    = 0
[pid  5001] close(3)                    = 0
[pid  5001] mkdir("/dev/binderfs", 0777) = 0
[pid  5001] mount("binder", "/dev/binderfs", "binder", 0, NULL) = 0
[pid  5001] symlink("/dev/binderfs", "./binderfs") = 0
[pid  5001] memfd_create("syzkaller", 0) = 3
[pid  5001] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f3c4783d000
[pid  5001] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 4194304) = 4194304
[pid  5001] munmap(0x7f3c4783d000, 4194304) = 0
[pid  5001] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[   43.973125][   T52] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   43.981221][   T52] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   43.989875][  T899] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[   44.005588][ T5001] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=5001 'syz-executor471'
[pid  5001] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5001] close(3)                    = 0
[pid  5001] mkdir("./file0", 0777)      = 0
[   44.041347][ T5001] loop0: detected capacity change from 0 to 8192
[   44.052118][ T5001] REISERFS warning:  read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[   44.065734][ T5001] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal
[   44.075144][ T5001] REISERFS (device loop0): using ordered data mode
[   44.081765][ T5001] reiserfs: using flush barriers
[   44.087642][ T5001] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
[   44.104336][ T5001] REISERFS (device loop0): checking transaction log (loop0)
[   44.113699][ T5001] REISERFS (device loop0): Using r5 hash to sort names
[   44.120923][ T5001] ==================================================================
[   44.129047][ T5001] BUG: KASAN: use-after-free in search_by_entry_key+0x823/0x960
[   44.136675][ T5001] Read of size 4 at addr ffff888073ef3004 by task syz-executor471/5001
[   44.144887][ T5001] 
[   44.147207][ T5001] CPU: 0 PID: 5001 Comm: syz-executor471 Not tainted 6.4.0-rc1-syzkaller #0
[   44.155855][ T5001] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
[   44.165895][ T5001] Call Trace:
[   44.169152][ T5001]  <TASK>
[   44.172080][ T5001]  dump_stack_lvl+0xd9/0x150
[   44.176680][ T5001]  print_address_description.constprop.0+0x2c/0x3c0
[   44.183275][ T5001]  ? search_by_entry_key+0x823/0x960
[   44.188553][ T5001]  kasan_report+0x11c/0x130
[   44.193056][ T5001]  ? search_by_entry_key+0x823/0x960
[   44.198334][ T5001]  search_by_entry_key+0x823/0x960
[   44.203432][ T5001]  reiserfs_find_entry.part.0+0x139/0xdf0
[   44.209139][ T5001]  ? search_by_entry_key+0x960/0x960
[   44.214404][ T5001]  ? find_held_lock+0x2d/0x110
[   44.219160][ T5001]  reiserfs_lookup+0x24e/0x610
[   44.223908][ T5001]  ? reiserfs_unlink+0x760/0x760
[   44.228834][ T5001]  ? d_alloc_parallel+0x693/0x1530
[   44.233940][ T5001]  __lookup_slow+0x24c/0x460
[   44.238518][ T5001]  ? lookup_one_qstr_excl+0x180/0x180
[   44.243877][ T5001]  ? lock_downgrade+0x690/0x690
[   44.249338][ T5001]  ? d_lookup+0x105/0x170
[   44.253656][ T5001]  lookup_one_len+0x16e/0x1a0
[   44.258320][ T5001]  ? try_lookup_one_len+0x190/0x190
[   44.263505][ T5001]  reiserfs_lookup_privroot+0x96/0x210
[   44.268954][ T5001]  reiserfs_fill_super+0x1a8d/0x2eb0
[   44.274231][ T5001]  ? reiserfs_remount+0x1650/0x1650
[   44.279527][ T5001]  ? snprintf+0xbf/0x100
[   44.283764][ T5001]  ? vsprintf+0x30/0x30
[   44.287910][ T5001]  ? wait_for_completion_io_timeout+0x20/0x20
[   44.293972][ T5001]  mount_bdev+0x357/0x420
[   44.298293][ T5001]  ? reiserfs_remount+0x1650/0x1650
[   44.303483][ T5001]  ? reiserfs_kill_sb+0x1e0/0x1e0
[   44.308497][ T5001]  legacy_get_tree+0x109/0x220
[   44.313255][ T5001]  vfs_get_tree+0x8d/0x350
[   44.317657][ T5001]  path_mount+0x134b/0x1e40
[   44.322150][ T5001]  ? kmem_cache_free+0xe9/0x480
[   44.326995][ T5001]  ? finish_automount+0x9b0/0x9b0
[   44.332010][ T5001]  ? putname+0x102/0x140
[   44.336244][ T5001]  __x64_sys_mount+0x283/0x300
[   44.340999][ T5001]  ? copy_mnt_ns+0xb30/0xb30
[   44.345578][ T5001]  ? lockdep_hardirqs_on+0x7d/0x100
[   44.350766][ T5001]  ? _raw_spin_unlock_irq+0x2e/0x50
[   44.355959][ T5001]  ? ptrace_notify+0xfe/0x140
[   44.360627][ T5001]  do_syscall_64+0x39/0xb0
[   44.365041][ T5001]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   44.370933][ T5001] RIP: 0033:0x7f3c5049ad2a
[   44.375333][ T5001] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 f8 03 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   44.394934][ T5001] RSP: 002b:00007ffde73026a8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[   44.403422][ T5001] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f3c5049ad2a
[   44.411376][ T5001] RDX: 0000000020000140 RSI: 0000000020000340 RDI: 00007ffde73026b0
[   44.419332][ T5001] RBP: 00007ffde73026b0 R08: 00007ffde73026f0 R09: 000000000000111a
[   44.427286][ T5001] R10: 000000000120c083 R11: 0000000000000286 R12: 0000000000000004
[   44.435329][ T5001] R13: 0000555555b802b8 R14: 00007ffde73026f0 R15: 0000000000000000
[   44.443291][ T5001]  </TASK>
[   44.446293][ T5001] 
[   44.448598][ T5001] The buggy address belongs to the physical page:
[   44.454986][ T5001] page:ffffea0001cfbcc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x73ef3
[   44.465146][ T5001] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   44.472234][ T5001] page_type: 0xffffffff()
[   44.476548][ T5001] raw: 00fff00000000000 ffffea0001cfbd08 ffff8880b9843660 0000000000000000
[   44.485161][ T5001] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[   44.493721][ T5001] page dumped because: kasan: bad access detected
[   44.500197][ T5001] page_owner tracks the page as freed
[   44.505543][ T5001] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 4967, tgid 4967 (sshd), ts 37292231688, free_ts 37344330974
[   44.523585][ T5001]  post_alloc_hook+0x2db/0x350
[   44.528350][ T5001]  get_page_from_freelist+0xf41/0x2c00
[   44.533801][ T5001]  __alloc_pages+0x1cb/0x4a0
[   44.538383][ T5001]  __folio_alloc+0x16/0x40
[   44.542792][ T5001]  vma_alloc_folio+0x155/0x890
[   44.547548][ T5001]  __handle_mm_fault+0x224c/0x41c0
[   44.552643][ T5001]  handle_mm_fault+0x2af/0x9f0
[   44.557387][ T5001]  do_user_addr_fault+0x2ca/0x1210
[   44.562489][ T5001]  exc_page_fault+0x98/0x170
[   44.567070][ T5001]  asm_exc_page_fault+0x26/0x30
[   44.571919][ T5001] page last free stack trace:
[   44.576570][ T5001]  free_unref_page_prepare+0x62e/0xcb0
[   44.582020][ T5001]  free_unref_page_list+0xe3/0xa70
[   44.587121][ T5001]  release_pages+0xcd8/0x1380
[   44.591788][ T5001]  tlb_batch_pages_flush+0xa8/0x1a0
[   44.597062][ T5001]  tlb_finish_mmu+0x14b/0x7e0
[   44.601734][ T5001]  unmap_region+0x23d/0x2d0
[   44.606220][ T5001]  do_vmi_align_munmap+0xe26/0x1580
[   44.611492][ T5001]  do_vmi_munmap+0x26e/0x2c0
[   44.616073][ T5001]  __vm_munmap+0x133/0x3b0
[   44.620563][ T5001]  __x64_sys_munmap+0x62/0x80
[   44.625229][ T5001]  do_syscall_64+0x39/0xb0
[   44.629641][ T5001]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   44.635531][ T5001] 
[   44.637833][ T5001] Memory state around the buggy address:
[   44.643442][ T5001]  ffff888073ef2f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   44.651481][ T5001]  ffff888073ef2f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   44.659532][ T5001] >ffff888073ef3000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   44.667569][ T5001]                    ^
[   44.671723][ T5001]  ffff888073ef3080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   44.679762][ T5001]  ffff888073ef3100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[   44.687907][ T5001] ==================================================================
[   44.697263][ T5001] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   44.704530][ T5001] CPU: 0 PID: 5001 Comm: syz-executor471 Not tainted 6.4.0-rc1-syzkaller #0
[   44.713179][ T5001] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
[   44.723209][ T5001] Call Trace:
[   44.726554][ T5001]  <TASK>
[   44.729461][ T5001]  dump_stack_lvl+0xd9/0x150
[   44.734040][ T5001]  panic+0x686/0x730
[   44.737922][ T5001]  ? panic_smp_self_stop+0xa0/0xa0
[   44.743033][ T5001]  ? preempt_schedule_thunk+0x1a/0x20
[   44.748395][ T5001]  ? preempt_schedule_common+0x45/0xb0
[   44.753831][ T5001]  check_panic_on_warn+0xb1/0xc0
[   44.758751][ T5001]  end_report+0xe9/0x120
[   44.762980][ T5001]  ? search_by_entry_key+0x823/0x960
[   44.768242][ T5001]  kasan_report+0xf9/0x130
[   44.772665][ T5001]  ? search_by_entry_key+0x823/0x960
[   44.777929][ T5001]  search_by_entry_key+0x823/0x960
[   44.783016][ T5001]  reiserfs_find_entry.part.0+0x139/0xdf0
[   44.788712][ T5001]  ? search_by_entry_key+0x960/0x960
[   44.793969][ T5001]  ? find_held_lock+0x2d/0x110
[   44.798713][ T5001]  reiserfs_lookup+0x24e/0x610
[   44.803454][ T5001]  ? reiserfs_unlink+0x760/0x760
[   44.808366][ T5001]  ? d_alloc_parallel+0x693/0x1530
[   44.813462][ T5001]  __lookup_slow+0x24c/0x460
[   44.818033][ T5001]  ? lookup_one_qstr_excl+0x180/0x180
[   44.823379][ T5001]  ? lock_downgrade+0x690/0x690
[   44.828214][ T5001]  ? d_lookup+0x105/0x170
[   44.832520][ T5001]  lookup_one_len+0x16e/0x1a0
[   44.837174][ T5001]  ? try_lookup_one_len+0x190/0x190
[   44.842350][ T5001]  reiserfs_lookup_privroot+0x96/0x210
[   44.847812][ T5001]  reiserfs_fill_super+0x1a8d/0x2eb0
[   44.853083][ T5001]  ? reiserfs_remount+0x1650/0x1650
[   44.858264][ T5001]  ? snprintf+0xbf/0x100
[   44.862489][ T5001]  ? vsprintf+0x30/0x30
[   44.866622][ T5001]  ? wait_for_completion_io_timeout+0x20/0x20
[   44.872671][ T5001]  mount_bdev+0x357/0x420
[   44.876982][ T5001]  ? reiserfs_remount+0x1650/0x1650
[   44.882175][ T5001]  ? reiserfs_kill_sb+0x1e0/0x1e0
[   44.887179][ T5001]  legacy_get_tree+0x109/0x220
[   44.891923][ T5001]  vfs_get_tree+0x8d/0x350
[   44.896319][ T5001]  path_mount+0x134b/0x1e40
[   44.900816][ T5001]  ? kmem_cache_free+0xe9/0x480
[   44.905648][ T5001]  ? finish_automount+0x9b0/0x9b0
[   44.910653][ T5001]  ? putname+0x102/0x140
[   44.914874][ T5001]  __x64_sys_mount+0x283/0x300
[   44.919618][ T5001]  ? copy_mnt_ns+0xb30/0xb30
[   44.924185][ T5001]  ? lockdep_hardirqs_on+0x7d/0x100
[   44.929362][ T5001]  ? _raw_spin_unlock_irq+0x2e/0x50
[   44.934638][ T5001]  ? ptrace_notify+0xfe/0x140
[   44.939312][ T5001]  do_syscall_64+0x39/0xb0
[   44.943714][ T5001]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   44.949593][ T5001] RIP: 0033:0x7f3c5049ad2a
[   44.953987][ T5001] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 f8 03 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   44.973571][ T5001] RSP: 002b:00007ffde73026a8 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[   44.982048][ T5001] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f3c5049ad2a
[   44.989996][ T5001] RDX: 0000000020000140 RSI: 0000000020000340 RDI: 00007ffde73026b0
[   44.997945][ T5001] RBP: 00007ffde73026b0 R08: 00007ffde73026f0 R09: 000000000000111a
[   45.005899][ T5001] R10: 000000000120c083 R11: 0000000000000286 R12: 0000000000000004
[   45.013860][ T5001] R13: 0000555555b802b8 R14: 00007ffde73026f0 R15: 0000000000000000
[   45.021814][ T5001]  </TASK>
[   45.025655][ T5001] Kernel Offset: disabled
[   45.029962][ T5001] Rebooting in 86400 seconds..